Analysis
- max time kernel
122s - max time network
109s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
24/05/2024, 07:51
Behavioral task
behavioral1
Sample
7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe
Resource
win7-20240215-en
windows7-x64
19 signatures
150 seconds
General
- Target 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe
- Size 1.6MB
- Sample240524-jp8aasad78
- SHA256 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b
- MD5 e23a29daaedc8085cd4373910d72adc2
- SHA1 4df7ce61932d47ae77dd1633fd370e942afa5c37
- SHA512 7a71f8d2dd4471a7ea86409766f226bfea60ba30d407e69d279ffdb659f9f9db4fd95d41ac077e6d70324bacc8bc086ba4ec35e8d9a2d051cc7bb862fe89b9e3
- SSDEEP 49152:rt8MGGGN/DJAyC4yHJvu/wRwAjGeRj5G2:J8MGGGZlAyCPVuMI
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000800000002338b-89.dat acprotect - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe - Executes dropped EXE 1 IoCs
pid Process 4732 ToDesk_Setup.exe - Loads dropped DLL 3 IoCs
pid Process 4732 ToDesk_Setup.exe 4732 ToDesk_Setup.exe 4732 ToDesk_Setup.exe -
resource yara_rule behavioral2/memory/1172-0-0x0000000000400000-0x0000000000776000-memory.dmp upx behavioral2/memory/1172-1-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1172-14-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1172-6-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1172-18-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1172-15-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1172-21-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1172-13-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1172-7-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1172-4-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1172-3-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1172-5-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1172-22-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1172-23-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1172-24-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1172-25-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1172-26-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1172-28-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1172-29-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1172-30-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1172-32-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1172-33-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1172-35-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1172-37-0x0000000000400000-0x0000000000776000-memory.dmp upx behavioral2/memory/1172-38-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1172-41-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1172-44-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1172-45-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1172-48-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1172-49-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1172-52-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1172-53-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1172-55-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1172-58-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1172-65-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1172-67-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1172-75-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1172-81-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/4732-93-0x0000000072760000-0x000000007281A000-memory.dmp upx behavioral2/files/0x000800000002338b-89.dat upx behavioral2/memory/1172-120-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1172-122-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1172-124-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1172-128-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/4732-148-0x0000000072760000-0x000000007281A000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe File opened (read-only) \??\U: 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe File opened (read-only) \??\X: 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe File opened (read-only) \??\Z: 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe File opened (read-only) \??\J: 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe File opened (read-only) \??\M: 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe File opened (read-only) \??\K: 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe File opened (read-only) \??\L: 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe File opened (read-only) \??\Q: 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe File opened (read-only) \??\R: 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe File opened (read-only) \??\V: 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe File opened (read-only) \??\G: 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe File opened (read-only) \??\H: 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe File opened (read-only) \??\P: 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe File opened (read-only) \??\T: 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe File opened (read-only) \??\W: 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe File opened (read-only) \??\E: 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe File opened (read-only) \??\N: 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe File opened (read-only) \??\Y: 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe File opened (read-only) \??\I: 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe File opened (read-only) \??\S: 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe File opened for modification F:\autorun.inf 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe - Drops file in Program Files directory 12 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe File opened for modification C:\Program Files\7-Zip\7z.exe 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\e573151 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe File opened for modification C:\Windows\SYSTEM.INI 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe Token: SeDebugPrivilege 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1172 wrote to memory of 760 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 8 PID 1172 wrote to memory of 768 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 9 PID 1172 wrote to memory of 316 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 13 PID 1172 wrote to memory of 2676 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 45 PID 1172 wrote to memory of 2752 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 46 PID 1172 wrote to memory of 2832 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 49 PID 1172 wrote to memory of 3572 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 56 PID 1172 wrote to memory of 3660 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 57 PID 1172 wrote to memory of 3864 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 58 PID 1172 wrote to memory of 3952 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 59 PID 1172 wrote to memory of 4020 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 60 PID 1172 wrote to memory of 868 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 61 PID 1172 wrote to memory of 3628 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 62 PID 1172 wrote to memory of 3608 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 74 PID 1172 wrote to memory of 2620 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 75 PID 1172 wrote to memory of 4076 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 80 PID 1172 wrote to memory of 3136 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 81 PID 1172 wrote to memory of 760 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 8 PID 1172 wrote to memory of 768 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 9 PID 1172 wrote to memory of 316 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 13 PID 1172 wrote to memory of 2676 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 45 PID 1172 wrote to memory of 2752 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 46 PID 1172 wrote to memory of 2832 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 49 PID 1172 wrote to memory of 3572 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 56 PID 1172 wrote to memory of 3660 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 57 PID 1172 wrote to memory of 3864 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 58 PID 1172 wrote to memory of 3952 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 59 PID 1172 wrote to memory of 4020 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 60 PID 1172 wrote to memory of 868 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 61 PID 1172 wrote to memory of 3628 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 62 PID 1172 wrote to memory of 3608 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 74 PID 1172 wrote to memory of 2620 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 75 PID 1172 wrote to memory of 4076 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 80 PID 1172 wrote to memory of 4512 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 84 PID 1172 wrote to memory of 4568 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 85 PID 1172 wrote to memory of 760 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 8 PID 1172 wrote to memory of 768 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 9 PID 1172 wrote to memory of 316 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 13 PID 1172 wrote to memory of 2676 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 45 PID 1172 wrote to memory of 2752 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 46 PID 1172 wrote to memory of 2832 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 49 PID 1172 wrote to memory of 3572 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 56 PID 1172 wrote to memory of 3660 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 57 PID 1172 wrote to memory of 3864 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 58 PID 1172 wrote to memory of 3952 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 59 PID 1172 wrote to memory of 4020 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 60 PID 1172 wrote to memory of 868 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 61 PID 1172 wrote to memory of 3628 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 62 PID 1172 wrote to memory of 3608 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 74 PID 1172 wrote to memory of 2620 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 75 PID 1172 wrote to memory of 4076 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 80 PID 1172 wrote to memory of 4512 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 84 PID 1172 wrote to memory of 4568 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 85 PID 1172 wrote to memory of 4732 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 96 PID 1172 wrote to memory of 4732 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 96 PID 1172 wrote to memory of 4732 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 96 PID 1172 wrote to memory of 760 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 8 PID 1172 wrote to memory of 768 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 9 PID 1172 wrote to memory of 316 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 13 PID 1172 wrote to memory of 2676 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 45 PID 1172 wrote to memory of 2752 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 46 PID 1172 wrote to memory of 2832 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 49 PID 1172 wrote to memory of 3572 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 56 PID 1172 wrote to memory of 3660 1172 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe 57 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:760
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:768
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:316
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2676
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2752
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2832
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe"C:\Users\Admin\AppData\Local\Temp\7d2880ae941c05d0887d84aee721c16c258ccb32b453f25f862cc09723c9e76b.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1172 -
C:\Users\Admin\Downloads\ToDesk_Setup.exe"C:\Users\Admin\Downloads\ToDesk_Setup.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4732
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3660
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3864
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3952
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4020
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:868
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3628
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:3608
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2620
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:4076
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:3136
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4512
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4568
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsk91E1.tmp\System.dll
- Size 12KB
- SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
- MD5 8cf2ac271d7679b1d68eefc1ae0c5618
- SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
- SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3
- SSDEEP 192:BenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XB9IwL:B8+Qlt70Fj/lQRY/9VjjlL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsk91E1.tmp\nsNiuniuSkin.dll
- Size 287KB
- SHA256 33e460a080a621cda7896e96b6f1beee802b485cf99e18b27463cd362c484b08
- MD5 bb0cdff5ac2d64723007a0b4f7962a02
- SHA1 410889522ee8ea7308b054f71bc4cab078295e06
- SHA512 b4dc2614f01f5f01d5dec9e6a41e072d01e924d8a94ac0dc1050399fd1dc3cc8d53d7ccf162d750d166fca200771b0850191b30c7caada8edea9ba6d686e2402
- SSDEEP 6144:EfuMPhou62ZrZxAxgGTpMayh91VDrH10nCRwbDB0Q5MeKxhwNsN:M3hC2lZxAxSpRbWnmADBpM+iN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsk91E1.tmp\skin.zip
- Size 733KB
- SHA256 1f81de1b4f32c6547b35f3361bbc3408e373c1031338023f397fbd96f078f8d9
- MD5 2151819d6b259d54a8ef2b1bec0c3f99
- SHA1 b3e3cf9ab831356c5dd5252706ff4d5b719d1fd7
- SHA512 5845a37bfdbe6666437d384897e10de1031dd63d586907f99f65c9bbee5ad7fad5cb74a2ab429655bce6c890401d6d4bb50988a094b09eca66a00d262fc569c1
- SSDEEP 12288:OWoMAT2Elk8KATCAGdWU/uK4lTy+87YOrtyx038NusK/WU/1K4lT7P/NRvMIMrwm:OWoMATFVKATLGd5/uha9s+1sK/5/1hN8
- MD5 SHA1 SHA512 SSDEEP
- Path F:\crar.pif
- Size 97KB
- SHA256 b0cbde96025b2d43bbc9648494a9f6d1e8f3748cae41764d5a9e19fc1354ee3a
- MD5 9344521135536545e66710601f9083d3
- SHA1 89b959c24ed311034a8d635fc8130a07e7070e3c
- SHA512 f76a4c849c64d9ed0585d9e8ccd1016a2d286df1fad04b4aaf0d8ec6494fa148188152153aa52e8efb5fcddf7a7169301325c3732eb8bd60ef9ad9c91f67fee7
- SSDEEP 1536:RMTqkgudDeIbXwkGLBJ98Q3WkpMVUF6h/V3HdfVGxumOO4gnVv974cYU0vOij/xz:WgkeIj1GLln2X/VhBmkiVJ4pUGLjNb
- MD5 SHA1 SHA512 SSDEEP