Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
29-06-2024 19:18
Static task
static1
Behavioral task
behavioral1
Sample
20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe
Resource
win7-20240508-en
General
-
Target
20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe
-
Size
65KB
-
MD5
8fe839caa4913469c88ddc73635bee3f
-
SHA1
a0b71956d978c6102a5f181fb20f6e9606c84dd6
-
SHA256
20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1
-
SHA512
9fb9450e0c7c63e1241e268b33dd59f22eb4caab6e4af2b2ff60612f34b5a4764420c5dd8ad70af281b6fcf634a6cde63161b89ff2b20a60e80f024a1b1d9216
-
SSDEEP
1536:RclJ1kNATK0S/6SaIWZQomKME5+5faQNg6mhVC0h/22jQOuPc5Cxf/:alJc50S/MQLKz5+NaQkhtNuPcyf/
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
Processes:
20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe -
Processes:
20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe -
Processes:
20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 28 IoCs
Processes:
resource yara_rule behavioral2/memory/1436-1-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1436-3-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1436-7-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1436-5-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1436-17-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1436-21-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1436-18-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1436-8-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1436-9-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1436-6-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1436-23-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1436-22-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1436-24-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1436-25-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1436-26-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1436-28-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1436-29-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1436-31-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1436-32-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1436-34-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1436-35-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1436-36-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1436-38-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1436-41-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1436-47-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1436-48-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1436-50-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1436-52-0x00000000007A0000-0x000000000185A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 30 IoCs
Processes:
resource yara_rule behavioral2/memory/1436-0-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/1436-1-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/1436-3-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/1436-7-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/1436-5-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/1436-17-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/1436-21-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/1436-18-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/1436-8-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/1436-9-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/1436-6-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/1436-23-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/1436-22-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/1436-24-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/1436-25-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/1436-26-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/1436-28-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/1436-29-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/1436-31-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/1436-32-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/1436-34-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/1436-35-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/1436-36-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/1436-38-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/1436-41-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/1436-47-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/1436-48-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/1436-50-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/1436-52-0x00000000007A0000-0x000000000185A000-memory.dmp UPX behavioral2/memory/1436-71-0x0000000000400000-0x0000000000412000-memory.dmp UPX -
Processes:
resource yara_rule behavioral2/memory/1436-1-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1436-3-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1436-7-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1436-5-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1436-17-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1436-21-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1436-18-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1436-8-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1436-9-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1436-6-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1436-23-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1436-22-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1436-24-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1436-25-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1436-26-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1436-28-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1436-29-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1436-31-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1436-32-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1436-34-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1436-35-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1436-36-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1436-38-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1436-41-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1436-47-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1436-48-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1436-50-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1436-52-0x00000000007A0000-0x000000000185A000-memory.dmp upx -
Processes:
20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe -
Processes:
20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe -
Enumerates connected drives 3 TTPs 11 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exedescription ioc process File opened (read-only) \??\N: 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe File opened (read-only) \??\P: 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe File opened (read-only) \??\E: 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe File opened (read-only) \??\H: 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe File opened (read-only) \??\I: 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe File opened (read-only) \??\L: 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe File opened (read-only) \??\M: 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe File opened (read-only) \??\O: 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe File opened (read-only) \??\G: 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe File opened (read-only) \??\J: 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe File opened (read-only) \??\K: 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe -
Drops file in Program Files directory 3 IoCs
Processes:
20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exedescription ioc process File opened for modification C:\Program Files\7-Zip\7z.exe 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe -
Drops file in Windows directory 2 IoCs
Processes:
20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exedescription ioc process File created C:\Windows\e572fe9 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe File opened for modification C:\Windows\SYSTEM.INI 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exepid process 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exedescription pid process Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Token: SeDebugPrivilege 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exedescription pid process target process PID 1436 wrote to memory of 776 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe fontdrvhost.exe PID 1436 wrote to memory of 784 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe fontdrvhost.exe PID 1436 wrote to memory of 316 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe dwm.exe PID 1436 wrote to memory of 2052 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe sihost.exe PID 1436 wrote to memory of 392 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe svchost.exe PID 1436 wrote to memory of 3104 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe taskhostw.exe PID 1436 wrote to memory of 3432 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Explorer.EXE PID 1436 wrote to memory of 3552 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe svchost.exe PID 1436 wrote to memory of 3764 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe DllHost.exe PID 1436 wrote to memory of 3852 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe StartMenuExperienceHost.exe PID 1436 wrote to memory of 3920 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe RuntimeBroker.exe PID 1436 wrote to memory of 4020 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe SearchApp.exe PID 1436 wrote to memory of 3684 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe RuntimeBroker.exe PID 1436 wrote to memory of 4844 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe TextInputHost.exe PID 1436 wrote to memory of 4912 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe RuntimeBroker.exe PID 1436 wrote to memory of 3848 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe backgroundTaskHost.exe PID 1436 wrote to memory of 208 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe backgroundTaskHost.exe PID 1436 wrote to memory of 776 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe fontdrvhost.exe PID 1436 wrote to memory of 784 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe fontdrvhost.exe PID 1436 wrote to memory of 316 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe dwm.exe PID 1436 wrote to memory of 2052 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe sihost.exe PID 1436 wrote to memory of 392 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe svchost.exe PID 1436 wrote to memory of 3104 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe taskhostw.exe PID 1436 wrote to memory of 3432 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe Explorer.EXE PID 1436 wrote to memory of 3552 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe svchost.exe PID 1436 wrote to memory of 3764 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe DllHost.exe PID 1436 wrote to memory of 3852 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe StartMenuExperienceHost.exe PID 1436 wrote to memory of 3920 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe RuntimeBroker.exe PID 1436 wrote to memory of 4020 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe SearchApp.exe PID 1436 wrote to memory of 3684 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe RuntimeBroker.exe PID 1436 wrote to memory of 4844 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe TextInputHost.exe PID 1436 wrote to memory of 4912 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe RuntimeBroker.exe PID 1436 wrote to memory of 3848 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe backgroundTaskHost.exe PID 1436 wrote to memory of 208 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe backgroundTaskHost.exe PID 1436 wrote to memory of 2992 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe RuntimeBroker.exe PID 1436 wrote to memory of 2064 1436 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe RuntimeBroker.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe"C:\Users\Admin\AppData\Local\Temp\20c315a94d13157a5711de69ccf7307a676815561dd6d749c3ad5b43c41e09e1.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Impair Defenses
4Disable or Modify Tools
3Disable or Modify System Firewall
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1436-0-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1436-1-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/1436-3-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/1436-7-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/1436-5-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/1436-17-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/1436-20-0x0000000003520000-0x0000000003522000-memory.dmpFilesize
8KB
-
memory/1436-21-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/1436-18-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/1436-8-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/1436-11-0x0000000003FB0000-0x0000000003FB1000-memory.dmpFilesize
4KB
-
memory/1436-19-0x0000000003520000-0x0000000003522000-memory.dmpFilesize
8KB
-
memory/1436-10-0x0000000003520000-0x0000000003522000-memory.dmpFilesize
8KB
-
memory/1436-9-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/1436-6-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/1436-23-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/1436-22-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/1436-24-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/1436-25-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/1436-26-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/1436-28-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/1436-29-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/1436-31-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/1436-32-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/1436-34-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/1436-35-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/1436-36-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/1436-38-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/1436-41-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/1436-47-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/1436-48-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/1436-50-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/1436-52-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/1436-60-0x0000000003520000-0x0000000003522000-memory.dmpFilesize
8KB
-
memory/1436-71-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB