sality | 17982cc741232f395fe8ea0af191c1611acfdf37da04287f856d3320e8e911a4

Analysis

max time kernel
26s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 19:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17982cc741232f395fe8ea0af191c1611acfdf37da04287f856d3320e8e911a4.dll
Size

120KB
MD5

2b2ac9be7a44039d34768997c6d980b5
SHA1

958b528b852fd47f3699408a8243b83916a52a2f
SHA256

17982cc741232f395fe8ea0af191c1611acfdf37da04287f856d3320e8e911a4
SHA512

de5fd1aaf691de211cca466e47f9c49fee4172971e01a854cf706a7d61a5190035ace089a93f23ebde8587bf4f501eaeba0201ad9bcccc5ed6c10629bf4451fc
SSDEEP

1536:pvUcqa0ZDPai0be2H6dP/zSLonTec3bWZADyLG7pRmRUkttHJ3VdLcFhqKcbkCoq:pg90/6J/ogT4Z+yLG7/24FHeV

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 3 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

f760703.exef7622cc.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	f760703.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	f760703.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	f760703.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	f7622cc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	f7622cc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	f7622cc.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f760703.exef7622cc.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f760703.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f7622cc.exe

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f7622cc.exef760703.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f7622cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f760703.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f760703.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f7622cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f760703.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f7622cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f7622cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f7622cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f7622cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f760703.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f760703.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f760703.exe

Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 26 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1628-13-0x00000000006A0000-0x000000000175A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1628-21-0x00000000006A0000-0x000000000175A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1628-16-0x00000000006A0000-0x000000000175A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1628-22-0x00000000006A0000-0x000000000175A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1628-14-0x00000000006A0000-0x000000000175A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1628-19-0x00000000006A0000-0x000000000175A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1628-20-0x00000000006A0000-0x000000000175A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1628-18-0x00000000006A0000-0x000000000175A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1628-17-0x00000000006A0000-0x000000000175A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1628-15-0x00000000006A0000-0x000000000175A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1628-61-0x00000000006A0000-0x000000000175A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1628-62-0x00000000006A0000-0x000000000175A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1628-63-0x00000000006A0000-0x000000000175A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1628-64-0x00000000006A0000-0x000000000175A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1628-65-0x00000000006A0000-0x000000000175A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1628-67-0x00000000006A0000-0x000000000175A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1628-68-0x00000000006A0000-0x000000000175A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1628-82-0x00000000006A0000-0x000000000175A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1628-84-0x00000000006A0000-0x000000000175A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1628-86-0x00000000006A0000-0x000000000175A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1628-103-0x00000000006A0000-0x000000000175A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1628-106-0x00000000006A0000-0x000000000175A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1628-124-0x00000000006A0000-0x000000000175A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1628-149-0x00000000006A0000-0x000000000175A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2532-167-0x0000000000A00000-0x0000000001ABA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2532-204-0x0000000000A00000-0x0000000001ABA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine

UPX dump on OEP (original entry point) 29 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1628-13-0x00000000006A0000-0x000000000175A000-memory.dmp	UPX
behavioral1/memory/1628-21-0x00000000006A0000-0x000000000175A000-memory.dmp	UPX
behavioral1/memory/1628-16-0x00000000006A0000-0x000000000175A000-memory.dmp	UPX
behavioral1/memory/1628-22-0x00000000006A0000-0x000000000175A000-memory.dmp	UPX
behavioral1/memory/1628-14-0x00000000006A0000-0x000000000175A000-memory.dmp	UPX
behavioral1/memory/1628-19-0x00000000006A0000-0x000000000175A000-memory.dmp	UPX
behavioral1/memory/1628-20-0x00000000006A0000-0x000000000175A000-memory.dmp	UPX
behavioral1/memory/1628-18-0x00000000006A0000-0x000000000175A000-memory.dmp	UPX
behavioral1/memory/1628-17-0x00000000006A0000-0x000000000175A000-memory.dmp	UPX
behavioral1/memory/1628-15-0x00000000006A0000-0x000000000175A000-memory.dmp	UPX
behavioral1/memory/1628-61-0x00000000006A0000-0x000000000175A000-memory.dmp	UPX
behavioral1/memory/1628-62-0x00000000006A0000-0x000000000175A000-memory.dmp	UPX
behavioral1/memory/1628-63-0x00000000006A0000-0x000000000175A000-memory.dmp	UPX
behavioral1/memory/1628-64-0x00000000006A0000-0x000000000175A000-memory.dmp	UPX
behavioral1/memory/1628-65-0x00000000006A0000-0x000000000175A000-memory.dmp	UPX
behavioral1/memory/1628-67-0x00000000006A0000-0x000000000175A000-memory.dmp	UPX
behavioral1/memory/1628-68-0x00000000006A0000-0x000000000175A000-memory.dmp	UPX
behavioral1/memory/1628-82-0x00000000006A0000-0x000000000175A000-memory.dmp	UPX
behavioral1/memory/1628-84-0x00000000006A0000-0x000000000175A000-memory.dmp	UPX
behavioral1/memory/1628-86-0x00000000006A0000-0x000000000175A000-memory.dmp	UPX
behavioral1/memory/1628-103-0x00000000006A0000-0x000000000175A000-memory.dmp	UPX
behavioral1/memory/1628-106-0x00000000006A0000-0x000000000175A000-memory.dmp	UPX
behavioral1/memory/1628-124-0x00000000006A0000-0x000000000175A000-memory.dmp	UPX
behavioral1/memory/2736-153-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral1/memory/1628-149-0x00000000006A0000-0x000000000175A000-memory.dmp	UPX
behavioral1/memory/1628-148-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral1/memory/2532-167-0x0000000000A00000-0x0000000001ABA000-memory.dmp	UPX
behavioral1/memory/2532-203-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral1/memory/2532-204-0x0000000000A00000-0x0000000001ABA000-memory.dmp	UPX

Executes dropped EXE 3 IoCs

Processes:

f760703.exef76086a.exef7622cc.exe

pid process

1628 f760703.exe
2736 f76086a.exe
2532 f7622cc.exe
Loads dropped DLL 6 IoCs

Processes:

rundll32.exe

pid process

1600 rundll32.exe
1600 rundll32.exe
1600 rundll32.exe
1600 rundll32.exe
1600 rundll32.exe
1600 rundll32.exe

pid	process
1628	f760703.exe
2736	f76086a.exe
2532	f7622cc.exe

pid	process
1600	rundll32.exe
1600	rundll32.exe
1600	rundll32.exe
1600	rundll32.exe
1600	rundll32.exe
1600	rundll32.exe

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1628-13-0x00000000006A0000-0x000000000175A000-memory.dmp	upx
behavioral1/memory/1628-21-0x00000000006A0000-0x000000000175A000-memory.dmp	upx
behavioral1/memory/1628-16-0x00000000006A0000-0x000000000175A000-memory.dmp	upx
behavioral1/memory/1628-22-0x00000000006A0000-0x000000000175A000-memory.dmp	upx
behavioral1/memory/1628-14-0x00000000006A0000-0x000000000175A000-memory.dmp	upx
behavioral1/memory/1628-19-0x00000000006A0000-0x000000000175A000-memory.dmp	upx
behavioral1/memory/1628-20-0x00000000006A0000-0x000000000175A000-memory.dmp	upx
behavioral1/memory/1628-18-0x00000000006A0000-0x000000000175A000-memory.dmp	upx
behavioral1/memory/1628-17-0x00000000006A0000-0x000000000175A000-memory.dmp	upx
behavioral1/memory/1628-15-0x00000000006A0000-0x000000000175A000-memory.dmp	upx
behavioral1/memory/1628-61-0x00000000006A0000-0x000000000175A000-memory.dmp	upx
behavioral1/memory/1628-62-0x00000000006A0000-0x000000000175A000-memory.dmp	upx
behavioral1/memory/1628-63-0x00000000006A0000-0x000000000175A000-memory.dmp	upx
behavioral1/memory/1628-64-0x00000000006A0000-0x000000000175A000-memory.dmp	upx
behavioral1/memory/1628-65-0x00000000006A0000-0x000000000175A000-memory.dmp	upx
behavioral1/memory/1628-67-0x00000000006A0000-0x000000000175A000-memory.dmp	upx
behavioral1/memory/1628-68-0x00000000006A0000-0x000000000175A000-memory.dmp	upx
behavioral1/memory/1628-82-0x00000000006A0000-0x000000000175A000-memory.dmp	upx
behavioral1/memory/1628-84-0x00000000006A0000-0x000000000175A000-memory.dmp	upx
behavioral1/memory/1628-86-0x00000000006A0000-0x000000000175A000-memory.dmp	upx
behavioral1/memory/1628-103-0x00000000006A0000-0x000000000175A000-memory.dmp	upx
behavioral1/memory/1628-106-0x00000000006A0000-0x000000000175A000-memory.dmp	upx
behavioral1/memory/1628-124-0x00000000006A0000-0x000000000175A000-memory.dmp	upx
behavioral1/memory/1628-149-0x00000000006A0000-0x000000000175A000-memory.dmp	upx
behavioral1/memory/2532-167-0x0000000000A00000-0x0000000001ABA000-memory.dmp	upx
behavioral1/memory/2532-204-0x0000000000A00000-0x0000000001ABA000-memory.dmp	upx

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f760703.exef7622cc.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f760703.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f760703.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f760703.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f7622cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f7622cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f7622cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	f7622cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	f760703.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f760703.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f7622cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f760703.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f7622cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f7622cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f760703.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

f760703.exef7622cc.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f760703.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f7622cc.exe

Enumerates connected drives 3 TTPs 16 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

f760703.exef7622cc.exe

description	ioc	process
File opened (read-only)	\??\M:	f760703.exe
File opened (read-only)	\??\Q:	f760703.exe
File opened (read-only)	\??\S:	f760703.exe
File opened (read-only)	\??\E:	f760703.exe
File opened (read-only)	\??\G:	f760703.exe
File opened (read-only)	\??\I:	f760703.exe
File opened (read-only)	\??\K:	f760703.exe
File opened (read-only)	\??\N:	f760703.exe
File opened (read-only)	\??\O:	f760703.exe
File opened (read-only)	\??\P:	f760703.exe
File opened (read-only)	\??\H:	f760703.exe
File opened (read-only)	\??\T:	f760703.exe
File opened (read-only)	\??\E:	f7622cc.exe
File opened (read-only)	\??\J:	f760703.exe
File opened (read-only)	\??\L:	f760703.exe
File opened (read-only)	\??\R:	f760703.exe

Drops file in Windows directory 3 IoCs

Processes:

f7622cc.exef760703.exe

description ioc process

File created C:\Windows\f765744 f7622cc.exe
File created C:\Windows\f760751 f760703.exe
File opened for modification C:\Windows\SYSTEM.INI f760703.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

f760703.exef7622cc.exe

pid process

1628 f760703.exe
1628 f760703.exe
2532 f7622cc.exe

description	ioc	process
File created	C:\Windows\f765744	f7622cc.exe
File created	C:\Windows\f760751	f760703.exe
File opened for modification	C:\Windows\SYSTEM.INI	f760703.exe

pid	process
1628	f760703.exe
1628	f760703.exe
2532	f7622cc.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

Processes:

f760703.exef7622cc.exe

description	pid	process
Token: SeDebugPrivilege	1628	f760703.exe
Token: SeDebugPrivilege	1628	f760703.exe
Token: SeDebugPrivilege	1628	f760703.exe
Token: SeDebugPrivilege	1628	f760703.exe
Token: SeDebugPrivilege	1628	f760703.exe
Token: SeDebugPrivilege	1628	f760703.exe
Token: SeDebugPrivilege	1628	f760703.exe
Token: SeDebugPrivilege	1628	f760703.exe
Token: SeDebugPrivilege	1628	f760703.exe
Token: SeDebugPrivilege	1628	f760703.exe
Token: SeDebugPrivilege	1628	f760703.exe
Token: SeDebugPrivilege	1628	f760703.exe
Token: SeDebugPrivilege	1628	f760703.exe
Token: SeDebugPrivilege	1628	f760703.exe
Token: SeDebugPrivilege	1628	f760703.exe
Token: SeDebugPrivilege	1628	f760703.exe
Token: SeDebugPrivilege	1628	f760703.exe
Token: SeDebugPrivilege	1628	f760703.exe
Token: SeDebugPrivilege	1628	f760703.exe
Token: SeDebugPrivilege	1628	f760703.exe
Token: SeDebugPrivilege	1628	f760703.exe
Token: SeDebugPrivilege	2532	f7622cc.exe
Token: SeDebugPrivilege	2532	f7622cc.exe
Token: SeDebugPrivilege	2532	f7622cc.exe
Token: SeDebugPrivilege	2532	f7622cc.exe
Token: SeDebugPrivilege	2532	f7622cc.exe
Token: SeDebugPrivilege	2532	f7622cc.exe
Token: SeDebugPrivilege	2532	f7622cc.exe
Token: SeDebugPrivilege	2532	f7622cc.exe
Token: SeDebugPrivilege	2532	f7622cc.exe
Token: SeDebugPrivilege	2532	f7622cc.exe
Token: SeDebugPrivilege	2532	f7622cc.exe
Token: SeDebugPrivilege	2532	f7622cc.exe
Token: SeDebugPrivilege	2532	f7622cc.exe
Token: SeDebugPrivilege	2532	f7622cc.exe
Token: SeDebugPrivilege	2532	f7622cc.exe
Token: SeDebugPrivilege	2532	f7622cc.exe
Token: SeDebugPrivilege	2532	f7622cc.exe
Token: SeDebugPrivilege	2532	f7622cc.exe
Token: SeDebugPrivilege	2532	f7622cc.exe
Token: SeDebugPrivilege	2532	f7622cc.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

rundll32.exerundll32.exef760703.exef7622cc.exe

description	pid	process	target process
PID 2072 wrote to memory of 1600	2072	rundll32.exe	rundll32.exe
PID 2072 wrote to memory of 1600	2072	rundll32.exe	rundll32.exe
PID 2072 wrote to memory of 1600	2072	rundll32.exe	rundll32.exe
PID 2072 wrote to memory of 1600	2072	rundll32.exe	rundll32.exe
PID 2072 wrote to memory of 1600	2072	rundll32.exe	rundll32.exe
PID 2072 wrote to memory of 1600	2072	rundll32.exe	rundll32.exe
PID 2072 wrote to memory of 1600	2072	rundll32.exe	rundll32.exe
PID 1600 wrote to memory of 1628	1600	rundll32.exe	f760703.exe
PID 1600 wrote to memory of 1628	1600	rundll32.exe	f760703.exe
PID 1600 wrote to memory of 1628	1600	rundll32.exe	f760703.exe
PID 1600 wrote to memory of 1628	1600	rundll32.exe	f760703.exe
PID 1628 wrote to memory of 1084	1628	f760703.exe	taskhost.exe
PID 1628 wrote to memory of 1152	1628	f760703.exe	Dwm.exe
PID 1628 wrote to memory of 1200	1628	f760703.exe	Explorer.EXE
PID 1628 wrote to memory of 1668	1628	f760703.exe	DllHost.exe
PID 1628 wrote to memory of 2072	1628	f760703.exe	rundll32.exe
PID 1628 wrote to memory of 1600	1628	f760703.exe	rundll32.exe
PID 1628 wrote to memory of 1600	1628	f760703.exe	rundll32.exe
PID 1600 wrote to memory of 2736	1600	rundll32.exe	f76086a.exe
PID 1600 wrote to memory of 2736	1600	rundll32.exe	f76086a.exe
PID 1600 wrote to memory of 2736	1600	rundll32.exe	f76086a.exe
PID 1600 wrote to memory of 2736	1600	rundll32.exe	f76086a.exe
PID 1600 wrote to memory of 2532	1600	rundll32.exe	f7622cc.exe
PID 1600 wrote to memory of 2532	1600	rundll32.exe	f7622cc.exe
PID 1600 wrote to memory of 2532	1600	rundll32.exe	f7622cc.exe
PID 1600 wrote to memory of 2532	1600	rundll32.exe	f7622cc.exe
PID 1628 wrote to memory of 1084	1628	f760703.exe	taskhost.exe
PID 1628 wrote to memory of 1152	1628	f760703.exe	Dwm.exe
PID 1628 wrote to memory of 1200	1628	f760703.exe	Explorer.EXE
PID 1628 wrote to memory of 2736	1628	f760703.exe	f76086a.exe
PID 1628 wrote to memory of 2736	1628	f760703.exe	f76086a.exe
PID 1628 wrote to memory of 2532	1628	f760703.exe	f7622cc.exe
PID 1628 wrote to memory of 2532	1628	f760703.exe	f7622cc.exe
PID 2532 wrote to memory of 1084	2532	f7622cc.exe	taskhost.exe
PID 2532 wrote to memory of 1152	2532	f7622cc.exe	Dwm.exe
PID 2532 wrote to memory of 1200	2532	f7622cc.exe	Explorer.EXE

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

f760703.exef7622cc.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f760703.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f7622cc.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1084

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1152

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1200

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\17982cc741232f395fe8ea0af191c1611acfdf37da04287f856d3320e8e911a4.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2072

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\17982cc741232f395fe8ea0af191c1611acfdf37da04287f856d3320e8e911a4.dll,#1
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1600

C:\Users\Admin\AppData\Local\Temp\f760703.exe
C:\Users\Admin\AppData\Local\Temp\f760703.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1628

C:\Users\Admin\AppData\Local\Temp\f76086a.exe
C:\Users\Admin\AppData\Local\Temp\f76086a.exe
4⤵
- Executes dropped EXE
PID:2736

C:\Users\Admin\AppData\Local\Temp\f7622cc.exe
C:\Users\Admin\AppData\Local\Temp\f7622cc.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2532

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1668

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SYSTEM.INI
Filesize
257B

MD5
f497fce1fe9542c91b83f13b4417d2f4

SHA1
14f60287c8bbc4feb6b4c3ae034779d9bc24b30b

SHA256
6970e4ad2ccd957db86d5f145152a5594fc07e17f2b823e39cde31c8ed08addd

SHA512
9fee666894e0eca419bcbeda7b4a31e4dc2d0eaa857fed71a151f15c9d09b7600b844c52094f06db483b1d156a9c808114fd00f95c234175ba4bb49011d666f4

Download Submit
\Users\Admin\AppData\Local\Temp\f760703.exe
Filesize
97KB

MD5
d23dc0dbe30f9197398ee37b27897dd7

SHA1
34ff02d57afbc19ed2691cb4fe7796d2e2a6652c

SHA256
dce90f408e745603cdd91e86d5f848ef771d96b962ed05e58262a42db2020520

SHA512
95e8e05c4615d13b599fb23ddbcc4371c8e647b38045e82d8fd83f20758cdf6097feb3f02b37cc30b915801090076135dcd745fc5657c16707a13fe7de5c3fb5

Download Submit
memory/1084-28-0x00000000003D0000-0x00000000003D2000-memory.dmp

Filesize
8KB

Download
memory/1600-36-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/1600-1-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/1600-9-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1600-79-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1600-55-0x00000000001F0000-0x00000000001F2000-memory.dmp

Filesize
8KB

Download
memory/1600-45-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/1600-59-0x00000000001F0000-0x00000000001F2000-memory.dmp

Filesize
8KB

Download
memory/1600-58-0x00000000002A0000-0x00000000002B2000-memory.dmp

Filesize
72KB

Download
memory/1600-35-0x00000000001F0000-0x00000000001F2000-memory.dmp

Filesize
8KB

Download
memory/1628-62-0x00000000006A0000-0x000000000175A000-memory.dmp

Filesize
16.7MB

Download
memory/1628-13-0x00000000006A0000-0x000000000175A000-memory.dmp

Filesize
16.7MB

Download
memory/1628-57-0x00000000003F0000-0x00000000003F2000-memory.dmp

Filesize
8KB

Download
memory/1628-16-0x00000000006A0000-0x000000000175A000-memory.dmp

Filesize
16.7MB

Download
memory/1628-22-0x00000000006A0000-0x000000000175A000-memory.dmp

Filesize
16.7MB

Download
memory/1628-14-0x00000000006A0000-0x000000000175A000-memory.dmp

Filesize
16.7MB

Download
memory/1628-19-0x00000000006A0000-0x000000000175A000-memory.dmp

Filesize
16.7MB

Download
memory/1628-20-0x00000000006A0000-0x000000000175A000-memory.dmp

Filesize
16.7MB

Download
memory/1628-18-0x00000000006A0000-0x000000000175A000-memory.dmp

Filesize
16.7MB

Download
memory/1628-46-0x0000000001860000-0x0000000001861000-memory.dmp

Filesize
4KB

Download
memory/1628-148-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1628-17-0x00000000006A0000-0x000000000175A000-memory.dmp

Filesize
16.7MB

Download
memory/1628-15-0x00000000006A0000-0x000000000175A000-memory.dmp

Filesize
16.7MB

Download
memory/1628-61-0x00000000006A0000-0x000000000175A000-memory.dmp

Filesize
16.7MB

Download
memory/1628-21-0x00000000006A0000-0x000000000175A000-memory.dmp

Filesize
16.7MB

Download
memory/1628-63-0x00000000006A0000-0x000000000175A000-memory.dmp

Filesize
16.7MB

Download
memory/1628-64-0x00000000006A0000-0x000000000175A000-memory.dmp

Filesize
16.7MB

Download
memory/1628-65-0x00000000006A0000-0x000000000175A000-memory.dmp

Filesize
16.7MB

Download
memory/1628-67-0x00000000006A0000-0x000000000175A000-memory.dmp

Filesize
16.7MB

Download
memory/1628-68-0x00000000006A0000-0x000000000175A000-memory.dmp

Filesize
16.7MB

Download
memory/1628-149-0x00000000006A0000-0x000000000175A000-memory.dmp

Filesize
16.7MB

Download
memory/1628-48-0x00000000003F0000-0x00000000003F2000-memory.dmp

Filesize
8KB

Download
memory/1628-82-0x00000000006A0000-0x000000000175A000-memory.dmp

Filesize
16.7MB

Download
memory/1628-84-0x00000000006A0000-0x000000000175A000-memory.dmp

Filesize
16.7MB

Download
memory/1628-86-0x00000000006A0000-0x000000000175A000-memory.dmp

Filesize
16.7MB

Download
memory/1628-10-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1628-124-0x00000000006A0000-0x000000000175A000-memory.dmp

Filesize
16.7MB

Download
memory/1628-106-0x00000000006A0000-0x000000000175A000-memory.dmp

Filesize
16.7MB

Download
memory/1628-103-0x00000000006A0000-0x000000000175A000-memory.dmp

Filesize
16.7MB

Download
memory/2532-105-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/2532-101-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2532-102-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/2532-81-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2532-167-0x0000000000A00000-0x0000000001ABA000-memory.dmp

Filesize
16.7MB

Download
memory/2532-203-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2532-204-0x0000000000A00000-0x0000000001ABA000-memory.dmp

Filesize
16.7MB

Download
memory/2736-104-0x0000000000360000-0x0000000000362000-memory.dmp

Filesize
8KB

Download
memory/2736-95-0x0000000000360000-0x0000000000362000-memory.dmp

Filesize
8KB

Download
memory/2736-94-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2736-153-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2736-60-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads