Analysis
-
max time kernel
115s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29/02/2024, 06:03
Static task
static1
Behavioral task
behavioral1
Sample
addb9645270a6dfdae9c1c740eb45353.exe
Resource
win7-20240221-en
General
-
Target
addb9645270a6dfdae9c1c740eb45353.exe
-
Size
381KB
-
MD5
addb9645270a6dfdae9c1c740eb45353
-
SHA1
d44dff3faebd16c5703f77bd58c0acbd64eb26ae
-
SHA256
a167b6fc2838aa7a0153db443885bb5d1a8b74774eb60368ba064fc751c4be28
-
SHA512
b601850abc1c21b038ea51e2549d3ceacf0f8048eee900025541cbc541898c4aca5a14e81cd865b55b1f9d05216b4399986f38ca6f675e9075a4504ffa8e7d66
-
SSDEEP
6144:XZKlg1Vlhw/aAa1Zg30ZTNWSG6/7aDdWCn54YqcDe/NpXsGKLu8Nvswpy2Ua8RGL:X20VlhganzrWSG6zIWC5kcDeltmxvssN
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" addb9645270a6dfdae9c1c740eb45353.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" addb9645270a6dfdae9c1c740eb45353.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" addb9645270a6dfdae9c1c740eb45353.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" addb9645270a6dfdae9c1c740eb45353.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" addb9645270a6dfdae9c1c740eb45353.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" addb9645270a6dfdae9c1c740eb45353.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" addb9645270a6dfdae9c1c740eb45353.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" addb9645270a6dfdae9c1c740eb45353.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" addb9645270a6dfdae9c1c740eb45353.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" addb9645270a6dfdae9c1c740eb45353.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" addb9645270a6dfdae9c1c740eb45353.exe -
Disables Task Manager via registry modification
-
resource yara_rule behavioral2/memory/2120-7-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2120-9-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2120-10-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2120-15-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2120-16-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2120-17-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2120-18-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2120-19-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2120-20-0x0000000002350000-0x00000000033DE000-memory.dmp upx behavioral2/memory/2120-22-0x0000000002350000-0x00000000033DE000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" addb9645270a6dfdae9c1c740eb45353.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc addb9645270a6dfdae9c1c740eb45353.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" addb9645270a6dfdae9c1c740eb45353.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" addb9645270a6dfdae9c1c740eb45353.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" addb9645270a6dfdae9c1c740eb45353.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" addb9645270a6dfdae9c1c740eb45353.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" addb9645270a6dfdae9c1c740eb45353.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" addb9645270a6dfdae9c1c740eb45353.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI addb9645270a6dfdae9c1c740eb45353.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2120 addb9645270a6dfdae9c1c740eb45353.exe 2120 addb9645270a6dfdae9c1c740eb45353.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe Token: SeDebugPrivilege 2120 addb9645270a6dfdae9c1c740eb45353.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 2120 wrote to memory of 784 2120 addb9645270a6dfdae9c1c740eb45353.exe 93 PID 2120 wrote to memory of 788 2120 addb9645270a6dfdae9c1c740eb45353.exe 92 PID 2120 wrote to memory of 64 2120 addb9645270a6dfdae9c1c740eb45353.exe 17 PID 2120 wrote to memory of 2468 2120 addb9645270a6dfdae9c1c740eb45353.exe 72 PID 2120 wrote to memory of 2484 2120 addb9645270a6dfdae9c1c740eb45353.exe 71 PID 2120 wrote to memory of 2620 2120 addb9645270a6dfdae9c1c740eb45353.exe 70 PID 2120 wrote to memory of 3556 2120 addb9645270a6dfdae9c1c740eb45353.exe 59 PID 2120 wrote to memory of 3736 2120 addb9645270a6dfdae9c1c740eb45353.exe 58 PID 2120 wrote to memory of 3928 2120 addb9645270a6dfdae9c1c740eb45353.exe 57 PID 2120 wrote to memory of 4080 2120 addb9645270a6dfdae9c1c740eb45353.exe 56 PID 2120 wrote to memory of 2880 2120 addb9645270a6dfdae9c1c740eb45353.exe 23 PID 2120 wrote to memory of 3800 2120 addb9645270a6dfdae9c1c740eb45353.exe 55 PID 2120 wrote to memory of 4256 2120 addb9645270a6dfdae9c1c740eb45353.exe 54 PID 2120 wrote to memory of 340 2120 addb9645270a6dfdae9c1c740eb45353.exe 52 PID 2120 wrote to memory of 4716 2120 addb9645270a6dfdae9c1c740eb45353.exe 42 PID 2120 wrote to memory of 1348 2120 addb9645270a6dfdae9c1c740eb45353.exe 40 PID 2120 wrote to memory of 4500 2120 addb9645270a6dfdae9c1c740eb45353.exe 38 PID 2120 wrote to memory of 5032 2120 addb9645270a6dfdae9c1c740eb45353.exe 37 PID 2120 wrote to memory of 2408 2120 addb9645270a6dfdae9c1c740eb45353.exe 36 PID 2120 wrote to memory of 1956 2120 addb9645270a6dfdae9c1c740eb45353.exe 35 PID 2120 wrote to memory of 3856 2120 addb9645270a6dfdae9c1c740eb45353.exe 33 PID 2120 wrote to memory of 3680 2120 addb9645270a6dfdae9c1c740eb45353.exe 32 PID 2120 wrote to memory of 4476 2120 addb9645270a6dfdae9c1c740eb45353.exe 28 PID 2120 wrote to memory of 4896 2120 addb9645270a6dfdae9c1c740eb45353.exe 27 PID 2120 wrote to memory of 468 2120 addb9645270a6dfdae9c1c740eb45353.exe 26 PID 2120 wrote to memory of 236 2120 addb9645270a6dfdae9c1c740eb45353.exe 94 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" addb9645270a6dfdae9c1c740eb45353.exe
Processes
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:64
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2880
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:468
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:4896
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca1⤵PID:4476
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=5516 --field-trial-handle=2972,i,4036376905309803364,5412922217215781933,262144 --variations-seed-version /prefetch:11⤵PID:3680
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5276 --field-trial-handle=2972,i,4036376905309803364,5412922217215781933,262144 --variations-seed-version /prefetch:11⤵PID:3856
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3536 --field-trial-handle=2972,i,4036376905309803364,5412922217215781933,262144 --variations-seed-version /prefetch:81⤵PID:1956
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3304 --field-trial-handle=2972,i,4036376905309803364,5412922217215781933,262144 --variations-seed-version /prefetch:31⤵PID:2408
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2968 --field-trial-handle=2972,i,4036376905309803364,5412922217215781933,262144 --variations-seed-version /prefetch:21⤵PID:5032
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x2e0,0x7ff90cd62e98,0x7ff90cd62ea4,0x7ff90cd62eb01⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\addb9645270a6dfdae9c1c740eb45353.exe"C:\Users\Admin\AppData\Local\Temp\addb9645270a6dfdae9c1c740eb45353.exe"1⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2120
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window1⤵PID:1348
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5740 --field-trial-handle=2972,i,4036376905309803364,5412922217215781933,262144 --variations-seed-version /prefetch:82⤵PID:4728
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4716
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:340
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4256
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3800
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4080
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3928
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3736
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3556
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2620
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2484
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2468
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\BackgroundTaskHost.exe"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider1⤵PID:236
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
309KB
MD507f9b39ab7d6cf3de214362b126e6149
SHA1992e0d52ecc404f25a967ef7163a93a390953764
SHA2568df33eeb4c2851a15fcad641cc988cf1f0c836f09fbbde6163ba38ade2a39110
SHA51277e417447d9e767b74b1c2baff250b2ea116b9f92f649819ce9e700597c12b3b3320e2d9eb52e91f2aa144448be2c30f8bb67b66eff32e8b554c836ded553cbb