Analysis
-
max time kernel
163s -
max time network
82s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
04/12/2022, 07:26
Static task
static1
Behavioral task
behavioral1
Sample
e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe
Resource
win7-20221111-en
windows7-x64
General
-
Target
e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe
-
Size
148KB
-
MD5
8c21a370bd149784cb7128d666543cc1
-
SHA1
7ad1dea7887f3f8256825b19590604b0d2c5beb7
-
SHA256
e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26
-
SHA512
5a91000b2b57063899f2744ddffddbdb7095088de70e46ccccc0ceaeab77b012cf81fd5b7db7b01136f63bae4051d88cc8c600ab0729206e036ae95644cf0fc0
-
SSDEEP
3072:eahsmpcReL9DxyjcI4zhawZ1CWRtHD24gEtYqniX:/hsmxLKIaMrR12lsYqS
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" foeuvo.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe -
Executes dropped EXE 1 IoCs
pid Process 1816 foeuvo.exe -
resource yara_rule behavioral1/memory/956-55-0x00000000024B0000-0x000000000353E000-memory.dmp upx behavioral1/memory/956-59-0x00000000024B0000-0x000000000353E000-memory.dmp upx behavioral1/memory/956-72-0x00000000024B0000-0x000000000353E000-memory.dmp upx -
Loads dropped DLL 7 IoCs
pid Process 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe 1016 WerFault.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\foeuvo = "C:\\Users\\Admin\\foeuvo.exe" foeuvo.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\ foeuvo.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe -
Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe File opened (read-only) \??\M: e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe File opened (read-only) \??\E: e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe File opened (read-only) \??\F: e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe File opened (read-only) \??\H: e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe File opened (read-only) \??\I: e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe File opened (read-only) \??\G: e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe File opened (read-only) \??\J: e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe File opened (read-only) \??\K: e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe File opened (read-only) \??\W: e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1016 956 WerFault.exe 20 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe 1816 foeuvo.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
description pid Process Token: SeDebugPrivilege 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe Token: SeDebugPrivilege 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe Token: SeDebugPrivilege 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe Token: SeDebugPrivilege 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe Token: SeDebugPrivilege 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe Token: SeDebugPrivilege 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe Token: SeDebugPrivilege 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe Token: SeDebugPrivilege 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe Token: SeDebugPrivilege 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe Token: SeDebugPrivilege 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe Token: SeDebugPrivilege 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe Token: SeDebugPrivilege 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe Token: SeDebugPrivilege 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe Token: SeDebugPrivilege 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe Token: SeDebugPrivilege 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe Token: SeDebugPrivilege 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe Token: SeDebugPrivilege 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe Token: SeDebugPrivilege 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe Token: SeDebugPrivilege 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe Token: SeDebugPrivilege 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe Token: SeDebugPrivilege 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe 1816 foeuvo.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 956 wrote to memory of 1128 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe 18 PID 956 wrote to memory of 1228 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe 17 PID 956 wrote to memory of 1284 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe 16 PID 956 wrote to memory of 1128 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe 18 PID 956 wrote to memory of 1228 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe 17 PID 956 wrote to memory of 1284 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe 16 PID 956 wrote to memory of 1816 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe 28 PID 956 wrote to memory of 1816 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe 28 PID 956 wrote to memory of 1816 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe 28 PID 956 wrote to memory of 1816 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe 28 PID 956 wrote to memory of 1128 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe 18 PID 956 wrote to memory of 1228 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe 17 PID 956 wrote to memory of 1284 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe 16 PID 956 wrote to memory of 1816 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe 28 PID 956 wrote to memory of 1816 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe 28 PID 956 wrote to memory of 1128 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe 18 PID 956 wrote to memory of 1228 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe 17 PID 956 wrote to memory of 1284 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe 16 PID 956 wrote to memory of 1016 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe 29 PID 956 wrote to memory of 1016 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe 29 PID 956 wrote to memory of 1016 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe 29 PID 956 wrote to memory of 1016 956 e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe 29 PID 1816 wrote to memory of 956 1816 foeuvo.exe 20 PID 1816 wrote to memory of 956 1816 foeuvo.exe 20 PID 1816 wrote to memory of 1016 1816 foeuvo.exe 29 PID 1816 wrote to memory of 1016 1816 foeuvo.exe 29 PID 1816 wrote to memory of 956 1816 foeuvo.exe 20 PID 1816 wrote to memory of 956 1816 foeuvo.exe 20 PID 1816 wrote to memory of 1016 1816 foeuvo.exe 29 PID 1816 wrote to memory of 1016 1816 foeuvo.exe 29 PID 1816 wrote to memory of 956 1816 foeuvo.exe 20 PID 1816 wrote to memory of 956 1816 foeuvo.exe 20 PID 1816 wrote to memory of 1016 1816 foeuvo.exe 29 PID 1816 wrote to memory of 1016 1816 foeuvo.exe 29 PID 1816 wrote to memory of 956 1816 foeuvo.exe 20 PID 1816 wrote to memory of 956 1816 foeuvo.exe 20 PID 1816 wrote to memory of 1016 1816 foeuvo.exe 29 PID 1816 wrote to memory of 1016 1816 foeuvo.exe 29 PID 1816 wrote to memory of 956 1816 foeuvo.exe 20 PID 1816 wrote to memory of 956 1816 foeuvo.exe 20 PID 1816 wrote to memory of 1016 1816 foeuvo.exe 29 PID 1816 wrote to memory of 1016 1816 foeuvo.exe 29 PID 1816 wrote to memory of 956 1816 foeuvo.exe 20 PID 1816 wrote to memory of 956 1816 foeuvo.exe 20 PID 1816 wrote to memory of 1016 1816 foeuvo.exe 29 PID 1816 wrote to memory of 1016 1816 foeuvo.exe 29 PID 1816 wrote to memory of 956 1816 foeuvo.exe 20 PID 1816 wrote to memory of 956 1816 foeuvo.exe 20 PID 1816 wrote to memory of 1016 1816 foeuvo.exe 29 PID 1816 wrote to memory of 1016 1816 foeuvo.exe 29 PID 1816 wrote to memory of 956 1816 foeuvo.exe 20 PID 1816 wrote to memory of 956 1816 foeuvo.exe 20 PID 1816 wrote to memory of 1016 1816 foeuvo.exe 29 PID 1816 wrote to memory of 1016 1816 foeuvo.exe 29 PID 1816 wrote to memory of 956 1816 foeuvo.exe 20 PID 1816 wrote to memory of 956 1816 foeuvo.exe 20 PID 1816 wrote to memory of 1016 1816 foeuvo.exe 29 PID 1816 wrote to memory of 1016 1816 foeuvo.exe 29 PID 1816 wrote to memory of 956 1816 foeuvo.exe 20 PID 1816 wrote to memory of 956 1816 foeuvo.exe 20 PID 1816 wrote to memory of 1016 1816 foeuvo.exe 29 PID 1816 wrote to memory of 1016 1816 foeuvo.exe 29 PID 1816 wrote to memory of 956 1816 foeuvo.exe 20 PID 1816 wrote to memory of 956 1816 foeuvo.exe 20 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe"C:\Users\Admin\AppData\Local\Temp\e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:956 -
C:\Users\Admin\foeuvo.exe"C:\Users\Admin\foeuvo.exe"3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1816
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 956 -s 11843⤵
- Loads dropped DLL
- Program crash
PID:1016
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1228
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1128
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
1Modify Existing Service
1Registry Run Keys / Startup Folder
1Defense Evasion
Bypass User Account Control
1Disabling Security Tools
3Hidden Files and Directories
1Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148KB
MD5b5fc37abebd9f7b5f166d42cc8fa2952
SHA101d4da7d332376a2619912a782e9c607001ddb49
SHA2569070d78be05bb5032a350f0305166ebe36cef8afa42dd9b94640ec6617a97db4
SHA5121d882b0a6cad51c87efd8d8c084f57471d3b7898653c10285bbd8a9678595db0a2dccdad4765f5f7cae5725a470e1bb45cf978723d17f184e3ce76347bd4d428
-
Filesize
148KB
MD5b5fc37abebd9f7b5f166d42cc8fa2952
SHA101d4da7d332376a2619912a782e9c607001ddb49
SHA2569070d78be05bb5032a350f0305166ebe36cef8afa42dd9b94640ec6617a97db4
SHA5121d882b0a6cad51c87efd8d8c084f57471d3b7898653c10285bbd8a9678595db0a2dccdad4765f5f7cae5725a470e1bb45cf978723d17f184e3ce76347bd4d428
-
\Users\Admin\AppData\Local\Temp\e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe
Filesize148KB
MD58c21a370bd149784cb7128d666543cc1
SHA17ad1dea7887f3f8256825b19590604b0d2c5beb7
SHA256e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26
SHA5125a91000b2b57063899f2744ddffddbdb7095088de70e46ccccc0ceaeab77b012cf81fd5b7db7b01136f63bae4051d88cc8c600ab0729206e036ae95644cf0fc0
-
\Users\Admin\AppData\Local\Temp\e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe
Filesize148KB
MD58c21a370bd149784cb7128d666543cc1
SHA17ad1dea7887f3f8256825b19590604b0d2c5beb7
SHA256e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26
SHA5125a91000b2b57063899f2744ddffddbdb7095088de70e46ccccc0ceaeab77b012cf81fd5b7db7b01136f63bae4051d88cc8c600ab0729206e036ae95644cf0fc0
-
\Users\Admin\AppData\Local\Temp\e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe
Filesize148KB
MD58c21a370bd149784cb7128d666543cc1
SHA17ad1dea7887f3f8256825b19590604b0d2c5beb7
SHA256e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26
SHA5125a91000b2b57063899f2744ddffddbdb7095088de70e46ccccc0ceaeab77b012cf81fd5b7db7b01136f63bae4051d88cc8c600ab0729206e036ae95644cf0fc0
-
\Users\Admin\AppData\Local\Temp\e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe
Filesize148KB
MD58c21a370bd149784cb7128d666543cc1
SHA17ad1dea7887f3f8256825b19590604b0d2c5beb7
SHA256e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26
SHA5125a91000b2b57063899f2744ddffddbdb7095088de70e46ccccc0ceaeab77b012cf81fd5b7db7b01136f63bae4051d88cc8c600ab0729206e036ae95644cf0fc0
-
\Users\Admin\AppData\Local\Temp\e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26.exe
Filesize148KB
MD58c21a370bd149784cb7128d666543cc1
SHA17ad1dea7887f3f8256825b19590604b0d2c5beb7
SHA256e07bf599cc6052136e2c987848f9e2ac32a2d2e8519410a1943c32d4dbc0fe26
SHA5125a91000b2b57063899f2744ddffddbdb7095088de70e46ccccc0ceaeab77b012cf81fd5b7db7b01136f63bae4051d88cc8c600ab0729206e036ae95644cf0fc0
-
Filesize
148KB
MD5b5fc37abebd9f7b5f166d42cc8fa2952
SHA101d4da7d332376a2619912a782e9c607001ddb49
SHA2569070d78be05bb5032a350f0305166ebe36cef8afa42dd9b94640ec6617a97db4
SHA5121d882b0a6cad51c87efd8d8c084f57471d3b7898653c10285bbd8a9678595db0a2dccdad4765f5f7cae5725a470e1bb45cf978723d17f184e3ce76347bd4d428
-
Filesize
148KB
MD5b5fc37abebd9f7b5f166d42cc8fa2952
SHA101d4da7d332376a2619912a782e9c607001ddb49
SHA2569070d78be05bb5032a350f0305166ebe36cef8afa42dd9b94640ec6617a97db4
SHA5121d882b0a6cad51c87efd8d8c084f57471d3b7898653c10285bbd8a9678595db0a2dccdad4765f5f7cae5725a470e1bb45cf978723d17f184e3ce76347bd4d428