sality | 59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 08:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
Size

113KB
MD5

3bdb17bd97e2fcfea0c6c61025343ce0
SHA1

6597b088ba8c24535b5461ab3e0cd3ffc4e1d589
SHA256

59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67
SHA512

f52f9e2a756700fc83c1480d9cc171daa8b3fd12e7b6d7b4a550c147eb6e775e6d089f644bf68f876c8db833ee5490f78474ab4ae0559c6f24906d5472c2a211
SSDEEP

1536:jY8eqjOolZ1w3tRc5h0xBejiFMp8EMDQlNn+0C5CF5DctUTUj6BSV5wV:s8jOo/1w3U5wALp8EMklNnSQ5Dc7W

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/672-133-0x0000000001030000-0x0000000002060000-memory.dmp	upx
behavioral2/memory/672-134-0x0000000001030000-0x0000000002060000-memory.dmp	upx
behavioral2/memory/672-136-0x0000000001030000-0x0000000002060000-memory.dmp	upx

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SYSTEM.INI	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
Token: SeDebugPrivilege	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
Token: SeDebugPrivilege	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
Token: SeDebugPrivilege	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
Token: SeDebugPrivilege	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
Token: SeDebugPrivilege	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
Token: SeDebugPrivilege	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
Token: SeDebugPrivilege	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
Token: SeDebugPrivilege	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
Token: SeDebugPrivilege	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
Token: SeDebugPrivilege	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
Token: SeDebugPrivilege	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 672 wrote to memory of 604	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	5
PID 672 wrote to memory of 604	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	5
PID 672 wrote to memory of 604	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	5
PID 672 wrote to memory of 604	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	5
PID 672 wrote to memory of 604	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	5
PID 672 wrote to memory of 604	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	5
PID 672 wrote to memory of 664	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	3
PID 672 wrote to memory of 664	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	3
PID 672 wrote to memory of 664	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	3
PID 672 wrote to memory of 664	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	3
PID 672 wrote to memory of 664	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	3
PID 672 wrote to memory of 664	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	3
PID 672 wrote to memory of 768	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	7
PID 672 wrote to memory of 768	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	7
PID 672 wrote to memory of 768	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	7
PID 672 wrote to memory of 768	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	7
PID 672 wrote to memory of 768	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	7
PID 672 wrote to memory of 768	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	7
PID 672 wrote to memory of 772	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	79
PID 672 wrote to memory of 772	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	79
PID 672 wrote to memory of 772	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	79
PID 672 wrote to memory of 772	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	79
PID 672 wrote to memory of 772	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	79
PID 672 wrote to memory of 772	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	79
PID 672 wrote to memory of 784	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	78
PID 672 wrote to memory of 784	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	78
PID 672 wrote to memory of 784	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	78
PID 672 wrote to memory of 784	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	78
PID 672 wrote to memory of 784	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	78
PID 672 wrote to memory of 784	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	78
PID 672 wrote to memory of 884	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	77
PID 672 wrote to memory of 884	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	77
PID 672 wrote to memory of 884	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	77
PID 672 wrote to memory of 884	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	77
PID 672 wrote to memory of 884	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	77
PID 672 wrote to memory of 884	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	77
PID 672 wrote to memory of 940	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	76
PID 672 wrote to memory of 940	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	76
PID 672 wrote to memory of 940	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	76
PID 672 wrote to memory of 940	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	76
PID 672 wrote to memory of 940	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	76
PID 672 wrote to memory of 940	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	76
PID 672 wrote to memory of 1008	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	75
PID 672 wrote to memory of 1008	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	75
PID 672 wrote to memory of 1008	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	75
PID 672 wrote to memory of 1008	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	75
PID 672 wrote to memory of 1008	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	75
PID 672 wrote to memory of 1008	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	75
PID 672 wrote to memory of 428	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	8
PID 672 wrote to memory of 428	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	8
PID 672 wrote to memory of 428	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	8
PID 672 wrote to memory of 428	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	8
PID 672 wrote to memory of 428	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	8
PID 672 wrote to memory of 428	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	8
PID 672 wrote to memory of 744	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	74
PID 672 wrote to memory of 744	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	74
PID 672 wrote to memory of 744	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	74
PID 672 wrote to memory of 744	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	74
PID 672 wrote to memory of 744	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	74
PID 672 wrote to memory of 744	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	74
PID 672 wrote to memory of 904	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	73
PID 672 wrote to memory of 904	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	73
PID 672 wrote to memory of 904	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	73
PID 672 wrote to memory of 904	672	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe	73

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:664

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:604
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:768
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:428

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:3696

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:4736

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:4756

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:2388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:2244

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:3300

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca
1⤵
PID:1104

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:984

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:2464

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:4460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:2308

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:832

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4068

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3764

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3508

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3356

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:1992

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2716
- C:\Users\Admin\AppData\Local\Temp\59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe
  "C:\Users\Admin\AppData\Local\Temp\59d9507c3ebdd3fa4941572da5f0fa12052208faeb6bb2362a5f22432e732c67.exe"
  2⤵
  - UAC bypass
  - Checks whether UAC is enabled
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:672
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3548

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2608

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2516

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2412

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2272

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2140

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:1772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:1668

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1944

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1932

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1860

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1848

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1740

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1624

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1468

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1348

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1060

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:904

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:784
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:2300

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:772

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/672-132-0x0000000001000000-0x000000000102A000-memory.dmp

Filesize
168KB

Download
memory/672-133-0x0000000001030000-0x0000000002060000-memory.dmp

Filesize
16.2MB

Download
memory/672-134-0x0000000001030000-0x0000000002060000-memory.dmp

Filesize
16.2MB

Download
memory/672-135-0x0000000001000000-0x000000000102A000-memory.dmp

Filesize
168KB

Download
memory/672-136-0x0000000001030000-0x0000000002060000-memory.dmp

Filesize
16.2MB

Download