sality | 0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 19:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe
Size

505KB
MD5

13162c54c4d8e425799ab947e57df82b
SHA1

02e7518ebc738d1be6c6079701b47d12f76ee33b
SHA256

0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca
SHA512

f7aad4cde66b4414ef7a5fb7e09032d4423932a5803d366876fb7d1e6686c8e48329a8d7d59c1c8eb88bd77a92ed7f6f7a7ae0d02cf981a2554b5f12118da57f
SSDEEP

12288:FMsi9TgKPChlEiYOAkycjo+ZToV0vloD29/:FQgKCYLtcPo+o29/

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 3 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2228-7-0x0000000001E50000-0x0000000002F0A000-memory.dmp	upx
behavioral1/memory/2228-4-0x0000000001E50000-0x0000000002F0A000-memory.dmp	upx
behavioral1/memory/2228-5-0x0000000001E50000-0x0000000002F0A000-memory.dmp	upx
behavioral1/memory/2228-10-0x0000000001E50000-0x0000000002F0A000-memory.dmp	upx
behavioral1/memory/2228-9-0x0000000001E50000-0x0000000002F0A000-memory.dmp	upx
behavioral1/memory/2228-11-0x0000000001E50000-0x0000000002F0A000-memory.dmp	upx
behavioral1/memory/2228-3-0x0000000001E50000-0x0000000002F0A000-memory.dmp	upx
behavioral1/memory/2228-12-0x0000000001E50000-0x0000000002F0A000-memory.dmp	upx
behavioral1/memory/2228-8-0x0000000001E50000-0x0000000002F0A000-memory.dmp	upx
behavioral1/memory/2228-6-0x0000000001E50000-0x0000000002F0A000-memory.dmp	upx
behavioral1/memory/2228-33-0x0000000001E50000-0x0000000002F0A000-memory.dmp	upx
behavioral1/memory/2228-34-0x0000000001E50000-0x0000000002F0A000-memory.dmp	upx
behavioral1/memory/2228-35-0x0000000001E50000-0x0000000002F0A000-memory.dmp	upx
behavioral1/memory/2228-36-0x0000000001E50000-0x0000000002F0A000-memory.dmp	upx
behavioral1/memory/2228-37-0x0000000001E50000-0x0000000002F0A000-memory.dmp	upx
behavioral1/memory/2228-39-0x0000000001E50000-0x0000000002F0A000-memory.dmp	upx
behavioral1/memory/2228-40-0x0000000001E50000-0x0000000002F0A000-memory.dmp	upx
behavioral1/memory/2228-60-0x0000000001E50000-0x0000000002F0A000-memory.dmp	upx

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe

description	ioc	process
File opened (read-only)	\??\G:	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe
File opened (read-only)	\??\E:	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe

Drops file in Windows directory 2 IoCs

Processes:

0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe

description	ioc	process
File created	C:\Windows\f761fa1	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe
File opened for modification	C:\Windows\SYSTEM.INI	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000541cac41be2a9e9156e148e96b7395fb8fcf85423df0cef1c47ca19078942f80000000000e8000000002000020000000f6d9664d4f52e555ba98856ccee96e0108ee52ca747bd3b0a0816a1cf3968f8690000000a5cf65f2dcde9309183dd6b7ddbee7052d2e86f101d66d136528d2b13840e41f0a5c5d727d78ffb059190c1327c8b59608076a3c5d7c3a82e26122d6a275efed913696a055b5d9cead4569c54a6be1d55e15f650bd018b59d96a23edd71635695d6cd7d20a52381dbc936c377001dae71c2b170d37089d7e3233252951e62a45d65acebf3c921fe977bf16afe169b88940000000e281501c6b974f4f63cb18bc109bf038fd685bea24e92cb20dc7c411b2bfd4d5264c9f22253b13cb53c42a802621909784cb9cd478ac76cbb0a814f690301019	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000008374a13cac6a2cd7633eafe9079ff7478d7e9395fa7f06f3a3036c5dac7248b4000000000e80000000020000200000004bc28d0462665c955272f97716c8ffa2ee694e2bbac615649ad28d1462ac0fc22000000014510104bb13e8ba2d9999c903fcbe763327ee93ac5c27cc1d2503747ed939694000000080044fd99c147c6a0c2de11823ebe3c67751f70d8800e4aa722b35eaa1ef8592d359df2ee2faf33bd64a498331577ec03eabcc72d011cf60171cfebc071216de	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425937827"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{75757471-3717-11EF-B390-D62CE60191A1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f05b945824cbda01	iexplore.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe

pid process

2228 0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe

pid	process
2228	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

Processes:

0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe

description	pid	process
Token: SeDebugPrivilege	2228	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe
Token: SeDebugPrivilege	2228	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe
Token: SeDebugPrivilege	2228	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe
Token: SeDebugPrivilege	2228	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe
Token: SeDebugPrivilege	2228	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe
Token: SeDebugPrivilege	2228	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe
Token: SeDebugPrivilege	2228	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe
Token: SeDebugPrivilege	2228	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe
Token: SeDebugPrivilege	2228	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe
Token: SeDebugPrivilege	2228	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe
Token: SeDebugPrivilege	2228	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe
Token: SeDebugPrivilege	2228	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe
Token: SeDebugPrivilege	2228	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe
Token: SeDebugPrivilege	2228	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe
Token: SeDebugPrivilege	2228	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe
Token: SeDebugPrivilege	2228	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe
Token: SeDebugPrivilege	2228	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe
Token: SeDebugPrivilege	2228	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe
Token: SeDebugPrivilege	2228	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe
Token: SeDebugPrivilege	2228	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2544 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2544 iexplore.exe
2544 iexplore.exe
2888 IEXPLORE.EXE
2888 IEXPLORE.EXE
2888 IEXPLORE.EXE
2888 IEXPLORE.EXE

pid	process
2544	iexplore.exe

pid	process
2544	iexplore.exe
2544	iexplore.exe
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exeiexplore.exe

description	pid	process	target process
PID 2228 wrote to memory of 1112	2228	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe	taskhost.exe
PID 2228 wrote to memory of 1168	2228	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe	Dwm.exe
PID 2228 wrote to memory of 1196	2228	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe	Explorer.EXE
PID 2228 wrote to memory of 2040	2228	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe	DllHost.exe
PID 2228 wrote to memory of 2544	2228	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe	iexplore.exe
PID 2228 wrote to memory of 2544	2228	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe	iexplore.exe
PID 2228 wrote to memory of 2544	2228	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe	iexplore.exe
PID 2228 wrote to memory of 2544	2228	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe	iexplore.exe
PID 2544 wrote to memory of 2888	2544	iexplore.exe	IEXPLORE.EXE
PID 2544 wrote to memory of 2888	2544	iexplore.exe	IEXPLORE.EXE
PID 2544 wrote to memory of 2888	2544	iexplore.exe	IEXPLORE.EXE
PID 2544 wrote to memory of 2888	2544	iexplore.exe	IEXPLORE.EXE

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1112

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1168

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1196

C:\Users\Admin\AppData\Local\Temp\0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe
"C:\Users\Admin\AppData\Local\Temp\0e4fc8e09d8bfa3094bc9859c63eaee96d036fc5513c2576101a3dde06b289ca.exe"
2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2228

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://down.360safe.com/setupbeta.exe
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2544

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2544 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2888

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2040

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1112-18-0x0000000000160000-0x0000000000162000-memory.dmp

Filesize
8KB

Download
memory/2228-27-0x0000000000890000-0x0000000000891000-memory.dmp

Filesize
4KB

Download
memory/2228-5-0x0000000001E50000-0x0000000002F0A000-memory.dmp

Filesize
16.7MB

Download
memory/2228-7-0x0000000001E50000-0x0000000002F0A000-memory.dmp

Filesize
16.7MB

Download
memory/2228-8-0x0000000001E50000-0x0000000002F0A000-memory.dmp

Filesize
16.7MB

Download
memory/2228-9-0x0000000001E50000-0x0000000002F0A000-memory.dmp

Filesize
16.7MB

Download
memory/2228-11-0x0000000001E50000-0x0000000002F0A000-memory.dmp

Filesize
16.7MB

Download
memory/2228-3-0x0000000001E50000-0x0000000002F0A000-memory.dmp

Filesize
16.7MB

Download
memory/2228-32-0x00000000005F0000-0x00000000005F2000-memory.dmp

Filesize
8KB

Download
memory/2228-31-0x00000000005F0000-0x00000000005F2000-memory.dmp

Filesize
8KB

Download
memory/2228-12-0x0000000001E50000-0x0000000002F0A000-memory.dmp

Filesize
16.7MB

Download
memory/2228-30-0x0000000000890000-0x0000000000891000-memory.dmp

Filesize
4KB

Download
memory/2228-0-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2228-60-0x0000000001E50000-0x0000000002F0A000-memory.dmp

Filesize
16.7MB

Download
memory/2228-4-0x0000000001E50000-0x0000000002F0A000-memory.dmp

Filesize
16.7MB

Download
memory/2228-10-0x0000000001E50000-0x0000000002F0A000-memory.dmp

Filesize
16.7MB

Download
memory/2228-6-0x0000000001E50000-0x0000000002F0A000-memory.dmp

Filesize
16.7MB

Download
memory/2228-33-0x0000000001E50000-0x0000000002F0A000-memory.dmp

Filesize
16.7MB

Download
memory/2228-34-0x0000000001E50000-0x0000000002F0A000-memory.dmp

Filesize
16.7MB

Download
memory/2228-35-0x0000000001E50000-0x0000000002F0A000-memory.dmp

Filesize
16.7MB

Download
memory/2228-36-0x0000000001E50000-0x0000000002F0A000-memory.dmp

Filesize
16.7MB

Download
memory/2228-37-0x0000000001E50000-0x0000000002F0A000-memory.dmp

Filesize
16.7MB

Download
memory/2228-39-0x0000000001E50000-0x0000000002F0A000-memory.dmp

Filesize
16.7MB

Download
memory/2228-40-0x0000000001E50000-0x0000000002F0A000-memory.dmp

Filesize
16.7MB

Download
memory/2228-59-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2228-46-0x00000000005F0000-0x00000000005F2000-memory.dmp

Filesize
8KB

Download
memory/2228-26-0x00000000005F0000-0x00000000005F2000-memory.dmp

Filesize
8KB

Download