Analysis
-
max time kernel
33s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
29-06-2024 04:21
Static task
static1
Behavioral task
behavioral1
Sample
e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe
Resource
win7-20240508-en
General
-
Target
e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe
-
Size
732KB
-
MD5
113aaec1011cf6a0e1db11100b603d36
-
SHA1
eb68cbe430ec0b1e3c07a81819f09dd84de31e4e
-
SHA256
e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50
-
SHA512
77c9ee398ba36e9b13270ffe467c72cc54a099e607a57672c80e9dfc1516ef3f11dc189b0f8faf7ce5751c18fdd1684e74b33503b2b0524ee205f65427746c43
-
SSDEEP
12288:RTyjXW+48qWywrU4kGFezOAVuJ5PIIww7F5DO3HYffJQC:VIXW/8yw1ez54lIeF5SXYHJ7
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
Processes:
e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exerundll32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" rundll32.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exerundll32.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Set value (int) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" rundll32.exe -
Processes:
rundll32.exee63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe -
Processes:
e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exerundll32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" rundll32.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 41 IoCs
Processes:
resource yara_rule behavioral2/memory/2028-3-0x00000000032D0000-0x000000000435E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2028-13-0x00000000032D0000-0x000000000435E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2028-7-0x00000000032D0000-0x000000000435E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2028-6-0x00000000032D0000-0x000000000435E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2028-5-0x00000000032D0000-0x000000000435E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2028-1-0x00000000032D0000-0x000000000435E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2028-8-0x00000000032D0000-0x000000000435E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2028-9-0x00000000032D0000-0x000000000435E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2028-10-0x00000000032D0000-0x000000000435E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2028-20-0x00000000032D0000-0x000000000435E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2028-19-0x00000000032D0000-0x000000000435E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2028-21-0x00000000032D0000-0x000000000435E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2028-25-0x00000000032D0000-0x000000000435E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2028-24-0x00000000032D0000-0x000000000435E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2028-30-0x00000000032D0000-0x000000000435E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4016-56-0x0000000004EC0000-0x0000000005F4E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4016-57-0x0000000004EC0000-0x0000000005F4E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4016-62-0x0000000004EC0000-0x0000000005F4E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4016-53-0x0000000004EC0000-0x0000000005F4E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4016-58-0x0000000004EC0000-0x0000000005F4E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4016-50-0x0000000004EC0000-0x0000000005F4E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4016-55-0x0000000004EC0000-0x0000000005F4E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4016-54-0x0000000004EC0000-0x0000000005F4E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4016-52-0x0000000004EC0000-0x0000000005F4E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4016-59-0x0000000004EC0000-0x0000000005F4E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4016-65-0x0000000004EC0000-0x0000000005F4E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4016-66-0x0000000004EC0000-0x0000000005F4E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4016-70-0x0000000004EC0000-0x0000000005F4E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4016-71-0x0000000004EC0000-0x0000000005F4E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4016-72-0x0000000004EC0000-0x0000000005F4E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4016-74-0x0000000004EC0000-0x0000000005F4E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4016-75-0x0000000004EC0000-0x0000000005F4E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4016-76-0x0000000004EC0000-0x0000000005F4E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4016-77-0x0000000004EC0000-0x0000000005F4E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4016-80-0x0000000004EC0000-0x0000000005F4E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4016-79-0x0000000004EC0000-0x0000000005F4E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4016-82-0x0000000004EC0000-0x0000000005F4E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4016-86-0x0000000004EC0000-0x0000000005F4E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4016-122-0x0000000004EC0000-0x0000000005F4E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine C:\gwgoc.exe INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4016-148-0x0000000004EC0000-0x0000000005F4E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 43 IoCs
Processes:
resource yara_rule behavioral2/memory/2028-3-0x00000000032D0000-0x000000000435E000-memory.dmp UPX behavioral2/memory/2028-13-0x00000000032D0000-0x000000000435E000-memory.dmp UPX behavioral2/memory/2028-7-0x00000000032D0000-0x000000000435E000-memory.dmp UPX behavioral2/memory/2028-6-0x00000000032D0000-0x000000000435E000-memory.dmp UPX behavioral2/memory/2028-5-0x00000000032D0000-0x000000000435E000-memory.dmp UPX behavioral2/memory/2028-1-0x00000000032D0000-0x000000000435E000-memory.dmp UPX behavioral2/memory/2028-8-0x00000000032D0000-0x000000000435E000-memory.dmp UPX behavioral2/memory/2028-9-0x00000000032D0000-0x000000000435E000-memory.dmp UPX behavioral2/memory/2028-10-0x00000000032D0000-0x000000000435E000-memory.dmp UPX behavioral2/memory/2028-20-0x00000000032D0000-0x000000000435E000-memory.dmp UPX behavioral2/memory/2028-19-0x00000000032D0000-0x000000000435E000-memory.dmp UPX behavioral2/memory/2028-21-0x00000000032D0000-0x000000000435E000-memory.dmp UPX behavioral2/memory/2028-25-0x00000000032D0000-0x000000000435E000-memory.dmp UPX behavioral2/memory/2028-24-0x00000000032D0000-0x000000000435E000-memory.dmp UPX behavioral2/memory/2028-30-0x00000000032D0000-0x000000000435E000-memory.dmp UPX behavioral2/memory/4016-45-0x0000000000400000-0x00000000004BF000-memory.dmp UPX behavioral2/memory/2028-49-0x0000000000400000-0x00000000004BF000-memory.dmp UPX behavioral2/memory/4016-56-0x0000000004EC0000-0x0000000005F4E000-memory.dmp UPX behavioral2/memory/4016-57-0x0000000004EC0000-0x0000000005F4E000-memory.dmp UPX behavioral2/memory/4016-62-0x0000000004EC0000-0x0000000005F4E000-memory.dmp UPX behavioral2/memory/4016-53-0x0000000004EC0000-0x0000000005F4E000-memory.dmp UPX behavioral2/memory/4016-58-0x0000000004EC0000-0x0000000005F4E000-memory.dmp UPX behavioral2/memory/4016-50-0x0000000004EC0000-0x0000000005F4E000-memory.dmp UPX behavioral2/memory/4016-55-0x0000000004EC0000-0x0000000005F4E000-memory.dmp UPX behavioral2/memory/4016-54-0x0000000004EC0000-0x0000000005F4E000-memory.dmp UPX behavioral2/memory/4016-52-0x0000000004EC0000-0x0000000005F4E000-memory.dmp UPX behavioral2/memory/4016-59-0x0000000004EC0000-0x0000000005F4E000-memory.dmp UPX behavioral2/memory/4016-65-0x0000000004EC0000-0x0000000005F4E000-memory.dmp UPX behavioral2/memory/4016-66-0x0000000004EC0000-0x0000000005F4E000-memory.dmp UPX behavioral2/memory/4016-70-0x0000000004EC0000-0x0000000005F4E000-memory.dmp UPX behavioral2/memory/4016-71-0x0000000004EC0000-0x0000000005F4E000-memory.dmp UPX behavioral2/memory/4016-72-0x0000000004EC0000-0x0000000005F4E000-memory.dmp UPX behavioral2/memory/4016-74-0x0000000004EC0000-0x0000000005F4E000-memory.dmp UPX behavioral2/memory/4016-75-0x0000000004EC0000-0x0000000005F4E000-memory.dmp UPX behavioral2/memory/4016-76-0x0000000004EC0000-0x0000000005F4E000-memory.dmp UPX behavioral2/memory/4016-77-0x0000000004EC0000-0x0000000005F4E000-memory.dmp UPX behavioral2/memory/4016-80-0x0000000004EC0000-0x0000000005F4E000-memory.dmp UPX behavioral2/memory/4016-79-0x0000000004EC0000-0x0000000005F4E000-memory.dmp UPX behavioral2/memory/4016-82-0x0000000004EC0000-0x0000000005F4E000-memory.dmp UPX behavioral2/memory/4016-86-0x0000000004EC0000-0x0000000005F4E000-memory.dmp UPX behavioral2/memory/4016-122-0x0000000004EC0000-0x0000000005F4E000-memory.dmp UPX behavioral2/memory/4016-147-0x0000000000400000-0x00000000004BF000-memory.dmp UPX behavioral2/memory/4016-148-0x0000000004EC0000-0x0000000005F4E000-memory.dmp UPX -
Deletes itself 1 IoCs
Processes:
rundll32.exepid process 4016 rundll32.exe -
Executes dropped EXE 1 IoCs
Processes:
rundll32.exepid process 4016 rundll32.exe -
Processes:
resource yara_rule behavioral2/memory/2028-3-0x00000000032D0000-0x000000000435E000-memory.dmp upx behavioral2/memory/2028-13-0x00000000032D0000-0x000000000435E000-memory.dmp upx behavioral2/memory/2028-7-0x00000000032D0000-0x000000000435E000-memory.dmp upx behavioral2/memory/2028-6-0x00000000032D0000-0x000000000435E000-memory.dmp upx behavioral2/memory/2028-5-0x00000000032D0000-0x000000000435E000-memory.dmp upx behavioral2/memory/2028-1-0x00000000032D0000-0x000000000435E000-memory.dmp upx behavioral2/memory/2028-8-0x00000000032D0000-0x000000000435E000-memory.dmp upx behavioral2/memory/2028-9-0x00000000032D0000-0x000000000435E000-memory.dmp upx behavioral2/memory/2028-10-0x00000000032D0000-0x000000000435E000-memory.dmp upx behavioral2/memory/2028-20-0x00000000032D0000-0x000000000435E000-memory.dmp upx behavioral2/memory/2028-19-0x00000000032D0000-0x000000000435E000-memory.dmp upx behavioral2/memory/2028-21-0x00000000032D0000-0x000000000435E000-memory.dmp upx behavioral2/memory/2028-25-0x00000000032D0000-0x000000000435E000-memory.dmp upx behavioral2/memory/2028-24-0x00000000032D0000-0x000000000435E000-memory.dmp upx behavioral2/memory/2028-30-0x00000000032D0000-0x000000000435E000-memory.dmp upx behavioral2/memory/4016-56-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/4016-57-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/4016-62-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/4016-53-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/4016-58-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/4016-50-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/4016-55-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/4016-54-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/4016-52-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/4016-59-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/4016-65-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/4016-66-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/4016-70-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/4016-71-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/4016-72-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/4016-74-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/4016-75-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/4016-76-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/4016-77-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/4016-80-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/4016-79-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/4016-82-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/4016-86-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/4016-122-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx behavioral2/memory/4016-148-0x0000000004EC0000-0x0000000005F4E000-memory.dmp upx -
Processes:
e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exerundll32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" rundll32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Office\\rundll32.exe" e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe -
Processes:
e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exerundll32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rundll32.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
rundll32.exee63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exedescription ioc process File opened (read-only) \??\K: rundll32.exe File opened (read-only) \??\L: rundll32.exe File opened (read-only) \??\N: rundll32.exe File opened (read-only) \??\Q: rundll32.exe File opened (read-only) \??\T: rundll32.exe File opened (read-only) \??\E: e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe File opened (read-only) \??\B: rundll32.exe File opened (read-only) \??\H: rundll32.exe File opened (read-only) \??\Z: rundll32.exe File opened (read-only) \??\Y: rundll32.exe File opened (read-only) \??\G: rundll32.exe File opened (read-only) \??\J: rundll32.exe File opened (read-only) \??\O: rundll32.exe File opened (read-only) \??\M: rundll32.exe File opened (read-only) \??\P: rundll32.exe File opened (read-only) \??\X: rundll32.exe File opened (read-only) \??\A: rundll32.exe File opened (read-only) \??\E: rundll32.exe File opened (read-only) \??\I: rundll32.exe File opened (read-only) \??\V: rundll32.exe File opened (read-only) \??\W: rundll32.exe File opened (read-only) \??\R: rundll32.exe File opened (read-only) \??\S: rundll32.exe File opened (read-only) \??\U: rundll32.exe -
Drops file in Windows directory 1 IoCs
Processes:
e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exerundll32.exepid process 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe 4016 rundll32.exe 4016 rundll32.exe 4016 rundll32.exe 4016 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exedescription pid process Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Token: SeDebugPrivilege 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exerundll32.exepid process 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe 4016 rundll32.exe -
Suspicious use of WriteProcessMemory 56 IoCs
Processes:
e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exerundll32.exedescription pid process target process PID 2028 wrote to memory of 788 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe fontdrvhost.exe PID 2028 wrote to memory of 784 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe fontdrvhost.exe PID 2028 wrote to memory of 380 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe dwm.exe PID 2028 wrote to memory of 2528 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe sihost.exe PID 2028 wrote to memory of 2568 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe svchost.exe PID 2028 wrote to memory of 2664 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe taskhostw.exe PID 2028 wrote to memory of 3424 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Explorer.EXE PID 2028 wrote to memory of 3584 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe svchost.exe PID 2028 wrote to memory of 3776 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe DllHost.exe PID 2028 wrote to memory of 3872 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe StartMenuExperienceHost.exe PID 2028 wrote to memory of 3932 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe RuntimeBroker.exe PID 2028 wrote to memory of 4024 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe SearchApp.exe PID 2028 wrote to memory of 2356 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe RuntimeBroker.exe PID 2028 wrote to memory of 1468 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe TextInputHost.exe PID 2028 wrote to memory of 3484 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe RuntimeBroker.exe PID 2028 wrote to memory of 1364 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe backgroundTaskHost.exe PID 2028 wrote to memory of 3008 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe backgroundTaskHost.exe PID 2028 wrote to memory of 4016 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe rundll32.exe PID 2028 wrote to memory of 4016 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe rundll32.exe PID 2028 wrote to memory of 4016 2028 e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe rundll32.exe PID 4016 wrote to memory of 788 4016 rundll32.exe fontdrvhost.exe PID 4016 wrote to memory of 784 4016 rundll32.exe fontdrvhost.exe PID 4016 wrote to memory of 380 4016 rundll32.exe dwm.exe PID 4016 wrote to memory of 2528 4016 rundll32.exe sihost.exe PID 4016 wrote to memory of 2568 4016 rundll32.exe svchost.exe PID 4016 wrote to memory of 2664 4016 rundll32.exe taskhostw.exe PID 4016 wrote to memory of 3424 4016 rundll32.exe Explorer.EXE PID 4016 wrote to memory of 3584 4016 rundll32.exe svchost.exe PID 4016 wrote to memory of 3776 4016 rundll32.exe DllHost.exe PID 4016 wrote to memory of 3872 4016 rundll32.exe StartMenuExperienceHost.exe PID 4016 wrote to memory of 3932 4016 rundll32.exe RuntimeBroker.exe PID 4016 wrote to memory of 4024 4016 rundll32.exe SearchApp.exe PID 4016 wrote to memory of 2356 4016 rundll32.exe RuntimeBroker.exe PID 4016 wrote to memory of 1468 4016 rundll32.exe TextInputHost.exe PID 4016 wrote to memory of 3484 4016 rundll32.exe RuntimeBroker.exe PID 4016 wrote to memory of 1364 4016 rundll32.exe backgroundTaskHost.exe PID 4016 wrote to memory of 2432 4016 rundll32.exe RuntimeBroker.exe PID 4016 wrote to memory of 2472 4016 rundll32.exe RuntimeBroker.exe PID 4016 wrote to memory of 788 4016 rundll32.exe fontdrvhost.exe PID 4016 wrote to memory of 784 4016 rundll32.exe fontdrvhost.exe PID 4016 wrote to memory of 380 4016 rundll32.exe dwm.exe PID 4016 wrote to memory of 2528 4016 rundll32.exe sihost.exe PID 4016 wrote to memory of 2568 4016 rundll32.exe svchost.exe PID 4016 wrote to memory of 2664 4016 rundll32.exe taskhostw.exe PID 4016 wrote to memory of 3424 4016 rundll32.exe Explorer.EXE PID 4016 wrote to memory of 3584 4016 rundll32.exe svchost.exe PID 4016 wrote to memory of 3776 4016 rundll32.exe DllHost.exe PID 4016 wrote to memory of 3872 4016 rundll32.exe StartMenuExperienceHost.exe PID 4016 wrote to memory of 3932 4016 rundll32.exe RuntimeBroker.exe PID 4016 wrote to memory of 4024 4016 rundll32.exe SearchApp.exe PID 4016 wrote to memory of 2356 4016 rundll32.exe RuntimeBroker.exe PID 4016 wrote to memory of 1468 4016 rundll32.exe TextInputHost.exe PID 4016 wrote to memory of 3484 4016 rundll32.exe RuntimeBroker.exe PID 4016 wrote to memory of 1364 4016 rundll32.exe backgroundTaskHost.exe PID 4016 wrote to memory of 2432 4016 rundll32.exe RuntimeBroker.exe PID 4016 wrote to memory of 2472 4016 rundll32.exe RuntimeBroker.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exerundll32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rundll32.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe"C:\Users\Admin\AppData\Local\Temp\e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50.exe"2⤵
- Modifies firewall policy service
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exeC:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe3⤵
- Modifies firewall policy service
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Windows security bypass
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
8Impair Defenses
4Disable or Modify Tools
3Disable or Modify System Firewall
1Hide Artifacts
2Hidden Files and Directories
2Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\0E574A76_Rar\rundll32.exeFilesize
664KB
MD52eb5d76180ce7b3241b281fa79ab3483
SHA106293dea80e39c7eb7ee2bdb00d60b58d932fa8a
SHA256e1b9beb4617a720d55afaec364941bb18ea2c456a8b06b30a736f0cbb5c297e8
SHA51235f553c76fc67afb88a6a090fcbad6af3e2faae154c9c84bd869714194012525a2d42b76dad855805f107a37c351f0de08fd9a03d8ddc1dd400d64640d81b90b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exeFilesize
732KB
MD5113aaec1011cf6a0e1db11100b603d36
SHA1eb68cbe430ec0b1e3c07a81819f09dd84de31e4e
SHA256e63d0241072b0c54aa33feca3c08b217e13a337e554aac2d579d15b60f1ecc50
SHA51277c9ee398ba36e9b13270ffe467c72cc54a099e607a57672c80e9dfc1516ef3f11dc189b0f8faf7ce5751c18fdd1684e74b33503b2b0524ee205f65427746c43
-
C:\Windows\SYSTEM.INIFilesize
257B
MD5b32cb20bda59bb9d5d1756c596c4ac82
SHA12a633939bbac09f5114167f93b574f1de31aded5
SHA256b6a616ca3e553b0cc7bed801d9bf6fc8bc26c3fdc97fdda6781b1d13e37723eb
SHA512159d71a0249fef9b0fbc9689218fff888efa5e99900e6c8c1c49743383a3b17a4a3981a7eff7c7819e92591a7361f06f0eb5ec1965f840503de5297715621310
-
C:\gwgoc.exeFilesize
100KB
MD5245bd820be8459308693b5f20df39ef5
SHA157d4240c7f0841903b163ba99bd537f6ad31e2b9
SHA256d1c67b6ecfbf08fae0f7860fd262b21f151a33eb67d9b0eb169cc9e57304edd9
SHA512572ed74128b0769f4f83b84513101c3c8dc3ffa1a519042462135d59e127ec7b44452c71894998a899a182b86aef63ff76bdc82bdc272eee28975e96aa126466
-
memory/2028-0-0x0000000000400000-0x00000000004BF000-memory.dmpFilesize
764KB
-
memory/2028-3-0x00000000032D0000-0x000000000435E000-memory.dmpFilesize
16.6MB
-
memory/2028-13-0x00000000032D0000-0x000000000435E000-memory.dmpFilesize
16.6MB
-
memory/2028-7-0x00000000032D0000-0x000000000435E000-memory.dmpFilesize
16.6MB
-
memory/2028-6-0x00000000032D0000-0x000000000435E000-memory.dmpFilesize
16.6MB
-
memory/2028-5-0x00000000032D0000-0x000000000435E000-memory.dmpFilesize
16.6MB
-
memory/2028-11-0x00000000009F0000-0x00000000009F2000-memory.dmpFilesize
8KB
-
memory/2028-1-0x00000000032D0000-0x000000000435E000-memory.dmpFilesize
16.6MB
-
memory/2028-8-0x00000000032D0000-0x000000000435E000-memory.dmpFilesize
16.6MB
-
memory/2028-9-0x00000000032D0000-0x000000000435E000-memory.dmpFilesize
16.6MB
-
memory/2028-18-0x00000000009F0000-0x00000000009F2000-memory.dmpFilesize
8KB
-
memory/2028-10-0x00000000032D0000-0x000000000435E000-memory.dmpFilesize
16.6MB
-
memory/2028-14-0x00000000009F0000-0x00000000009F2000-memory.dmpFilesize
8KB
-
memory/2028-12-0x0000000000A10000-0x0000000000A11000-memory.dmpFilesize
4KB
-
memory/2028-20-0x00000000032D0000-0x000000000435E000-memory.dmpFilesize
16.6MB
-
memory/2028-19-0x00000000032D0000-0x000000000435E000-memory.dmpFilesize
16.6MB
-
memory/2028-21-0x00000000032D0000-0x000000000435E000-memory.dmpFilesize
16.6MB
-
memory/2028-25-0x00000000032D0000-0x000000000435E000-memory.dmpFilesize
16.6MB
-
memory/2028-24-0x00000000032D0000-0x000000000435E000-memory.dmpFilesize
16.6MB
-
memory/2028-30-0x00000000032D0000-0x000000000435E000-memory.dmpFilesize
16.6MB
-
memory/2028-49-0x0000000000400000-0x00000000004BF000-memory.dmpFilesize
764KB
-
memory/4016-45-0x0000000000400000-0x00000000004BF000-memory.dmpFilesize
764KB
-
memory/4016-56-0x0000000004EC0000-0x0000000005F4E000-memory.dmpFilesize
16.6MB
-
memory/4016-57-0x0000000004EC0000-0x0000000005F4E000-memory.dmpFilesize
16.6MB
-
memory/4016-63-0x0000000003720000-0x0000000003722000-memory.dmpFilesize
8KB
-
memory/4016-64-0x0000000003720000-0x0000000003722000-memory.dmpFilesize
8KB
-
memory/4016-62-0x0000000004EC0000-0x0000000005F4E000-memory.dmpFilesize
16.6MB
-
memory/4016-53-0x0000000004EC0000-0x0000000005F4E000-memory.dmpFilesize
16.6MB
-
memory/4016-58-0x0000000004EC0000-0x0000000005F4E000-memory.dmpFilesize
16.6MB
-
memory/4016-61-0x0000000003830000-0x0000000003831000-memory.dmpFilesize
4KB
-
memory/4016-50-0x0000000004EC0000-0x0000000005F4E000-memory.dmpFilesize
16.6MB
-
memory/4016-55-0x0000000004EC0000-0x0000000005F4E000-memory.dmpFilesize
16.6MB
-
memory/4016-54-0x0000000004EC0000-0x0000000005F4E000-memory.dmpFilesize
16.6MB
-
memory/4016-52-0x0000000004EC0000-0x0000000005F4E000-memory.dmpFilesize
16.6MB
-
memory/4016-59-0x0000000004EC0000-0x0000000005F4E000-memory.dmpFilesize
16.6MB
-
memory/4016-65-0x0000000004EC0000-0x0000000005F4E000-memory.dmpFilesize
16.6MB
-
memory/4016-66-0x0000000004EC0000-0x0000000005F4E000-memory.dmpFilesize
16.6MB
-
memory/4016-70-0x0000000004EC0000-0x0000000005F4E000-memory.dmpFilesize
16.6MB
-
memory/4016-71-0x0000000004EC0000-0x0000000005F4E000-memory.dmpFilesize
16.6MB
-
memory/4016-72-0x0000000004EC0000-0x0000000005F4E000-memory.dmpFilesize
16.6MB
-
memory/4016-74-0x0000000004EC0000-0x0000000005F4E000-memory.dmpFilesize
16.6MB
-
memory/4016-75-0x0000000004EC0000-0x0000000005F4E000-memory.dmpFilesize
16.6MB
-
memory/4016-76-0x0000000004EC0000-0x0000000005F4E000-memory.dmpFilesize
16.6MB
-
memory/4016-77-0x0000000004EC0000-0x0000000005F4E000-memory.dmpFilesize
16.6MB
-
memory/4016-80-0x0000000004EC0000-0x0000000005F4E000-memory.dmpFilesize
16.6MB
-
memory/4016-79-0x0000000004EC0000-0x0000000005F4E000-memory.dmpFilesize
16.6MB
-
memory/4016-82-0x0000000004EC0000-0x0000000005F4E000-memory.dmpFilesize
16.6MB
-
memory/4016-86-0x0000000004EC0000-0x0000000005F4E000-memory.dmpFilesize
16.6MB
-
memory/4016-122-0x0000000004EC0000-0x0000000005F4E000-memory.dmpFilesize
16.6MB
-
memory/4016-123-0x0000000003720000-0x0000000003722000-memory.dmpFilesize
8KB
-
memory/4016-147-0x0000000000400000-0x00000000004BF000-memory.dmpFilesize
764KB
-
memory/4016-148-0x0000000004EC0000-0x0000000005F4E000-memory.dmpFilesize
16.6MB