Analysis
-
max time kernel
40s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06/11/2022, 18:11
Static task
static1
Behavioral task
behavioral1
Sample
2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe
Resource
win7-20220812-en
windows7-x64
13 signatures
150 seconds
General
-
Target
2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe
-
Size
1.2MB
-
MD5
0f4dbbd12cbb21650ddd494687ef4fc0
-
SHA1
874944d0bc0a96b179798472223a0913b7e0946c
-
SHA256
2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6
-
SHA512
566b5e58cf7b1fcef611ec0b8b73015e01f8a94bf653fc2e13b7a5f2faaa86986f39309c0c022a938d7a39c3cf03ddd6a8bd0e8ae4b619ce909f4a1345bff56a
-
SSDEEP
3072:g4KLVfykOSaz8ceGcpQcf9nLzrDh5m0FkWI7bGmxMGft6DJlmMn:g4KLhOpYcexFln/Pm0q17bG8lMD
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe -
resource yara_rule behavioral1/memory/1248-55-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx behavioral1/memory/1248-58-0x0000000001DE0000-0x0000000002E6E000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe -
Suspicious behavior: MapViewOfSection 20 IoCs
pid Process 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe -
Suspicious use of AdjustPrivilegeToken 20 IoCs
description pid Process Token: SeDebugPrivilege 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe Token: SeDebugPrivilege 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe Token: SeDebugPrivilege 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe Token: SeDebugPrivilege 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe Token: SeDebugPrivilege 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe Token: SeDebugPrivilege 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe Token: SeDebugPrivilege 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe Token: SeDebugPrivilege 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe Token: SeDebugPrivilege 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe Token: SeDebugPrivilege 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe Token: SeDebugPrivilege 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe Token: SeDebugPrivilege 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe Token: SeDebugPrivilege 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe Token: SeDebugPrivilege 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe Token: SeDebugPrivilege 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe Token: SeDebugPrivilege 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe Token: SeDebugPrivilege 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe Token: SeDebugPrivilege 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe Token: SeDebugPrivilege 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe Token: SeDebugPrivilege 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1248 wrote to memory of 1300 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 16 PID 1248 wrote to memory of 1404 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 10 PID 1248 wrote to memory of 1444 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 15 PID 1248 wrote to memory of 368 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 5 PID 1248 wrote to memory of 368 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 5 PID 1248 wrote to memory of 368 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 5 PID 1248 wrote to memory of 368 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 5 PID 1248 wrote to memory of 368 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 5 PID 1248 wrote to memory of 368 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 5 PID 1248 wrote to memory of 368 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 5 PID 1248 wrote to memory of 376 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 4 PID 1248 wrote to memory of 376 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 4 PID 1248 wrote to memory of 376 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 4 PID 1248 wrote to memory of 376 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 4 PID 1248 wrote to memory of 376 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 4 PID 1248 wrote to memory of 376 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 4 PID 1248 wrote to memory of 376 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 4 PID 1248 wrote to memory of 416 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 3 PID 1248 wrote to memory of 416 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 3 PID 1248 wrote to memory of 416 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 3 PID 1248 wrote to memory of 416 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 3 PID 1248 wrote to memory of 416 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 3 PID 1248 wrote to memory of 416 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 3 PID 1248 wrote to memory of 416 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 3 PID 1248 wrote to memory of 460 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 2 PID 1248 wrote to memory of 460 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 2 PID 1248 wrote to memory of 460 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 2 PID 1248 wrote to memory of 460 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 2 PID 1248 wrote to memory of 460 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 2 PID 1248 wrote to memory of 460 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 2 PID 1248 wrote to memory of 460 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 2 PID 1248 wrote to memory of 480 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 1 PID 1248 wrote to memory of 480 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 1 PID 1248 wrote to memory of 480 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 1 PID 1248 wrote to memory of 480 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 1 PID 1248 wrote to memory of 480 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 1 PID 1248 wrote to memory of 480 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 1 PID 1248 wrote to memory of 480 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 1 PID 1248 wrote to memory of 488 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 24 PID 1248 wrote to memory of 488 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 24 PID 1248 wrote to memory of 488 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 24 PID 1248 wrote to memory of 488 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 24 PID 1248 wrote to memory of 488 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 24 PID 1248 wrote to memory of 488 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 24 PID 1248 wrote to memory of 488 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 24 PID 1248 wrote to memory of 596 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 8 PID 1248 wrote to memory of 596 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 8 PID 1248 wrote to memory of 596 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 8 PID 1248 wrote to memory of 596 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 8 PID 1248 wrote to memory of 596 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 8 PID 1248 wrote to memory of 596 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 8 PID 1248 wrote to memory of 596 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 8 PID 1248 wrote to memory of 676 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 23 PID 1248 wrote to memory of 676 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 23 PID 1248 wrote to memory of 676 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 23 PID 1248 wrote to memory of 676 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 23 PID 1248 wrote to memory of 676 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 23 PID 1248 wrote to memory of 676 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 23 PID 1248 wrote to memory of 676 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 23 PID 1248 wrote to memory of 752 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 22 PID 1248 wrote to memory of 752 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 22 PID 1248 wrote to memory of 752 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 22 PID 1248 wrote to memory of 752 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 22 PID 1248 wrote to memory of 752 1248 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe 22 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:480
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵PID:460
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵PID:596
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵PID:328
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵PID:1696
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵PID:1800
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵PID:1300
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵PID:1036
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵PID:336
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵PID:884
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵PID:848
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵PID:812
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵PID:752
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵PID:676
-
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:416
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:376
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:368
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:488
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1404
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe"C:\Users\Admin\AppData\Local\Temp\2061ae716311a8fcaad92de82854faea07f060c213b414cee88ad8003300a9a6.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1248
-