sality | 1afee1e360b83dd26765376a455bba1391cca8302f05cb3dc13f25eff5f0b84b

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 19:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1afee1e360b83dd26765376a455bba1391cca8302f05cb3dc13f25eff5f0b84b.dll
Size

120KB
MD5

923ff8bd292fe697210d8fa8f1915abd
SHA1

bdc783a237772c4ee84a8c4fea653385002ea5fe
SHA256

1afee1e360b83dd26765376a455bba1391cca8302f05cb3dc13f25eff5f0b84b
SHA512

ee22dfe438067135279aef0d5c8afb63b92cbbc19c89caafb503aea1ddae7f061923dd6e124a0c9b9e612e205621fac8e75afdae96e285dd20619a6266a00896
SSDEEP

1536:ibhn3zHjSdlEQcRcKe+1o/Tm8tNPW7nmoePfL63r88:sd3zDSDERclKwPonXT37

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 3 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

f768daf.exef768b8d.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	f768daf.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	f768daf.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	f768b8d.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	f768b8d.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	f768b8d.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	f768daf.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f768b8d.exef768daf.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f768b8d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f768daf.exe

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f768daf.exef768b8d.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f768daf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f768b8d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f768b8d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f768b8d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f768daf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f768daf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f768daf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f768daf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f768b8d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f768b8d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f768b8d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f768daf.exe

Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 24 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1520-13-0x0000000000590000-0x000000000164A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1520-11-0x0000000000590000-0x000000000164A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1520-17-0x0000000000590000-0x000000000164A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1520-14-0x0000000000590000-0x000000000164A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1520-20-0x0000000000590000-0x000000000164A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1520-26-0x0000000000590000-0x000000000164A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1520-19-0x0000000000590000-0x000000000164A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1520-16-0x0000000000590000-0x000000000164A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1520-15-0x0000000000590000-0x000000000164A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1520-18-0x0000000000590000-0x000000000164A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1520-60-0x0000000000590000-0x000000000164A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1520-59-0x0000000000590000-0x000000000164A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1520-61-0x0000000000590000-0x000000000164A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1520-63-0x0000000000590000-0x000000000164A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1520-62-0x0000000000590000-0x000000000164A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1520-65-0x0000000000590000-0x000000000164A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1520-78-0x0000000000590000-0x000000000164A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1520-79-0x0000000000590000-0x000000000164A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1520-80-0x0000000000590000-0x000000000164A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1520-84-0x0000000000590000-0x000000000164A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1520-104-0x0000000000590000-0x000000000164A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/1520-149-0x0000000000590000-0x000000000164A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2504-159-0x0000000000A60000-0x0000000001B1A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral1/memory/2504-161-0x0000000000A60000-0x0000000001B1A000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine

UPX dump on OEP (original entry point) 28 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1520-13-0x0000000000590000-0x000000000164A000-memory.dmp	UPX
behavioral1/memory/1520-11-0x0000000000590000-0x000000000164A000-memory.dmp	UPX
behavioral1/memory/2504-51-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral1/memory/1520-17-0x0000000000590000-0x000000000164A000-memory.dmp	UPX
behavioral1/memory/1520-14-0x0000000000590000-0x000000000164A000-memory.dmp	UPX
behavioral1/memory/1520-20-0x0000000000590000-0x000000000164A000-memory.dmp	UPX
behavioral1/memory/1520-26-0x0000000000590000-0x000000000164A000-memory.dmp	UPX
behavioral1/memory/1520-19-0x0000000000590000-0x000000000164A000-memory.dmp	UPX
behavioral1/memory/1520-16-0x0000000000590000-0x000000000164A000-memory.dmp	UPX
behavioral1/memory/1520-15-0x0000000000590000-0x000000000164A000-memory.dmp	UPX
behavioral1/memory/1520-18-0x0000000000590000-0x000000000164A000-memory.dmp	UPX
behavioral1/memory/1520-60-0x0000000000590000-0x000000000164A000-memory.dmp	UPX
behavioral1/memory/1520-59-0x0000000000590000-0x000000000164A000-memory.dmp	UPX
behavioral1/memory/1520-61-0x0000000000590000-0x000000000164A000-memory.dmp	UPX
behavioral1/memory/1520-63-0x0000000000590000-0x000000000164A000-memory.dmp	UPX
behavioral1/memory/1520-62-0x0000000000590000-0x000000000164A000-memory.dmp	UPX
behavioral1/memory/1520-65-0x0000000000590000-0x000000000164A000-memory.dmp	UPX
behavioral1/memory/1520-78-0x0000000000590000-0x000000000164A000-memory.dmp	UPX
behavioral1/memory/1520-79-0x0000000000590000-0x000000000164A000-memory.dmp	UPX
behavioral1/memory/1520-80-0x0000000000590000-0x000000000164A000-memory.dmp	UPX
behavioral1/memory/1520-84-0x0000000000590000-0x000000000164A000-memory.dmp	UPX
behavioral1/memory/1520-104-0x0000000000590000-0x000000000164A000-memory.dmp	UPX
behavioral1/memory/1520-150-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral1/memory/1520-149-0x0000000000590000-0x000000000164A000-memory.dmp	UPX
behavioral1/memory/2504-159-0x0000000000A60000-0x0000000001B1A000-memory.dmp	UPX
behavioral1/memory/2504-162-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral1/memory/2504-161-0x0000000000A60000-0x0000000001B1A000-memory.dmp	UPX
behavioral1/memory/2728-166-0x0000000000400000-0x0000000000412000-memory.dmp	UPX

Executes dropped EXE 3 IoCs

Processes:

f768b8d.exef768daf.exef76a5e0.exe

pid process

1520 f768b8d.exe
2504 f768daf.exe
2728 f76a5e0.exe
Loads dropped DLL 6 IoCs

Processes:

rundll32.exe

pid process

2248 rundll32.exe
2248 rundll32.exe
2248 rundll32.exe
2248 rundll32.exe
2248 rundll32.exe
2248 rundll32.exe

pid	process
1520	f768b8d.exe
2504	f768daf.exe
2728	f76a5e0.exe

pid	process
2248	rundll32.exe
2248	rundll32.exe
2248	rundll32.exe
2248	rundll32.exe
2248	rundll32.exe
2248	rundll32.exe

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1520-13-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/1520-11-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/1520-17-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/1520-14-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/1520-20-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/1520-26-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/1520-19-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/1520-16-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/1520-15-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/1520-18-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/1520-60-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/1520-59-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/1520-61-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/1520-63-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/1520-62-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/1520-65-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/1520-78-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/1520-79-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/1520-80-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/1520-84-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/1520-104-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/1520-149-0x0000000000590000-0x000000000164A000-memory.dmp	upx
behavioral1/memory/2504-159-0x0000000000A60000-0x0000000001B1A000-memory.dmp	upx
behavioral1/memory/2504-161-0x0000000000A60000-0x0000000001B1A000-memory.dmp	upx

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f768b8d.exef768daf.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	f768b8d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f768daf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f768b8d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f768daf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f768b8d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f768b8d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f768daf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f768daf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f768daf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f768b8d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f768b8d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f768b8d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f768daf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	f768daf.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

f768daf.exef768b8d.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f768daf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f768b8d.exe

Enumerates connected drives 3 TTPs 14 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

f768b8d.exe

description	ioc	process
File opened (read-only)	\??\H:	f768b8d.exe
File opened (read-only)	\??\P:	f768b8d.exe
File opened (read-only)	\??\E:	f768b8d.exe
File opened (read-only)	\??\O:	f768b8d.exe
File opened (read-only)	\??\S:	f768b8d.exe
File opened (read-only)	\??\J:	f768b8d.exe
File opened (read-only)	\??\K:	f768b8d.exe
File opened (read-only)	\??\L:	f768b8d.exe
File opened (read-only)	\??\Q:	f768b8d.exe
File opened (read-only)	\??\G:	f768b8d.exe
File opened (read-only)	\??\M:	f768b8d.exe
File opened (read-only)	\??\N:	f768b8d.exe
File opened (read-only)	\??\R:	f768b8d.exe
File opened (read-only)	\??\I:	f768b8d.exe

Drops file in Windows directory 3 IoCs

Processes:

f768daf.exef768b8d.exe

description ioc process

File created C:\Windows\f76dca9 f768daf.exe
File created C:\Windows\f768bfa f768b8d.exe
File opened for modification C:\Windows\SYSTEM.INI f768b8d.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f768b8d.exe

pid process

1520 f768b8d.exe
1520 f768b8d.exe

description	ioc	process
File created	C:\Windows\f76dca9	f768daf.exe
File created	C:\Windows\f768bfa	f768b8d.exe
File opened for modification	C:\Windows\SYSTEM.INI	f768b8d.exe

pid	process
1520	f768b8d.exe
1520	f768b8d.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

f768b8d.exe

description	pid	process
Token: SeDebugPrivilege	1520	f768b8d.exe
Token: SeDebugPrivilege	1520	f768b8d.exe
Token: SeDebugPrivilege	1520	f768b8d.exe
Token: SeDebugPrivilege	1520	f768b8d.exe
Token: SeDebugPrivilege	1520	f768b8d.exe
Token: SeDebugPrivilege	1520	f768b8d.exe
Token: SeDebugPrivilege	1520	f768b8d.exe
Token: SeDebugPrivilege	1520	f768b8d.exe
Token: SeDebugPrivilege	1520	f768b8d.exe
Token: SeDebugPrivilege	1520	f768b8d.exe
Token: SeDebugPrivilege	1520	f768b8d.exe
Token: SeDebugPrivilege	1520	f768b8d.exe
Token: SeDebugPrivilege	1520	f768b8d.exe
Token: SeDebugPrivilege	1520	f768b8d.exe
Token: SeDebugPrivilege	1520	f768b8d.exe
Token: SeDebugPrivilege	1520	f768b8d.exe
Token: SeDebugPrivilege	1520	f768b8d.exe
Token: SeDebugPrivilege	1520	f768b8d.exe
Token: SeDebugPrivilege	1520	f768b8d.exe
Token: SeDebugPrivilege	1520	f768b8d.exe
Token: SeDebugPrivilege	1520	f768b8d.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

rundll32.exerundll32.exef768b8d.exe

description	pid	process	target process
PID 2216 wrote to memory of 2248	2216	rundll32.exe	rundll32.exe
PID 2216 wrote to memory of 2248	2216	rundll32.exe	rundll32.exe
PID 2216 wrote to memory of 2248	2216	rundll32.exe	rundll32.exe
PID 2216 wrote to memory of 2248	2216	rundll32.exe	rundll32.exe
PID 2216 wrote to memory of 2248	2216	rundll32.exe	rundll32.exe
PID 2216 wrote to memory of 2248	2216	rundll32.exe	rundll32.exe
PID 2216 wrote to memory of 2248	2216	rundll32.exe	rundll32.exe
PID 2248 wrote to memory of 1520	2248	rundll32.exe	f768b8d.exe
PID 2248 wrote to memory of 1520	2248	rundll32.exe	f768b8d.exe
PID 2248 wrote to memory of 1520	2248	rundll32.exe	f768b8d.exe
PID 2248 wrote to memory of 1520	2248	rundll32.exe	f768b8d.exe
PID 1520 wrote to memory of 1104	1520	f768b8d.exe	taskhost.exe
PID 1520 wrote to memory of 1180	1520	f768b8d.exe	Dwm.exe
PID 1520 wrote to memory of 1216	1520	f768b8d.exe	Explorer.EXE
PID 1520 wrote to memory of 2012	1520	f768b8d.exe	DllHost.exe
PID 1520 wrote to memory of 2216	1520	f768b8d.exe	rundll32.exe
PID 1520 wrote to memory of 2248	1520	f768b8d.exe	rundll32.exe
PID 1520 wrote to memory of 2248	1520	f768b8d.exe	rundll32.exe
PID 2248 wrote to memory of 2504	2248	rundll32.exe	f768daf.exe
PID 2248 wrote to memory of 2504	2248	rundll32.exe	f768daf.exe
PID 2248 wrote to memory of 2504	2248	rundll32.exe	f768daf.exe
PID 2248 wrote to memory of 2504	2248	rundll32.exe	f768daf.exe
PID 2248 wrote to memory of 2728	2248	rundll32.exe	f76a5e0.exe
PID 2248 wrote to memory of 2728	2248	rundll32.exe	f76a5e0.exe
PID 2248 wrote to memory of 2728	2248	rundll32.exe	f76a5e0.exe
PID 2248 wrote to memory of 2728	2248	rundll32.exe	f76a5e0.exe
PID 1520 wrote to memory of 1104	1520	f768b8d.exe	taskhost.exe
PID 1520 wrote to memory of 1180	1520	f768b8d.exe	Dwm.exe
PID 1520 wrote to memory of 1216	1520	f768b8d.exe	Explorer.EXE
PID 1520 wrote to memory of 2504	1520	f768b8d.exe	f768daf.exe
PID 1520 wrote to memory of 2504	1520	f768b8d.exe	f768daf.exe
PID 1520 wrote to memory of 2728	1520	f768b8d.exe	f76a5e0.exe
PID 1520 wrote to memory of 2728	1520	f768b8d.exe	f76a5e0.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

f768b8d.exef768daf.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f768b8d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f768daf.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1104

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1180

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1216

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1afee1e360b83dd26765376a455bba1391cca8302f05cb3dc13f25eff5f0b84b.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2216

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1afee1e360b83dd26765376a455bba1391cca8302f05cb3dc13f25eff5f0b84b.dll,#1
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2248

C:\Users\Admin\AppData\Local\Temp\f768b8d.exe
C:\Users\Admin\AppData\Local\Temp\f768b8d.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1520

C:\Users\Admin\AppData\Local\Temp\f768daf.exe
C:\Users\Admin\AppData\Local\Temp\f768daf.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System policy modification
PID:2504

C:\Users\Admin\AppData\Local\Temp\f76a5e0.exe
C:\Users\Admin\AppData\Local\Temp\f76a5e0.exe
4⤵
- Executes dropped EXE
PID:2728

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2012

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\f768b8d.exe
Filesize
97KB

MD5
7972c1901878995895093e3e84ed9250

SHA1
02e20232176f61ebf1e46340328deeead333b9c8

SHA256
c2d966c566c9ac1ed3060837e0b53885c36e3115ffd9d76b0f9740c1a441a6ad

SHA512
1273e7b6d97bff8adf9b8c9234beb8e5f169d64922013ecf56e824d67d35dd46a52e22383b97e1c99602a9583b39aee88459afe97fa9f63d1adadf72bf88d023

Download Submit
C:\Windows\SYSTEM.INI
Filesize
257B

MD5
6556513319cb77da32a5ae4c606a60c6

SHA1
9ea3e0071622cdc8523c1cdda36d31f310e66d86

SHA256
649a1513072a776db360ab0c75a0536a1a1ef3ecbdd01e22f6229931dbdfcf35

SHA512
1c9e80013c8d65fe465928f7a87894d04668534f10a98b757a5b6643cad1ea96511149bfe7dfac5ec87e450fd19e614a50855a783b788faeb3686d8cdb40d1b4

Download Submit
memory/1104-21-0x0000000001C60000-0x0000000001C62000-memory.dmp

Filesize
8KB

Download
memory/1520-26-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/1520-19-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/1520-13-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/1520-149-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/1520-17-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/1520-14-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/1520-38-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/1520-20-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/1520-150-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1520-10-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1520-104-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/1520-65-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/1520-52-0x00000000002A0000-0x00000000002A2000-memory.dmp

Filesize
8KB

Download
memory/1520-11-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/1520-16-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/1520-15-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/1520-58-0x00000000002A0000-0x00000000002A2000-memory.dmp

Filesize
8KB

Download
memory/1520-84-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/1520-80-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/1520-79-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/1520-18-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/1520-78-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/1520-60-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/1520-59-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/1520-61-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/1520-63-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/1520-62-0x0000000000590000-0x000000000164A000-memory.dmp

Filesize
16.7MB

Download
memory/2248-39-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2248-49-0x0000000000280000-0x0000000000292000-memory.dmp

Filesize
72KB

Download
memory/2248-73-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/2248-1-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/2248-31-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2248-47-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/2248-9-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2248-30-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/2248-50-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/2504-93-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2504-101-0x0000000000360000-0x0000000000362000-memory.dmp

Filesize
8KB

Download
memory/2504-159-0x0000000000A60000-0x0000000001B1A000-memory.dmp

Filesize
16.7MB

Download
memory/2504-162-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2504-103-0x0000000000360000-0x0000000000362000-memory.dmp

Filesize
8KB

Download
memory/2504-161-0x0000000000A60000-0x0000000001B1A000-memory.dmp

Filesize
16.7MB

Download
memory/2504-51-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2728-99-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/2728-100-0x00000000001F0000-0x00000000001F2000-memory.dmp

Filesize
8KB

Download
memory/2728-102-0x00000000001F0000-0x00000000001F2000-memory.dmp

Filesize
8KB

Download
memory/2728-77-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2728-166-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads