Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29-06-2024 21:22
Static task
static1
Behavioral task
behavioral1
Sample
52ac269e4331e777c8ee349d70a45145b55a98f9bb14f13eba4797bc986416cd.dll
Resource
win7-20240220-en
General
-
Target
52ac269e4331e777c8ee349d70a45145b55a98f9bb14f13eba4797bc986416cd.dll
-
Size
120KB
-
MD5
c325922f8c42888bef5e7db3b16a462a
-
SHA1
03cc2c2ee054d7d095f78864935a629b4866a101
-
SHA256
52ac269e4331e777c8ee349d70a45145b55a98f9bb14f13eba4797bc986416cd
-
SHA512
982eef4864db50c2188be3307c940c814f60531967abca190f6fc42601ba843341781834db17cbb0df799f4d65ec1d257970f1221ff468bfd0d482d891308387
-
SSDEEP
1536:J7LDJaWnN08fogdEDqxjnHGeYW70wBic6BeF/vS+n7BwLDNMDIzVod1LD+i/n:pLvnNtd3TbBicFmPXVobDf
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
Processes:
e576419.exee577fa0.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e576419.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e576419.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e577fa0.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e577fa0.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e577fa0.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e576419.exe -
Processes:
e576419.exee577fa0.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e576419.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e577fa0.exe -
Processes:
e576419.exee577fa0.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e576419.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e577fa0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e577fa0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e576419.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e576419.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e576419.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e576419.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e577fa0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e576419.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e577fa0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e577fa0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e577fa0.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 32 IoCs
Processes:
resource yara_rule behavioral2/memory/3704-6-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3704-10-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3704-11-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3704-9-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3704-18-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3704-31-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3704-19-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3704-35-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3704-12-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3704-36-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3704-37-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3704-38-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3704-39-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3704-40-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3704-41-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3704-43-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3704-44-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3704-53-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3704-55-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3704-56-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3704-66-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3704-68-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3704-71-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3704-73-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3704-75-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3704-77-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3704-79-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3704-81-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3704-83-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3704-87-0x00000000008B0000-0x000000000196A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4584-119-0x0000000000B40000-0x0000000001BFA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4584-149-0x0000000000B40000-0x0000000001BFA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 37 IoCs
Processes:
resource yara_rule behavioral2/memory/3704-5-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/3704-6-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3704-10-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3704-11-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3704-9-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3704-18-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/1324-34-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/3704-31-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3704-19-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3704-35-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3704-12-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3704-36-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3704-37-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3704-38-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3704-39-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3704-40-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3704-41-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3704-43-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3704-44-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3704-53-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3704-55-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3704-56-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3704-66-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3704-68-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3704-71-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3704-73-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3704-75-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3704-77-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3704-79-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3704-81-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3704-83-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/3704-103-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/1324-107-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/3704-87-0x00000000008B0000-0x000000000196A000-memory.dmp UPX behavioral2/memory/4584-119-0x0000000000B40000-0x0000000001BFA000-memory.dmp UPX behavioral2/memory/4584-150-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral2/memory/4584-149-0x0000000000B40000-0x0000000001BFA000-memory.dmp UPX -
Executes dropped EXE 3 IoCs
Processes:
e576419.exee5765bf.exee577fa0.exepid process 3704 e576419.exe 1324 e5765bf.exe 4584 e577fa0.exe -
Processes:
resource yara_rule behavioral2/memory/3704-6-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3704-10-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3704-11-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3704-9-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3704-18-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3704-31-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3704-19-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3704-35-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3704-12-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3704-36-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3704-37-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3704-38-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3704-39-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3704-40-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3704-41-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3704-43-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3704-44-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3704-53-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3704-55-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3704-56-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3704-66-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3704-68-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3704-71-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3704-73-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3704-75-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3704-77-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3704-79-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3704-81-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3704-83-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/3704-87-0x00000000008B0000-0x000000000196A000-memory.dmp upx behavioral2/memory/4584-119-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx behavioral2/memory/4584-149-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx -
Processes:
e576419.exee577fa0.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e576419.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e576419.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e577fa0.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e577fa0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e576419.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e576419.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e577fa0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e577fa0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e576419.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e576419.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e576419.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e577fa0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e577fa0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e577fa0.exe -
Processes:
e576419.exee577fa0.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e576419.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e577fa0.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
e576419.exee577fa0.exedescription ioc process File opened (read-only) \??\K: e576419.exe File opened (read-only) \??\N: e576419.exe File opened (read-only) \??\R: e576419.exe File opened (read-only) \??\H: e576419.exe File opened (read-only) \??\G: e576419.exe File opened (read-only) \??\I: e576419.exe File opened (read-only) \??\P: e576419.exe File opened (read-only) \??\S: e576419.exe File opened (read-only) \??\E: e577fa0.exe File opened (read-only) \??\E: e576419.exe File opened (read-only) \??\Q: e576419.exe File opened (read-only) \??\O: e576419.exe File opened (read-only) \??\L: e576419.exe File opened (read-only) \??\M: e576419.exe File opened (read-only) \??\J: e576419.exe -
Drops file in Program Files directory 4 IoCs
Processes:
e576419.exedescription ioc process File opened for modification C:\Program Files\7-Zip\Uninstall.exe e576419.exe File opened for modification C:\Program Files\7-Zip\7z.exe e576419.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e576419.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e576419.exe -
Drops file in Windows directory 3 IoCs
Processes:
e576419.exee577fa0.exedescription ioc process File created C:\Windows\e576467 e576419.exe File opened for modification C:\Windows\SYSTEM.INI e576419.exe File created C:\Windows\e57b4f8 e577fa0.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
e576419.exee577fa0.exepid process 3704 e576419.exe 3704 e576419.exe 3704 e576419.exe 3704 e576419.exe 4584 e577fa0.exe 4584 e577fa0.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
e576419.exedescription pid process Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe Token: SeDebugPrivilege 3704 e576419.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.exerundll32.exee576419.exee577fa0.exedescription pid process target process PID 4712 wrote to memory of 4848 4712 rundll32.exe rundll32.exe PID 4712 wrote to memory of 4848 4712 rundll32.exe rundll32.exe PID 4712 wrote to memory of 4848 4712 rundll32.exe rundll32.exe PID 4848 wrote to memory of 3704 4848 rundll32.exe e576419.exe PID 4848 wrote to memory of 3704 4848 rundll32.exe e576419.exe PID 4848 wrote to memory of 3704 4848 rundll32.exe e576419.exe PID 3704 wrote to memory of 792 3704 e576419.exe fontdrvhost.exe PID 3704 wrote to memory of 800 3704 e576419.exe fontdrvhost.exe PID 3704 wrote to memory of 380 3704 e576419.exe dwm.exe PID 3704 wrote to memory of 2720 3704 e576419.exe sihost.exe PID 3704 wrote to memory of 2728 3704 e576419.exe svchost.exe PID 3704 wrote to memory of 2960 3704 e576419.exe taskhostw.exe PID 3704 wrote to memory of 3520 3704 e576419.exe Explorer.EXE PID 3704 wrote to memory of 3644 3704 e576419.exe svchost.exe PID 3704 wrote to memory of 3840 3704 e576419.exe DllHost.exe PID 3704 wrote to memory of 4012 3704 e576419.exe StartMenuExperienceHost.exe PID 3704 wrote to memory of 4072 3704 e576419.exe RuntimeBroker.exe PID 3704 wrote to memory of 3872 3704 e576419.exe SearchApp.exe PID 3704 wrote to memory of 4124 3704 e576419.exe RuntimeBroker.exe PID 3704 wrote to memory of 392 3704 e576419.exe RuntimeBroker.exe PID 3704 wrote to memory of 2292 3704 e576419.exe TextInputHost.exe PID 3704 wrote to memory of 4712 3704 e576419.exe rundll32.exe PID 3704 wrote to memory of 4848 3704 e576419.exe rundll32.exe PID 3704 wrote to memory of 4848 3704 e576419.exe rundll32.exe PID 4848 wrote to memory of 1324 4848 rundll32.exe e5765bf.exe PID 4848 wrote to memory of 1324 4848 rundll32.exe e5765bf.exe PID 4848 wrote to memory of 1324 4848 rundll32.exe e5765bf.exe PID 4848 wrote to memory of 4584 4848 rundll32.exe e577fa0.exe PID 4848 wrote to memory of 4584 4848 rundll32.exe e577fa0.exe PID 4848 wrote to memory of 4584 4848 rundll32.exe e577fa0.exe PID 3704 wrote to memory of 792 3704 e576419.exe fontdrvhost.exe PID 3704 wrote to memory of 800 3704 e576419.exe fontdrvhost.exe PID 3704 wrote to memory of 380 3704 e576419.exe dwm.exe PID 3704 wrote to memory of 2720 3704 e576419.exe sihost.exe PID 3704 wrote to memory of 2728 3704 e576419.exe svchost.exe PID 3704 wrote to memory of 2960 3704 e576419.exe taskhostw.exe PID 3704 wrote to memory of 3520 3704 e576419.exe Explorer.EXE PID 3704 wrote to memory of 3644 3704 e576419.exe svchost.exe PID 3704 wrote to memory of 3840 3704 e576419.exe DllHost.exe PID 3704 wrote to memory of 4012 3704 e576419.exe StartMenuExperienceHost.exe PID 3704 wrote to memory of 4072 3704 e576419.exe RuntimeBroker.exe PID 3704 wrote to memory of 3872 3704 e576419.exe SearchApp.exe PID 3704 wrote to memory of 4124 3704 e576419.exe RuntimeBroker.exe PID 3704 wrote to memory of 392 3704 e576419.exe RuntimeBroker.exe PID 3704 wrote to memory of 2292 3704 e576419.exe TextInputHost.exe PID 3704 wrote to memory of 1324 3704 e576419.exe e5765bf.exe PID 3704 wrote to memory of 1324 3704 e576419.exe e5765bf.exe PID 3704 wrote to memory of 4584 3704 e576419.exe e577fa0.exe PID 3704 wrote to memory of 4584 3704 e576419.exe e577fa0.exe PID 4584 wrote to memory of 792 4584 e577fa0.exe fontdrvhost.exe PID 4584 wrote to memory of 800 4584 e577fa0.exe fontdrvhost.exe PID 4584 wrote to memory of 380 4584 e577fa0.exe dwm.exe PID 4584 wrote to memory of 2720 4584 e577fa0.exe sihost.exe PID 4584 wrote to memory of 2728 4584 e577fa0.exe svchost.exe PID 4584 wrote to memory of 2960 4584 e577fa0.exe taskhostw.exe PID 4584 wrote to memory of 3520 4584 e577fa0.exe Explorer.EXE PID 4584 wrote to memory of 3644 4584 e577fa0.exe svchost.exe PID 4584 wrote to memory of 3840 4584 e577fa0.exe DllHost.exe PID 4584 wrote to memory of 4012 4584 e577fa0.exe StartMenuExperienceHost.exe PID 4584 wrote to memory of 4072 4584 e577fa0.exe RuntimeBroker.exe PID 4584 wrote to memory of 3872 4584 e577fa0.exe SearchApp.exe PID 4584 wrote to memory of 4124 4584 e577fa0.exe RuntimeBroker.exe PID 4584 wrote to memory of 392 4584 e577fa0.exe RuntimeBroker.exe PID 4584 wrote to memory of 2292 4584 e577fa0.exe TextInputHost.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
e576419.exee577fa0.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e576419.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e577fa0.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\52ac269e4331e777c8ee349d70a45145b55a98f9bb14f13eba4797bc986416cd.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\52ac269e4331e777c8ee349d70a45145b55a98f9bb14f13eba4797bc986416cd.dll,#13⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e576419.exeC:\Users\Admin\AppData\Local\Temp\e576419.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\e5765bf.exeC:\Users\Admin\AppData\Local\Temp\e5765bf.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\e577fa0.exeC:\Users\Admin\AppData\Local\Temp\e577fa0.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Impair Defenses
4Disable or Modify Tools
3Disable or Modify System Firewall
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\e576419.exeFilesize
97KB
MD5833fe2c175ba19211bd257442e921fed
SHA185aed2f561366d875d7b8abe3f0fcb91d1ea1c87
SHA25631dcc68c448b43b44a0cf313fc2e67d7feb5b73c7816362157ca541ff3ba6a6e
SHA51258ef2906a790558752ef614a11848c6e050e32ff27d005e983f3b3d3c7052ca08b17eae0c76fccda855ba5591fb650bb6848701422261713eb96496adf11a29a
-
C:\Windows\SYSTEM.INIFilesize
257B
MD5198d14c9fd63c4a0d9062369feeb8e42
SHA19bc6c1025f1a74775878ee745e08b9f906e25d56
SHA2566a40256a8dee3f86ac025691ba0c2ba10d4037cc84d1279107ca13ee559fd3e8
SHA51247e0238bda4c3156e1426621b8a5ef8250465ba01f444ca2d44c5d09efb04e2061efa286be1a2b6f8e2228d7f9ff34af50c2eb81ad1e53b6c56cd349d4803db0
-
memory/1324-34-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1324-107-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1324-59-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/1324-60-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/1324-64-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/3704-43-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3704-55-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3704-87-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3704-26-0x0000000001BF0000-0x0000000001BF2000-memory.dmpFilesize
8KB
-
memory/3704-18-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3704-31-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3704-5-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3704-19-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3704-32-0x0000000001BF0000-0x0000000001BF2000-memory.dmpFilesize
8KB
-
memory/3704-35-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3704-103-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3704-94-0x0000000001BF0000-0x0000000001BF2000-memory.dmpFilesize
8KB
-
memory/3704-12-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3704-36-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3704-37-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3704-38-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3704-39-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3704-40-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3704-41-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3704-9-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3704-44-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3704-83-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3704-53-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3704-23-0x0000000001C00000-0x0000000001C01000-memory.dmpFilesize
4KB
-
memory/3704-56-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3704-81-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3704-79-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3704-11-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3704-77-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3704-10-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3704-66-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3704-6-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3704-68-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3704-71-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3704-73-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/3704-75-0x00000000008B0000-0x000000000196A000-memory.dmpFilesize
16.7MB
-
memory/4584-62-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/4584-65-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/4584-63-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/4584-52-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4584-119-0x0000000000B40000-0x0000000001BFA000-memory.dmpFilesize
16.7MB
-
memory/4584-150-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4584-149-0x0000000000B40000-0x0000000001BFA000-memory.dmpFilesize
16.7MB
-
memory/4848-20-0x0000000003E40000-0x0000000003E42000-memory.dmpFilesize
8KB
-
memory/4848-25-0x0000000003ED0000-0x0000000003ED1000-memory.dmpFilesize
4KB
-
memory/4848-33-0x0000000003E40000-0x0000000003E42000-memory.dmpFilesize
8KB
-
memory/4848-28-0x0000000003E40000-0x0000000003E42000-memory.dmpFilesize
8KB
-
memory/4848-2-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB