Analysis
-
max time kernel
123s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2024, 07:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
数码资源网.url
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
数码资源网.url
Resource
win10v2004-20240419-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
辅助程序/功能程序/csrss.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
辅助程序/功能程序/csrss.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
辅助程序/过游戏保护/csrss.exe
Resource
win7-20240220-en
windows7-x64
16 signatures
150 seconds
General
-
Target
辅助程序/过游戏保护/csrss.exe
-
Size
1.2MB
-
MD5
94dcf3d9a7cf1b9fa079d0e6f4f2ba5a
-
SHA1
72f801de257841558356aae3710ec1e0c606fc8b
-
SHA256
b23e7005b48679fa121cb99ccec15aa5e259c1b91c08a99490ccdb961e330b44
-
SHA512
3bbd4086b97866b9f79d31b1f416bf188bb51bef88f87cb252fc91099ff51703c6eb65f1e40ff866157e306dc52274bba10bf703e1dde320a03705802b13a31c
-
SSDEEP
12288:bcNMq4xG3b0RK5bzMjidw7JU6eUOMwFdVfZobi2a89ujY68aapv:bcD4s3wRQYj6gJU6pOMwFHmi9bOaov
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" csrss.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" csrss.exe -
resource yara_rule behavioral6/memory/4544-3-0x0000000002770000-0x00000000037FE000-memory.dmp upx behavioral6/memory/4544-5-0x0000000002770000-0x00000000037FE000-memory.dmp upx behavioral6/memory/4544-10-0x0000000002770000-0x00000000037FE000-memory.dmp upx behavioral6/memory/4544-6-0x0000000002770000-0x00000000037FE000-memory.dmp upx behavioral6/memory/4544-14-0x0000000002770000-0x00000000037FE000-memory.dmp upx behavioral6/memory/4544-13-0x0000000002770000-0x00000000037FE000-memory.dmp upx behavioral6/memory/4544-15-0x0000000002770000-0x00000000037FE000-memory.dmp upx behavioral6/memory/4544-7-0x0000000002770000-0x00000000037FE000-memory.dmp upx behavioral6/memory/4544-1-0x0000000002770000-0x00000000037FE000-memory.dmp upx behavioral6/memory/4544-16-0x0000000002770000-0x00000000037FE000-memory.dmp upx behavioral6/memory/4544-17-0x0000000002770000-0x00000000037FE000-memory.dmp upx behavioral6/memory/4544-18-0x0000000002770000-0x00000000037FE000-memory.dmp upx behavioral6/memory/4544-19-0x0000000002770000-0x00000000037FE000-memory.dmp upx behavioral6/memory/4544-20-0x0000000002770000-0x00000000037FE000-memory.dmp upx behavioral6/memory/4544-22-0x0000000002770000-0x00000000037FE000-memory.dmp upx behavioral6/memory/4544-23-0x0000000002770000-0x00000000037FE000-memory.dmp upx behavioral6/memory/4544-24-0x0000000002770000-0x00000000037FE000-memory.dmp upx behavioral6/memory/4544-26-0x0000000002770000-0x00000000037FE000-memory.dmp upx behavioral6/memory/4544-27-0x0000000002770000-0x00000000037FE000-memory.dmp upx behavioral6/memory/4544-29-0x0000000002770000-0x00000000037FE000-memory.dmp upx behavioral6/memory/4544-31-0x0000000002770000-0x00000000037FE000-memory.dmp upx behavioral6/memory/4544-33-0x0000000002770000-0x00000000037FE000-memory.dmp upx behavioral6/memory/4544-36-0x0000000002770000-0x00000000037FE000-memory.dmp upx behavioral6/memory/4544-39-0x0000000002770000-0x00000000037FE000-memory.dmp upx behavioral6/memory/4544-41-0x0000000002770000-0x00000000037FE000-memory.dmp upx behavioral6/memory/4544-42-0x0000000002770000-0x00000000037FE000-memory.dmp upx behavioral6/memory/4544-49-0x0000000002770000-0x00000000037FE000-memory.dmp upx behavioral6/memory/4544-50-0x0000000002770000-0x00000000037FE000-memory.dmp upx behavioral6/memory/4544-52-0x0000000002770000-0x00000000037FE000-memory.dmp upx behavioral6/memory/4544-54-0x0000000002770000-0x00000000037FE000-memory.dmp upx behavioral6/memory/4544-56-0x0000000002770000-0x00000000037FE000-memory.dmp upx behavioral6/memory/4544-58-0x0000000002770000-0x00000000037FE000-memory.dmp upx behavioral6/memory/4544-60-0x0000000002770000-0x00000000037FE000-memory.dmp upx behavioral6/memory/4544-62-0x0000000002770000-0x00000000037FE000-memory.dmp upx behavioral6/memory/4544-63-0x0000000002770000-0x00000000037FE000-memory.dmp upx behavioral6/memory/4544-66-0x0000000002770000-0x00000000037FE000-memory.dmp upx behavioral6/memory/4544-67-0x0000000002770000-0x00000000037FE000-memory.dmp upx behavioral6/memory/4544-68-0x0000000002770000-0x00000000037FE000-memory.dmp upx behavioral6/memory/4544-70-0x0000000002770000-0x00000000037FE000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc csrss.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: csrss.exe File opened (read-only) \??\E: csrss.exe File opened (read-only) \??\H: csrss.exe File opened (read-only) \??\J: csrss.exe File opened (read-only) \??\K: csrss.exe File opened (read-only) \??\L: csrss.exe File opened (read-only) \??\M: csrss.exe File opened (read-only) \??\Q: csrss.exe File opened (read-only) \??\S: csrss.exe File opened (read-only) \??\Z: csrss.exe File opened (read-only) \??\G: csrss.exe File opened (read-only) \??\P: csrss.exe File opened (read-only) \??\V: csrss.exe File opened (read-only) \??\W: csrss.exe File opened (read-only) \??\X: csrss.exe File opened (read-only) \??\Y: csrss.exe File opened (read-only) \??\I: csrss.exe File opened (read-only) \??\N: csrss.exe File opened (read-only) \??\T: csrss.exe File opened (read-only) \??\U: csrss.exe File opened (read-only) \??\O: csrss.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf csrss.exe File opened for modification F:\autorun.inf csrss.exe -
Drops file in Program Files directory 12 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe csrss.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe csrss.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe csrss.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe csrss.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe csrss.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe csrss.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe csrss.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe csrss.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe csrss.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe csrss.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe csrss.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe csrss.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI csrss.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe 4544 csrss.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe Token: SeDebugPrivilege 4544 csrss.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4544 csrss.exe 4544 csrss.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4544 wrote to memory of 780 4544 csrss.exe 8 PID 4544 wrote to memory of 788 4544 csrss.exe 9 PID 4544 wrote to memory of 60 4544 csrss.exe 13 PID 4544 wrote to memory of 2864 4544 csrss.exe 49 PID 4544 wrote to memory of 2988 4544 csrss.exe 51 PID 4544 wrote to memory of 3160 4544 csrss.exe 53 PID 4544 wrote to memory of 3460 4544 csrss.exe 55 PID 4544 wrote to memory of 3632 4544 csrss.exe 57 PID 4544 wrote to memory of 3812 4544 csrss.exe 58 PID 4544 wrote to memory of 3900 4544 csrss.exe 59 PID 4544 wrote to memory of 3964 4544 csrss.exe 60 PID 4544 wrote to memory of 4052 4544 csrss.exe 61 PID 4544 wrote to memory of 4136 4544 csrss.exe 62 PID 4544 wrote to memory of 3444 4544 csrss.exe 74 PID 4544 wrote to memory of 1540 4544 csrss.exe 76 PID 4544 wrote to memory of 1568 4544 csrss.exe 83 PID 4544 wrote to memory of 1328 4544 csrss.exe 84 PID 4544 wrote to memory of 780 4544 csrss.exe 8 PID 4544 wrote to memory of 788 4544 csrss.exe 9 PID 4544 wrote to memory of 60 4544 csrss.exe 13 PID 4544 wrote to memory of 2864 4544 csrss.exe 49 PID 4544 wrote to memory of 2988 4544 csrss.exe 51 PID 4544 wrote to memory of 3160 4544 csrss.exe 53 PID 4544 wrote to memory of 3460 4544 csrss.exe 55 PID 4544 wrote to memory of 3632 4544 csrss.exe 57 PID 4544 wrote to memory of 3812 4544 csrss.exe 58 PID 4544 wrote to memory of 3900 4544 csrss.exe 59 PID 4544 wrote to memory of 3964 4544 csrss.exe 60 PID 4544 wrote to memory of 4052 4544 csrss.exe 61 PID 4544 wrote to memory of 4136 4544 csrss.exe 62 PID 4544 wrote to memory of 3444 4544 csrss.exe 74 PID 4544 wrote to memory of 1540 4544 csrss.exe 76 PID 4544 wrote to memory of 1568 4544 csrss.exe 83 PID 4544 wrote to memory of 1328 4544 csrss.exe 84 PID 4544 wrote to memory of 3596 4544 csrss.exe 87 PID 4544 wrote to memory of 4584 4544 csrss.exe 88 PID 4544 wrote to memory of 2336 4544 csrss.exe 89 PID 4544 wrote to memory of 780 4544 csrss.exe 8 PID 4544 wrote to memory of 788 4544 csrss.exe 9 PID 4544 wrote to memory of 60 4544 csrss.exe 13 PID 4544 wrote to memory of 2864 4544 csrss.exe 49 PID 4544 wrote to memory of 2988 4544 csrss.exe 51 PID 4544 wrote to memory of 3160 4544 csrss.exe 53 PID 4544 wrote to memory of 3460 4544 csrss.exe 55 PID 4544 wrote to memory of 3632 4544 csrss.exe 57 PID 4544 wrote to memory of 3812 4544 csrss.exe 58 PID 4544 wrote to memory of 3900 4544 csrss.exe 59 PID 4544 wrote to memory of 3964 4544 csrss.exe 60 PID 4544 wrote to memory of 4052 4544 csrss.exe 61 PID 4544 wrote to memory of 4136 4544 csrss.exe 62 PID 4544 wrote to memory of 3444 4544 csrss.exe 74 PID 4544 wrote to memory of 1540 4544 csrss.exe 76 PID 4544 wrote to memory of 1568 4544 csrss.exe 83 PID 4544 wrote to memory of 3596 4544 csrss.exe 87 PID 4544 wrote to memory of 4584 4544 csrss.exe 88 PID 4544 wrote to memory of 780 4544 csrss.exe 8 PID 4544 wrote to memory of 788 4544 csrss.exe 9 PID 4544 wrote to memory of 60 4544 csrss.exe 13 PID 4544 wrote to memory of 2864 4544 csrss.exe 49 PID 4544 wrote to memory of 2988 4544 csrss.exe 51 PID 4544 wrote to memory of 3160 4544 csrss.exe 53 PID 4544 wrote to memory of 3460 4544 csrss.exe 55 PID 4544 wrote to memory of 3632 4544 csrss.exe 57 PID 4544 wrote to memory of 3812 4544 csrss.exe 58 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:60
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2864
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2988
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3160
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\辅助程序\过游戏保护\csrss.exe"C:\Users\Admin\AppData\Local\Temp\辅助程序\过游戏保护\csrss.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4544
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3632
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3812
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3900
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3964
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4052
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4136
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:3444
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1540
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:1568
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:1328
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3596
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4584
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵PID:2336
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵PID:2924
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD5216d14170fa582d5b355b4e6ca973920
SHA1e268829f272621c3dfde08bc58d94fff43bf42f1
SHA256dd58c214170cd22d734dc4422dbc2b2c951609d2dd832dcf451f0a192fe64663
SHA5127db221bcce460209c654451b2b5c806371624e17e25000b0491de25a1a700344107954d778b3f300aae61ed50a6a2b94449d2b01793c086a891f8fce763f11fc