sality | 98b305ee6b43a2670a5fbd055dfcd73ddca292fb99ababa682b7b53900e955cf

Analysis

max time kernel
96s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2024 09:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

98b305ee6b43a2670a5fbd055dfcd73ddca292fb99ababa682b7b53900e955cf_NeikiAnalytics.dll
Size

120KB
MD5

ad0c33a9570cbac2479906690f402a20
SHA1

92b2f183d1b96277446f7ef4ad1b771c2030245f
SHA256

98b305ee6b43a2670a5fbd055dfcd73ddca292fb99ababa682b7b53900e955cf
SHA512

ec99b18b812f3b0c4552f36328eecd31472c06047b9dffe9e472b9f7d82b55d6948c23c35af1b825df81139200c5bdaaa9344c54d212ae66e26469e5d1b287e4
SSDEEP

1536:pbUuETPXHLg6ApxwZKZscFuAqa/sMb/fNyK9kLAnWZKHub1IupVCD02Pj:QDXr6OrMbHN3ycWUObRpI42P

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 3 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

e577436.exee578ffb.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	e577436.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	e577436.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	e577436.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	e578ffb.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	e578ffb.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	e578ffb.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e577436.exee578ffb.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e577436.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e578ffb.exe

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e577436.exee578ffb.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e577436.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e577436.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e577436.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e577436.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e577436.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e578ffb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e578ffb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e578ffb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e578ffb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e578ffb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e578ffb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e577436.exe

Executes dropped EXE 4 IoCs

Processes:

e577436.exee5775bc.exee578fcc.exee578ffb.exe

pid process

3468 e577436.exe
2440 e5775bc.exe
4080 e578fcc.exe
4512 e578ffb.exe

pid	process
3468	e577436.exe
2440	e5775bc.exe
4080	e578fcc.exe
4512	e578ffb.exe

UPX packed file 33 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3468-6-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3468-10-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3468-8-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3468-9-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3468-14-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3468-32-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3468-28-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3468-11-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3468-34-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3468-33-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3468-35-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3468-36-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3468-37-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3468-38-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3468-39-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3468-40-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3468-42-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3468-56-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3468-57-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3468-59-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3468-72-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3468-75-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3468-76-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3468-79-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3468-82-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3468-83-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3468-85-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3468-87-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3468-88-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3468-90-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/3468-89-0x00000000007C0000-0x000000000187A000-memory.dmp	upx
behavioral2/memory/4512-125-0x0000000000B20000-0x0000000001BDA000-memory.dmp	upx
behavioral2/memory/4512-162-0x0000000000B20000-0x0000000001BDA000-memory.dmp	upx

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e578ffb.exee577436.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e578ffb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	e577436.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e577436.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e577436.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e577436.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e578ffb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e578ffb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e577436.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e577436.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e577436.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e578ffb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e578ffb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e578ffb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	e578ffb.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

e577436.exee578ffb.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e577436.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e578ffb.exe

Enumerates connected drives 3 TTPs 15 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

e577436.exee578ffb.exe

description	ioc	process
File opened (read-only)	\??\G:	e577436.exe
File opened (read-only)	\??\K:	e577436.exe
File opened (read-only)	\??\N:	e577436.exe
File opened (read-only)	\??\P:	e577436.exe
File opened (read-only)	\??\Q:	e577436.exe
File opened (read-only)	\??\J:	e577436.exe
File opened (read-only)	\??\G:	e578ffb.exe
File opened (read-only)	\??\L:	e577436.exe
File opened (read-only)	\??\R:	e577436.exe
File opened (read-only)	\??\E:	e577436.exe
File opened (read-only)	\??\H:	e577436.exe
File opened (read-only)	\??\I:	e577436.exe
File opened (read-only)	\??\M:	e577436.exe
File opened (read-only)	\??\O:	e577436.exe
File opened (read-only)	\??\E:	e578ffb.exe

Drops file in Program Files directory 4 IoCs

Processes:

e577436.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\7z.exe	e577436.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	e577436.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	e577436.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	e577436.exe

Drops file in Windows directory 3 IoCs

Processes:

e577436.exee578ffb.exe

description ioc process

File created C:\Windows\e577494 e577436.exe
File opened for modification C:\Windows\SYSTEM.INI e577436.exe
File created C:\Windows\e57c534 e578ffb.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

e577436.exee578ffb.exe

pid process

3468 e577436.exe
3468 e577436.exe
3468 e577436.exe
3468 e577436.exe
4512 e578ffb.exe
4512 e578ffb.exe

description	ioc	process
File created	C:\Windows\e577494	e577436.exe
File opened for modification	C:\Windows\SYSTEM.INI	e577436.exe
File created	C:\Windows\e57c534	e578ffb.exe

pid	process
3468	e577436.exe
3468	e577436.exe
3468	e577436.exe
3468	e577436.exe
4512	e578ffb.exe
4512	e578ffb.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

e577436.exe

description	pid	process
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe
Token: SeDebugPrivilege	3468	e577436.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

rundll32.exerundll32.exee577436.exee578ffb.exe

description	pid	process	target process
PID 2664 wrote to memory of 4288	2664	rundll32.exe	rundll32.exe
PID 2664 wrote to memory of 4288	2664	rundll32.exe	rundll32.exe
PID 2664 wrote to memory of 4288	2664	rundll32.exe	rundll32.exe
PID 4288 wrote to memory of 3468	4288	rundll32.exe	e577436.exe
PID 4288 wrote to memory of 3468	4288	rundll32.exe	e577436.exe
PID 4288 wrote to memory of 3468	4288	rundll32.exe	e577436.exe
PID 3468 wrote to memory of 780	3468	e577436.exe	fontdrvhost.exe
PID 3468 wrote to memory of 788	3468	e577436.exe	fontdrvhost.exe
PID 3468 wrote to memory of 336	3468	e577436.exe	dwm.exe
PID 3468 wrote to memory of 2556	3468	e577436.exe	sihost.exe
PID 3468 wrote to memory of 2592	3468	e577436.exe	svchost.exe
PID 3468 wrote to memory of 2680	3468	e577436.exe	taskhostw.exe
PID 3468 wrote to memory of 3552	3468	e577436.exe	Explorer.EXE
PID 3468 wrote to memory of 3660	3468	e577436.exe	svchost.exe
PID 3468 wrote to memory of 3856	3468	e577436.exe	DllHost.exe
PID 3468 wrote to memory of 3948	3468	e577436.exe	StartMenuExperienceHost.exe
PID 3468 wrote to memory of 4036	3468	e577436.exe	RuntimeBroker.exe
PID 3468 wrote to memory of 404	3468	e577436.exe	SearchApp.exe
PID 3468 wrote to memory of 3564	3468	e577436.exe	RuntimeBroker.exe
PID 3468 wrote to memory of 4216	3468	e577436.exe	RuntimeBroker.exe
PID 3468 wrote to memory of 1488	3468	e577436.exe	TextInputHost.exe
PID 3468 wrote to memory of 2664	3468	e577436.exe	rundll32.exe
PID 3468 wrote to memory of 4288	3468	e577436.exe	rundll32.exe
PID 3468 wrote to memory of 4288	3468	e577436.exe	rundll32.exe
PID 4288 wrote to memory of 2440	4288	rundll32.exe	e5775bc.exe
PID 4288 wrote to memory of 2440	4288	rundll32.exe	e5775bc.exe
PID 4288 wrote to memory of 2440	4288	rundll32.exe	e5775bc.exe
PID 4288 wrote to memory of 4080	4288	rundll32.exe	e578fcc.exe
PID 4288 wrote to memory of 4080	4288	rundll32.exe	e578fcc.exe
PID 4288 wrote to memory of 4080	4288	rundll32.exe	e578fcc.exe
PID 4288 wrote to memory of 4512	4288	rundll32.exe	e578ffb.exe
PID 4288 wrote to memory of 4512	4288	rundll32.exe	e578ffb.exe
PID 4288 wrote to memory of 4512	4288	rundll32.exe	e578ffb.exe
PID 3468 wrote to memory of 780	3468	e577436.exe	fontdrvhost.exe
PID 3468 wrote to memory of 788	3468	e577436.exe	fontdrvhost.exe
PID 3468 wrote to memory of 336	3468	e577436.exe	dwm.exe
PID 3468 wrote to memory of 2556	3468	e577436.exe	sihost.exe
PID 3468 wrote to memory of 2592	3468	e577436.exe	svchost.exe
PID 3468 wrote to memory of 2680	3468	e577436.exe	taskhostw.exe
PID 3468 wrote to memory of 3552	3468	e577436.exe	Explorer.EXE
PID 3468 wrote to memory of 3660	3468	e577436.exe	svchost.exe
PID 3468 wrote to memory of 3856	3468	e577436.exe	DllHost.exe
PID 3468 wrote to memory of 3948	3468	e577436.exe	StartMenuExperienceHost.exe
PID 3468 wrote to memory of 4036	3468	e577436.exe	RuntimeBroker.exe
PID 3468 wrote to memory of 404	3468	e577436.exe	SearchApp.exe
PID 3468 wrote to memory of 3564	3468	e577436.exe	RuntimeBroker.exe
PID 3468 wrote to memory of 4216	3468	e577436.exe	RuntimeBroker.exe
PID 3468 wrote to memory of 1488	3468	e577436.exe	TextInputHost.exe
PID 3468 wrote to memory of 2440	3468	e577436.exe	e5775bc.exe
PID 3468 wrote to memory of 2440	3468	e577436.exe	e5775bc.exe
PID 3468 wrote to memory of 4080	3468	e577436.exe	e578fcc.exe
PID 3468 wrote to memory of 4080	3468	e577436.exe	e578fcc.exe
PID 3468 wrote to memory of 4512	3468	e577436.exe	e578ffb.exe
PID 3468 wrote to memory of 4512	3468	e577436.exe	e578ffb.exe
PID 4512 wrote to memory of 780	4512	e578ffb.exe	fontdrvhost.exe
PID 4512 wrote to memory of 788	4512	e578ffb.exe	fontdrvhost.exe
PID 4512 wrote to memory of 336	4512	e578ffb.exe	dwm.exe
PID 4512 wrote to memory of 2556	4512	e578ffb.exe	sihost.exe
PID 4512 wrote to memory of 2592	4512	e578ffb.exe	svchost.exe
PID 4512 wrote to memory of 2680	4512	e578ffb.exe	taskhostw.exe
PID 4512 wrote to memory of 3552	4512	e578ffb.exe	Explorer.EXE
PID 4512 wrote to memory of 3660	4512	e578ffb.exe	svchost.exe
PID 4512 wrote to memory of 3856	4512	e578ffb.exe	DllHost.exe
PID 4512 wrote to memory of 3948	4512	e578ffb.exe	StartMenuExperienceHost.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

e577436.exee578ffb.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e577436.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e578ffb.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:780

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:788

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:336

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2592

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2680

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3552

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\98b305ee6b43a2670a5fbd055dfcd73ddca292fb99ababa682b7b53900e955cf_NeikiAnalytics.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2664

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\98b305ee6b43a2670a5fbd055dfcd73ddca292fb99ababa682b7b53900e955cf_NeikiAnalytics.dll,#1
3⤵
- Suspicious use of WriteProcessMemory
PID:4288

C:\Users\Admin\AppData\Local\Temp\e577436.exe
C:\Users\Admin\AppData\Local\Temp\e577436.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3468

C:\Users\Admin\AppData\Local\Temp\e5775bc.exe
C:\Users\Admin\AppData\Local\Temp\e5775bc.exe
4⤵
- Executes dropped EXE
PID:2440

C:\Users\Admin\AppData\Local\Temp\e578fcc.exe
C:\Users\Admin\AppData\Local\Temp\e578fcc.exe
4⤵
- Executes dropped EXE
PID:4080

C:\Users\Admin\AppData\Local\Temp\e578ffb.exe
C:\Users\Admin\AppData\Local\Temp\e578ffb.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3660

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3856

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3948

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4036

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:404

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3564

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4216

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:1488

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e577436.exe
Filesize
97KB

MD5
66b33e2c0594aa9fbe2dfcaf633f3bad

SHA1
05152397d9299f89c4970be7969c0ea740bd4e32

SHA256
e7ca409166beb51c67b2001613769f8e90803ddcdf95bf0a64244102cb773839

SHA512
483901b034680ab7b95d79ce9dd564b798780416743a4e4e7d856bb0a3a714337d760e672ba40bb1efe8aad8bec1c5755fda29b1a29f51952f30fb88cf196900

Download Submit
C:\Windows\SYSTEM.INI
Filesize
257B

MD5
79e4126b5e06239f0af81bb9127fe5cd

SHA1
64dca624a068143980eb06fe6c8c8e8acf427035

SHA256
4ae1756310b07964fe28dc35202af06a15fceb800cd91c6f5993ae918e0afdbb

SHA512
2b0028df67c591b3db1d857c983af79b6941ab3036846924acfb0852bf99c742580aaa8372e76ecf745f7876a0e3c8c80be358fc3f6c6787687911a41d531245

Download Submit
memory/2440-30-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2440-113-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2440-61-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2440-62-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2440-69-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/3468-57-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3468-83-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3468-14-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3468-32-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3468-28-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3468-5-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3468-29-0x00000000005D0000-0x00000000005D2000-memory.dmp

Filesize
8KB

Download
memory/3468-11-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3468-19-0x0000000001A00000-0x0000000001A01000-memory.dmp

Filesize
4KB

Download
memory/3468-6-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3468-100-0x00000000005D0000-0x00000000005D2000-memory.dmp

Filesize
8KB

Download
memory/3468-109-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3468-34-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3468-33-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3468-35-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3468-36-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3468-37-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3468-38-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3468-39-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3468-40-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3468-42-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3468-89-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3468-90-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3468-56-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3468-88-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3468-59-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3468-87-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3468-85-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3468-72-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3468-31-0x00000000005D0000-0x00000000005D2000-memory.dmp

Filesize
8KB

Download
memory/3468-9-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3468-82-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3468-79-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3468-76-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3468-8-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3468-10-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/3468-75-0x00000000007C0000-0x000000000187A000-memory.dmp

Filesize
16.7MB

Download
memory/4080-65-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/4080-142-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4080-70-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/4080-64-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/4080-53-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4288-13-0x0000000000D70000-0x0000000000D71000-memory.dmp

Filesize
4KB

Download
memory/4288-25-0x0000000000BD0000-0x0000000000BD2000-memory.dmp

Filesize
8KB

Download
memory/4288-1-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/4288-17-0x0000000000BD0000-0x0000000000BD2000-memory.dmp

Filesize
8KB

Download
memory/4288-12-0x0000000000BD0000-0x0000000000BD2000-memory.dmp

Filesize
8KB

Download
memory/4512-71-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/4512-54-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4512-68-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/4512-125-0x0000000000B20000-0x0000000001BDA000-memory.dmp

Filesize
16.7MB

Download
memory/4512-67-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/4512-162-0x0000000000B20000-0x0000000001BDA000-memory.dmp

Filesize
16.7MB

Download
memory/4512-161-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download