Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 18:53
Static task
static1
Behavioral task
behavioral1
Sample
13cf44084d1dd7bbdba15da1952dd9b7a65142d0dafb9079b135d7f37291b7cd.dll
Resource
win7-20231129-en
General
-
Target
13cf44084d1dd7bbdba15da1952dd9b7a65142d0dafb9079b135d7f37291b7cd.dll
-
Size
120KB
-
MD5
f8022d66a710ec84460dda2f34917f91
-
SHA1
6eb2a846bbf8a78acec5111771f92df58d4f3560
-
SHA256
13cf44084d1dd7bbdba15da1952dd9b7a65142d0dafb9079b135d7f37291b7cd
-
SHA512
aee71041ef0328ed61c285457e9b8fc88861b0dbb938516ce52522c364ac2fa91ecb6297f43d04e6402e59055df6ae775c4b5da7fa7d0cf560c42b7f7edbc1a2
-
SSDEEP
1536:+CoZnd5ExlKl2iND/JN+w59u4rOK/kto3ux9r+KElPvr05v92I+XEn+lFPyuQe4P:roZd5Eg2ipawqwVkto3uxVhwICjII
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
f7617e4.exef761989.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f7617e4.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f7617e4.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f7617e4.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f761989.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f761989.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f761989.exe -
Processes:
f7617e4.exef761989.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7617e4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f761989.exe -
Processes:
f7617e4.exef761989.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7617e4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f761989.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f761989.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f761989.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7617e4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7617e4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7617e4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7617e4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7617e4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f761989.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f761989.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f761989.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 22 IoCs
Processes:
resource yara_rule behavioral1/memory/2708-23-0x0000000000560000-0x000000000161A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2708-15-0x0000000000560000-0x000000000161A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2708-14-0x0000000000560000-0x000000000161A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2708-18-0x0000000000560000-0x000000000161A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2708-16-0x0000000000560000-0x000000000161A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2708-21-0x0000000000560000-0x000000000161A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2708-19-0x0000000000560000-0x000000000161A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2708-17-0x0000000000560000-0x000000000161A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2708-22-0x0000000000560000-0x000000000161A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2708-20-0x0000000000560000-0x000000000161A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2708-64-0x0000000000560000-0x000000000161A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2708-65-0x0000000000560000-0x000000000161A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2708-66-0x0000000000560000-0x000000000161A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2708-67-0x0000000000560000-0x000000000161A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2708-68-0x0000000000560000-0x000000000161A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2708-70-0x0000000000560000-0x000000000161A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2708-71-0x0000000000560000-0x000000000161A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2708-86-0x0000000000560000-0x000000000161A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2708-89-0x0000000000560000-0x000000000161A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2708-90-0x0000000000560000-0x000000000161A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2708-160-0x0000000000560000-0x000000000161A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2760-172-0x0000000000920000-0x00000000019DA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 25 IoCs
Processes:
resource yara_rule behavioral1/memory/2708-23-0x0000000000560000-0x000000000161A000-memory.dmp UPX behavioral1/memory/2708-15-0x0000000000560000-0x000000000161A000-memory.dmp UPX behavioral1/memory/2708-14-0x0000000000560000-0x000000000161A000-memory.dmp UPX behavioral1/memory/2708-18-0x0000000000560000-0x000000000161A000-memory.dmp UPX behavioral1/memory/2708-16-0x0000000000560000-0x000000000161A000-memory.dmp UPX behavioral1/memory/2708-21-0x0000000000560000-0x000000000161A000-memory.dmp UPX behavioral1/memory/2708-19-0x0000000000560000-0x000000000161A000-memory.dmp UPX behavioral1/memory/2708-17-0x0000000000560000-0x000000000161A000-memory.dmp UPX behavioral1/memory/2708-22-0x0000000000560000-0x000000000161A000-memory.dmp UPX behavioral1/memory/2708-20-0x0000000000560000-0x000000000161A000-memory.dmp UPX behavioral1/memory/2708-64-0x0000000000560000-0x000000000161A000-memory.dmp UPX behavioral1/memory/2708-65-0x0000000000560000-0x000000000161A000-memory.dmp UPX behavioral1/memory/2708-66-0x0000000000560000-0x000000000161A000-memory.dmp UPX behavioral1/memory/2708-67-0x0000000000560000-0x000000000161A000-memory.dmp UPX behavioral1/memory/2708-68-0x0000000000560000-0x000000000161A000-memory.dmp UPX behavioral1/memory/2708-70-0x0000000000560000-0x000000000161A000-memory.dmp UPX behavioral1/memory/2708-71-0x0000000000560000-0x000000000161A000-memory.dmp UPX behavioral1/memory/2708-86-0x0000000000560000-0x000000000161A000-memory.dmp UPX behavioral1/memory/2708-89-0x0000000000560000-0x000000000161A000-memory.dmp UPX behavioral1/memory/2708-90-0x0000000000560000-0x000000000161A000-memory.dmp UPX behavioral1/memory/2708-161-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/2708-160-0x0000000000560000-0x000000000161A000-memory.dmp UPX behavioral1/memory/2760-172-0x0000000000920000-0x00000000019DA000-memory.dmp UPX behavioral1/memory/2760-174-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/3004-178-0x0000000000400000-0x0000000000412000-memory.dmp UPX -
Executes dropped EXE 3 IoCs
Processes:
f7617e4.exef761989.exef76336f.exepid process 2708 f7617e4.exe 2760 f761989.exe 3004 f76336f.exe -
Loads dropped DLL 6 IoCs
Processes:
rundll32.exepid process 2264 rundll32.exe 2264 rundll32.exe 2264 rundll32.exe 2264 rundll32.exe 2264 rundll32.exe 2264 rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/2708-23-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2708-15-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2708-14-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2708-18-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2708-16-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2708-21-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2708-19-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2708-17-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2708-22-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2708-20-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2708-64-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2708-65-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2708-66-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2708-67-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2708-68-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2708-70-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2708-71-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2708-86-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2708-89-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2708-90-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2708-160-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2760-172-0x0000000000920000-0x00000000019DA000-memory.dmp upx -
Processes:
f7617e4.exef761989.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7617e4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7617e4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f761989.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f761989.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7617e4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7617e4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7617e4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f7617e4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f761989.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f761989.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7617e4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f761989.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f761989.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f761989.exe -
Processes:
f7617e4.exef761989.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7617e4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f761989.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f7617e4.exedescription ioc process File opened (read-only) \??\J: f7617e4.exe File opened (read-only) \??\K: f7617e4.exe File opened (read-only) \??\O: f7617e4.exe File opened (read-only) \??\T: f7617e4.exe File opened (read-only) \??\Q: f7617e4.exe File opened (read-only) \??\S: f7617e4.exe File opened (read-only) \??\G: f7617e4.exe File opened (read-only) \??\P: f7617e4.exe File opened (read-only) \??\R: f7617e4.exe File opened (read-only) \??\E: f7617e4.exe File opened (read-only) \??\H: f7617e4.exe File opened (read-only) \??\I: f7617e4.exe File opened (read-only) \??\L: f7617e4.exe File opened (read-only) \??\M: f7617e4.exe File opened (read-only) \??\N: f7617e4.exe -
Drops file in Windows directory 3 IoCs
Processes:
f7617e4.exef761989.exedescription ioc process File created C:\Windows\f761832 f7617e4.exe File opened for modification C:\Windows\SYSTEM.INI f7617e4.exe File created C:\Windows\f766854 f761989.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
f7617e4.exepid process 2708 f7617e4.exe 2708 f7617e4.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
Processes:
f7617e4.exedescription pid process Token: SeDebugPrivilege 2708 f7617e4.exe Token: SeDebugPrivilege 2708 f7617e4.exe Token: SeDebugPrivilege 2708 f7617e4.exe Token: SeDebugPrivilege 2708 f7617e4.exe Token: SeDebugPrivilege 2708 f7617e4.exe Token: SeDebugPrivilege 2708 f7617e4.exe Token: SeDebugPrivilege 2708 f7617e4.exe Token: SeDebugPrivilege 2708 f7617e4.exe Token: SeDebugPrivilege 2708 f7617e4.exe Token: SeDebugPrivilege 2708 f7617e4.exe Token: SeDebugPrivilege 2708 f7617e4.exe Token: SeDebugPrivilege 2708 f7617e4.exe Token: SeDebugPrivilege 2708 f7617e4.exe Token: SeDebugPrivilege 2708 f7617e4.exe Token: SeDebugPrivilege 2708 f7617e4.exe Token: SeDebugPrivilege 2708 f7617e4.exe Token: SeDebugPrivilege 2708 f7617e4.exe Token: SeDebugPrivilege 2708 f7617e4.exe Token: SeDebugPrivilege 2708 f7617e4.exe Token: SeDebugPrivilege 2708 f7617e4.exe Token: SeDebugPrivilege 2708 f7617e4.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
rundll32.exerundll32.exef7617e4.exedescription pid process target process PID 2936 wrote to memory of 2264 2936 rundll32.exe rundll32.exe PID 2936 wrote to memory of 2264 2936 rundll32.exe rundll32.exe PID 2936 wrote to memory of 2264 2936 rundll32.exe rundll32.exe PID 2936 wrote to memory of 2264 2936 rundll32.exe rundll32.exe PID 2936 wrote to memory of 2264 2936 rundll32.exe rundll32.exe PID 2936 wrote to memory of 2264 2936 rundll32.exe rundll32.exe PID 2936 wrote to memory of 2264 2936 rundll32.exe rundll32.exe PID 2264 wrote to memory of 2708 2264 rundll32.exe f7617e4.exe PID 2264 wrote to memory of 2708 2264 rundll32.exe f7617e4.exe PID 2264 wrote to memory of 2708 2264 rundll32.exe f7617e4.exe PID 2264 wrote to memory of 2708 2264 rundll32.exe f7617e4.exe PID 2708 wrote to memory of 1248 2708 f7617e4.exe taskhost.exe PID 2708 wrote to memory of 1328 2708 f7617e4.exe Dwm.exe PID 2708 wrote to memory of 1372 2708 f7617e4.exe Explorer.EXE PID 2708 wrote to memory of 1520 2708 f7617e4.exe DllHost.exe PID 2708 wrote to memory of 2936 2708 f7617e4.exe rundll32.exe PID 2708 wrote to memory of 2264 2708 f7617e4.exe rundll32.exe PID 2708 wrote to memory of 2264 2708 f7617e4.exe rundll32.exe PID 2264 wrote to memory of 2760 2264 rundll32.exe f761989.exe PID 2264 wrote to memory of 2760 2264 rundll32.exe f761989.exe PID 2264 wrote to memory of 2760 2264 rundll32.exe f761989.exe PID 2264 wrote to memory of 2760 2264 rundll32.exe f761989.exe PID 2264 wrote to memory of 3004 2264 rundll32.exe f76336f.exe PID 2264 wrote to memory of 3004 2264 rundll32.exe f76336f.exe PID 2264 wrote to memory of 3004 2264 rundll32.exe f76336f.exe PID 2264 wrote to memory of 3004 2264 rundll32.exe f76336f.exe PID 2708 wrote to memory of 1248 2708 f7617e4.exe taskhost.exe PID 2708 wrote to memory of 1328 2708 f7617e4.exe Dwm.exe PID 2708 wrote to memory of 1372 2708 f7617e4.exe Explorer.EXE PID 2708 wrote to memory of 2760 2708 f7617e4.exe f761989.exe PID 2708 wrote to memory of 2760 2708 f7617e4.exe f761989.exe PID 2708 wrote to memory of 3004 2708 f7617e4.exe f76336f.exe PID 2708 wrote to memory of 3004 2708 f7617e4.exe f76336f.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
f7617e4.exef761989.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7617e4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f761989.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1248
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1328
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1372
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\13cf44084d1dd7bbdba15da1952dd9b7a65142d0dafb9079b135d7f37291b7cd.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\13cf44084d1dd7bbdba15da1952dd9b7a65142d0dafb9079b135d7f37291b7cd.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\f7617e4.exeC:\Users\Admin\AppData\Local\Temp\f7617e4.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\f761989.exeC:\Users\Admin\AppData\Local\Temp\f761989.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System policy modification
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\f76336f.exeC:\Users\Admin\AppData\Local\Temp\f76336f.exe4⤵
- Executes dropped EXE
PID:3004
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1520
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SYSTEM.INIFilesize
257B
MD53616c553b3fbbc0a000cef802d4e19d3
SHA1aaae02ff3c8721bdb34da4eb715d111b37f9bacd
SHA256b46b461c3535f2828eee291426cfa2fabfe52a23c07a055aed476b63e5800116
SHA512cb2bc1fe748a34fbb80a0da7c38faa8368e7edc100846bc7fb6652889fb875e2f84c2434c6320a948f08674cd8b6fa009417c5172e49ef2724b1ba00879a08c0
-
\Users\Admin\AppData\Local\Temp\f7617e4.exeFilesize
97KB
MD5def21c545675deff7a5cbb3909746778
SHA13d7eb69e38a72b643b38b1bd646bcd8f4df95430
SHA25662edec905ed0fafdcb7b722167559eb8353bf33183dc5c3f011c190e50ac4706
SHA512411f28889c27b80e0a1d1b5455b02d7cabf638b8c28a057d01152d903fde9c48da220e2c1da323fc3a4c0fedce4a1a6588d7832c1dcbc5b71cf9948a8366eaef
-
memory/1248-29-0x0000000000210000-0x0000000000212000-memory.dmpFilesize
8KB
-
memory/2264-84-0x0000000000260000-0x0000000000272000-memory.dmpFilesize
72KB
-
memory/2264-9-0x0000000000180000-0x0000000000192000-memory.dmpFilesize
72KB
-
memory/2264-82-0x0000000000180000-0x0000000000182000-memory.dmpFilesize
8KB
-
memory/2264-48-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2264-63-0x00000000001B0000-0x00000000001B2000-memory.dmpFilesize
8KB
-
memory/2264-61-0x00000000001B0000-0x00000000001B2000-memory.dmpFilesize
8KB
-
memory/2264-39-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2264-38-0x00000000001B0000-0x00000000001B2000-memory.dmpFilesize
8KB
-
memory/2264-10-0x0000000000180000-0x0000000000192000-memory.dmpFilesize
72KB
-
memory/2264-1-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/2264-57-0x0000000000260000-0x0000000000272000-memory.dmpFilesize
72KB
-
memory/2708-49-0x00000000016E0000-0x00000000016E1000-memory.dmpFilesize
4KB
-
memory/2708-65-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2708-21-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2708-19-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2708-16-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2708-54-0x00000000003F0000-0x00000000003F2000-memory.dmpFilesize
8KB
-
memory/2708-17-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2708-22-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2708-20-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2708-18-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2708-14-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2708-11-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2708-64-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2708-51-0x00000000003F0000-0x00000000003F2000-memory.dmpFilesize
8KB
-
memory/2708-66-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2708-67-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2708-68-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2708-70-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2708-71-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2708-160-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2708-15-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2708-23-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2708-86-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2708-89-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2708-90-0x0000000000560000-0x000000000161A000-memory.dmpFilesize
16.7MB
-
memory/2708-161-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2708-126-0x00000000003F0000-0x00000000003F2000-memory.dmpFilesize
8KB
-
memory/2760-109-0x00000000001B0000-0x00000000001B2000-memory.dmpFilesize
8KB
-
memory/2760-100-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2760-62-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2760-172-0x0000000000920000-0x00000000019DA000-memory.dmpFilesize
16.7MB
-
memory/2760-174-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3004-111-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/3004-110-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/3004-107-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/3004-85-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3004-178-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB