Analysis
-
max time kernel
137s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
23-04-2024 13:29
Behavioral task
behavioral1
Sample
d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe
Resource
win7-20240220-en
General
-
Target
d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe
-
Size
2.5MB
-
MD5
f0b291a13e780a78cd5270f2f976355e
-
SHA1
ff0bfead9d220b00869e32bc552b9311a5295080
-
SHA256
d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1
-
SHA512
ee9f7119ec79c757d8943fd5dfef1ae189ae7a0f51581f9723bdce172648f8dab62f5536f6e54c9f45db1e92cf10f178a6359509b074f09ef7e4573ecffb2c38
-
SSDEEP
49152:wjfT+6ngdZqU8nWw08pbGKjJJ4sZ0BxpKGHdtOlsmgUuyv9rmil:wjfT+9Hv8Ww0E34siginOicu29rxl
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe -
Processes:
d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe -
Processes:
d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe -
Processes:
resource yara_rule behavioral2/memory/3248-0-0x0000000000400000-0x000000000119E000-memory.dmp upx behavioral2/memory/3248-1-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/3248-3-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/3248-4-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/3248-5-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/3248-8-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/3248-10-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/3248-11-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/3248-13-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/3248-14-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/3248-15-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/3248-16-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/3248-17-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/3248-18-0x0000000000400000-0x000000000119E000-memory.dmp upx behavioral2/memory/3248-19-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/3248-20-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/3248-34-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/3248-35-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/3248-36-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/3248-38-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/3248-39-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/3248-41-0x0000000000400000-0x000000000119E000-memory.dmp upx behavioral2/memory/3248-42-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/3248-44-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/3248-47-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/3248-49-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/3248-51-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/3248-57-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/3248-58-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/3248-59-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/3248-60-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/3248-63-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/3248-65-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/3248-67-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/3248-69-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/3248-71-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/3248-73-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/3248-75-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/3248-77-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/3248-79-0x0000000003080000-0x000000000410E000-memory.dmp upx behavioral2/memory/3248-82-0x0000000003080000-0x000000000410E000-memory.dmp upx -
Processes:
d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe -
Processes:
d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exedescription ioc process File opened (read-only) \??\Z: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened (read-only) \??\K: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened (read-only) \??\L: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened (read-only) \??\P: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened (read-only) \??\T: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened (read-only) \??\W: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened (read-only) \??\E: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened (read-only) \??\F: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened (read-only) \??\O: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened (read-only) \??\Q: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened (read-only) \??\V: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened (read-only) \??\I: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened (read-only) \??\J: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened (read-only) \??\S: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened (read-only) \??\U: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened (read-only) \??\Y: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened (read-only) \??\R: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened (read-only) \??\X: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened (read-only) \??\D: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened (read-only) \??\G: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened (read-only) \??\H: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened (read-only) \??\M: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened (read-only) \??\N: d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exedescription ioc process File opened for modification C:\autorun.inf d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened for modification F:\autorun.inf d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe -
Drops file in Program Files directory 12 IoCs
Processes:
d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exedescription ioc process File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe -
Drops file in Windows directory 1 IoCs
Processes:
d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exepid process 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exedescription pid process Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Token: SeDebugPrivilege 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exepid process 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exedescription pid process target process PID 3248 wrote to memory of 804 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe fontdrvhost.exe PID 3248 wrote to memory of 812 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe fontdrvhost.exe PID 3248 wrote to memory of 404 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe dwm.exe PID 3248 wrote to memory of 2408 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe sihost.exe PID 3248 wrote to memory of 2428 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe svchost.exe PID 3248 wrote to memory of 2512 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe taskhostw.exe PID 3248 wrote to memory of 3336 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Explorer.EXE PID 3248 wrote to memory of 3532 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe svchost.exe PID 3248 wrote to memory of 3736 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe DllHost.exe PID 3248 wrote to memory of 3840 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe StartMenuExperienceHost.exe PID 3248 wrote to memory of 3960 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe RuntimeBroker.exe PID 3248 wrote to memory of 4048 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe SearchApp.exe PID 3248 wrote to memory of 3648 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe RuntimeBroker.exe PID 3248 wrote to memory of 2204 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe RuntimeBroker.exe PID 3248 wrote to memory of 2404 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe TextInputHost.exe PID 3248 wrote to memory of 4880 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe msedge.exe PID 3248 wrote to memory of 1528 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe msedge.exe PID 3248 wrote to memory of 3516 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe msedge.exe PID 3248 wrote to memory of 2328 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe msedge.exe PID 3248 wrote to memory of 1768 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe msedge.exe PID 3248 wrote to memory of 3500 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe msedge.exe PID 3248 wrote to memory of 5024 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe msedge.exe PID 3248 wrote to memory of 804 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe fontdrvhost.exe PID 3248 wrote to memory of 812 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe fontdrvhost.exe PID 3248 wrote to memory of 404 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe dwm.exe PID 3248 wrote to memory of 2408 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe sihost.exe PID 3248 wrote to memory of 2428 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe svchost.exe PID 3248 wrote to memory of 2512 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe taskhostw.exe PID 3248 wrote to memory of 3336 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Explorer.EXE PID 3248 wrote to memory of 3532 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe svchost.exe PID 3248 wrote to memory of 3736 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe DllHost.exe PID 3248 wrote to memory of 3840 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe StartMenuExperienceHost.exe PID 3248 wrote to memory of 3960 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe RuntimeBroker.exe PID 3248 wrote to memory of 4048 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe SearchApp.exe PID 3248 wrote to memory of 3648 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe RuntimeBroker.exe PID 3248 wrote to memory of 2204 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe RuntimeBroker.exe PID 3248 wrote to memory of 2404 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe TextInputHost.exe PID 3248 wrote to memory of 4880 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe msedge.exe PID 3248 wrote to memory of 1528 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe msedge.exe PID 3248 wrote to memory of 3516 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe msedge.exe PID 3248 wrote to memory of 2328 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe msedge.exe PID 3248 wrote to memory of 1768 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe msedge.exe PID 3248 wrote to memory of 3500 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe msedge.exe PID 3248 wrote to memory of 5024 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe msedge.exe PID 3248 wrote to memory of 804 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe fontdrvhost.exe PID 3248 wrote to memory of 812 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe fontdrvhost.exe PID 3248 wrote to memory of 404 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe dwm.exe PID 3248 wrote to memory of 2408 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe sihost.exe PID 3248 wrote to memory of 2428 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe svchost.exe PID 3248 wrote to memory of 2512 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe taskhostw.exe PID 3248 wrote to memory of 3336 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe Explorer.EXE PID 3248 wrote to memory of 3532 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe svchost.exe PID 3248 wrote to memory of 3736 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe DllHost.exe PID 3248 wrote to memory of 3840 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe StartMenuExperienceHost.exe PID 3248 wrote to memory of 3960 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe RuntimeBroker.exe PID 3248 wrote to memory of 4048 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe SearchApp.exe PID 3248 wrote to memory of 3648 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe RuntimeBroker.exe PID 3248 wrote to memory of 2204 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe RuntimeBroker.exe PID 3248 wrote to memory of 2404 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe TextInputHost.exe PID 3248 wrote to memory of 4880 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe msedge.exe PID 3248 wrote to memory of 1528 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe msedge.exe PID 3248 wrote to memory of 3516 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe msedge.exe PID 3248 wrote to memory of 2328 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe msedge.exe PID 3248 wrote to memory of 1768 3248 d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe msedge.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe"C:\Users\Admin\AppData\Local\Temp\d3dd245c4523800c257784ae994c84ac5f154781f91c9115b1707fbeb4a720f1.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffea3b92e98,0x7ffea3b92ea4,0x7ffea3b92eb02⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2276 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3196 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:32⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3340 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5376 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=5356 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1348 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:82⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\onsr.pifFilesize
100KB
MD5f218c1053e92c715601311091e016d21
SHA11772d75535b9c3c3461d330a2c09147f144d93b0
SHA25662d5cd7073b333594fa6ca09931779dcc8a36cb1dbfeea7630c6f169868bf48e
SHA5126032f333861dd2119b8c03064ba1dc6764ddb1f774ceff682f952e163070c90bda251fa4e33dd7a689bb6fd66febcbeefd494302d7a3828d762d00d18f760402
-
memory/3248-39-0x0000000003080000-0x000000000410E000-memory.dmpFilesize
16.6MB
-
memory/3248-77-0x0000000003080000-0x000000000410E000-memory.dmpFilesize
16.6MB
-
memory/3248-4-0x0000000003080000-0x000000000410E000-memory.dmpFilesize
16.6MB
-
memory/3248-7-0x0000000004460000-0x0000000004461000-memory.dmpFilesize
4KB
-
memory/3248-5-0x0000000003080000-0x000000000410E000-memory.dmpFilesize
16.6MB
-
memory/3248-6-0x0000000004450000-0x0000000004452000-memory.dmpFilesize
8KB
-
memory/3248-9-0x0000000004450000-0x0000000004452000-memory.dmpFilesize
8KB
-
memory/3248-8-0x0000000003080000-0x000000000410E000-memory.dmpFilesize
16.6MB
-
memory/3248-10-0x0000000003080000-0x000000000410E000-memory.dmpFilesize
16.6MB
-
memory/3248-12-0x0000000005250000-0x0000000005251000-memory.dmpFilesize
4KB
-
memory/3248-11-0x0000000003080000-0x000000000410E000-memory.dmpFilesize
16.6MB
-
memory/3248-13-0x0000000003080000-0x000000000410E000-memory.dmpFilesize
16.6MB
-
memory/3248-14-0x0000000003080000-0x000000000410E000-memory.dmpFilesize
16.6MB
-
memory/3248-15-0x0000000003080000-0x000000000410E000-memory.dmpFilesize
16.6MB
-
memory/3248-16-0x0000000003080000-0x000000000410E000-memory.dmpFilesize
16.6MB
-
memory/3248-17-0x0000000003080000-0x000000000410E000-memory.dmpFilesize
16.6MB
-
memory/3248-18-0x0000000000400000-0x000000000119E000-memory.dmpFilesize
13.6MB
-
memory/3248-19-0x0000000003080000-0x000000000410E000-memory.dmpFilesize
16.6MB
-
memory/3248-20-0x0000000003080000-0x000000000410E000-memory.dmpFilesize
16.6MB
-
memory/3248-34-0x0000000003080000-0x000000000410E000-memory.dmpFilesize
16.6MB
-
memory/3248-35-0x0000000003080000-0x000000000410E000-memory.dmpFilesize
16.6MB
-
memory/3248-36-0x0000000003080000-0x000000000410E000-memory.dmpFilesize
16.6MB
-
memory/3248-93-0x0000000004450000-0x0000000004452000-memory.dmpFilesize
8KB
-
memory/3248-3-0x0000000003080000-0x000000000410E000-memory.dmpFilesize
16.6MB
-
memory/3248-47-0x0000000003080000-0x000000000410E000-memory.dmpFilesize
16.6MB
-
memory/3248-42-0x0000000003080000-0x000000000410E000-memory.dmpFilesize
16.6MB
-
memory/3248-44-0x0000000003080000-0x000000000410E000-memory.dmpFilesize
16.6MB
-
memory/3248-41-0x0000000000400000-0x000000000119E000-memory.dmpFilesize
13.6MB
-
memory/3248-49-0x0000000003080000-0x000000000410E000-memory.dmpFilesize
16.6MB
-
memory/3248-51-0x0000000003080000-0x000000000410E000-memory.dmpFilesize
16.6MB
-
memory/3248-57-0x0000000003080000-0x000000000410E000-memory.dmpFilesize
16.6MB
-
memory/3248-58-0x0000000003080000-0x000000000410E000-memory.dmpFilesize
16.6MB
-
memory/3248-59-0x0000000003080000-0x000000000410E000-memory.dmpFilesize
16.6MB
-
memory/3248-60-0x0000000003080000-0x000000000410E000-memory.dmpFilesize
16.6MB
-
memory/3248-63-0x0000000003080000-0x000000000410E000-memory.dmpFilesize
16.6MB
-
memory/3248-65-0x0000000003080000-0x000000000410E000-memory.dmpFilesize
16.6MB
-
memory/3248-67-0x0000000003080000-0x000000000410E000-memory.dmpFilesize
16.6MB
-
memory/3248-69-0x0000000003080000-0x000000000410E000-memory.dmpFilesize
16.6MB
-
memory/3248-71-0x0000000003080000-0x000000000410E000-memory.dmpFilesize
16.6MB
-
memory/3248-73-0x0000000003080000-0x000000000410E000-memory.dmpFilesize
16.6MB
-
memory/3248-75-0x0000000003080000-0x000000000410E000-memory.dmpFilesize
16.6MB
-
memory/3248-0-0x0000000000400000-0x000000000119E000-memory.dmpFilesize
13.6MB
-
memory/3248-79-0x0000000003080000-0x000000000410E000-memory.dmpFilesize
16.6MB
-
memory/3248-82-0x0000000003080000-0x000000000410E000-memory.dmpFilesize
16.6MB
-
memory/3248-1-0x0000000003080000-0x000000000410E000-memory.dmpFilesize
16.6MB
-
memory/3248-38-0x0000000003080000-0x000000000410E000-memory.dmpFilesize
16.6MB
-
memory/3248-95-0x0000000005250000-0x0000000005251000-memory.dmpFilesize
4KB