Analysis
-
max time kernel
139s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 10:20
Static task
static1
Behavioral task
behavioral1
Sample
e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe
Resource
win7-20240508-en
General
-
Target
e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe
-
Size
1.2MB
-
MD5
e17bf1770bab7aae01b11e7a3558f31a
-
SHA1
d00ec77c77c62118cad0f5658a976d0e0a88b467
-
SHA256
e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d
-
SHA512
263c27108ed3a8f1fd50c8fe23ef2ae1166328046079a1d425c20823fc70b4ff1f6b7b4c284fd8980b1533b3d55deaa4afa1fec7c1049af1adaa3d46869e18fc
-
SSDEEP
24576:7qo1V4IDQ1rThff+r/ibJIRYP6h95C+VlLExqWXTHRyWtv4r6Ps:7qoTDerQKwC+vExqWXTxyWF4r6Ps
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe -
Processes:
e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe -
Processes:
e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe -
Processes:
resource yara_rule behavioral2/memory/1000-13-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/1000-12-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/1000-16-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/1000-21-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/1000-17-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/1000-29-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/1000-27-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/1000-30-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/1000-15-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/1000-14-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/1000-31-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/1000-32-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/1000-33-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/1000-34-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/1000-35-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/1000-37-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/1000-38-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/1000-39-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/1000-41-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/1000-42-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/1000-45-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/1000-47-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/1000-49-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/1000-52-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/1000-58-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/1000-60-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/1000-61-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/1000-62-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/1000-64-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/1000-68-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/1000-69-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/1000-72-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/1000-74-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/1000-76-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/1000-77-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/1000-79-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/1000-84-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/1000-83-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/1000-99-0x0000000002360000-0x000000000341A000-memory.dmp upx behavioral2/memory/1000-102-0x0000000002360000-0x000000000341A000-memory.dmp upx -
Processes:
e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe -
Processes:
e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exedescription ioc process File opened (read-only) \??\S: e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe File opened (read-only) \??\W: e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe File opened (read-only) \??\X: e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe File opened (read-only) \??\E: e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe File opened (read-only) \??\G: e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe File opened (read-only) \??\I: e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe File opened (read-only) \??\K: e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe File opened (read-only) \??\R: e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe File opened (read-only) \??\H: e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe File opened (read-only) \??\T: e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe File opened (read-only) \??\Y: e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe File opened (read-only) \??\Z: e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe File opened (read-only) \??\J: e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe File opened (read-only) \??\M: e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe File opened (read-only) \??\Q: e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe File opened (read-only) \??\U: e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe File opened (read-only) \??\L: e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe File opened (read-only) \??\N: e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe File opened (read-only) \??\O: e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe File opened (read-only) \??\P: e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe File opened (read-only) \??\V: e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exedescription ioc process File opened for modification C:\autorun.inf e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe File opened for modification F:\autorun.inf e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe -
Drops file in Program Files directory 12 IoCs
Processes:
e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exedescription ioc process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe File opened for modification C:\Program Files\7-Zip\7z.exe e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe -
Drops file in Windows directory 2 IoCs
Processes:
e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exedescription ioc process File created C:\Windows\e573fe7 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe File opened for modification C:\Windows\SYSTEM.INI e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exepid process 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exedescription pid process Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Token: SeDebugPrivilege 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exedescription pid process target process PID 1000 wrote to memory of 772 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe fontdrvhost.exe PID 1000 wrote to memory of 776 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe fontdrvhost.exe PID 1000 wrote to memory of 68 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe dwm.exe PID 1000 wrote to memory of 2504 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe sihost.exe PID 1000 wrote to memory of 2520 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe svchost.exe PID 1000 wrote to memory of 2620 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe taskhostw.exe PID 1000 wrote to memory of 3156 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Explorer.EXE PID 1000 wrote to memory of 3612 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe svchost.exe PID 1000 wrote to memory of 3804 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe DllHost.exe PID 1000 wrote to memory of 3928 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe StartMenuExperienceHost.exe PID 1000 wrote to memory of 3992 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe RuntimeBroker.exe PID 1000 wrote to memory of 4088 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe SearchApp.exe PID 1000 wrote to memory of 4128 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe RuntimeBroker.exe PID 1000 wrote to memory of 3780 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe TextInputHost.exe PID 1000 wrote to memory of 316 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe RuntimeBroker.exe PID 1000 wrote to memory of 3896 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe backgroundTaskHost.exe PID 1000 wrote to memory of 3096 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe backgroundTaskHost.exe PID 1000 wrote to memory of 4852 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe BackgroundTransferHost.exe PID 1000 wrote to memory of 772 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe fontdrvhost.exe PID 1000 wrote to memory of 776 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe fontdrvhost.exe PID 1000 wrote to memory of 68 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe dwm.exe PID 1000 wrote to memory of 2504 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe sihost.exe PID 1000 wrote to memory of 2520 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe svchost.exe PID 1000 wrote to memory of 2620 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe taskhostw.exe PID 1000 wrote to memory of 3156 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Explorer.EXE PID 1000 wrote to memory of 3612 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe svchost.exe PID 1000 wrote to memory of 3804 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe DllHost.exe PID 1000 wrote to memory of 3928 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe StartMenuExperienceHost.exe PID 1000 wrote to memory of 3992 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe RuntimeBroker.exe PID 1000 wrote to memory of 4088 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe SearchApp.exe PID 1000 wrote to memory of 4128 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe RuntimeBroker.exe PID 1000 wrote to memory of 3780 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe TextInputHost.exe PID 1000 wrote to memory of 316 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe RuntimeBroker.exe PID 1000 wrote to memory of 3896 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe backgroundTaskHost.exe PID 1000 wrote to memory of 3096 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe backgroundTaskHost.exe PID 1000 wrote to memory of 4924 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe RuntimeBroker.exe PID 1000 wrote to memory of 1252 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe RuntimeBroker.exe PID 1000 wrote to memory of 916 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe BackgroundTransferHost.exe PID 1000 wrote to memory of 772 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe fontdrvhost.exe PID 1000 wrote to memory of 776 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe fontdrvhost.exe PID 1000 wrote to memory of 68 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe dwm.exe PID 1000 wrote to memory of 2504 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe sihost.exe PID 1000 wrote to memory of 2520 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe svchost.exe PID 1000 wrote to memory of 2620 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe taskhostw.exe PID 1000 wrote to memory of 3156 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe Explorer.EXE PID 1000 wrote to memory of 3612 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe svchost.exe PID 1000 wrote to memory of 3804 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe DllHost.exe PID 1000 wrote to memory of 3928 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe StartMenuExperienceHost.exe PID 1000 wrote to memory of 3992 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe RuntimeBroker.exe PID 1000 wrote to memory of 4088 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe SearchApp.exe PID 1000 wrote to memory of 4128 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe RuntimeBroker.exe PID 1000 wrote to memory of 3780 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe TextInputHost.exe PID 1000 wrote to memory of 316 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe RuntimeBroker.exe PID 1000 wrote to memory of 3896 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe backgroundTaskHost.exe PID 1000 wrote to memory of 3096 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe backgroundTaskHost.exe PID 1000 wrote to memory of 4924 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe RuntimeBroker.exe PID 1000 wrote to memory of 1252 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe RuntimeBroker.exe PID 1000 wrote to memory of 916 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe BackgroundTransferHost.exe PID 1000 wrote to memory of 772 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe fontdrvhost.exe PID 1000 wrote to memory of 776 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe fontdrvhost.exe PID 1000 wrote to memory of 68 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe dwm.exe PID 1000 wrote to memory of 2504 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe sihost.exe PID 1000 wrote to memory of 2520 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe svchost.exe PID 1000 wrote to memory of 2620 1000 e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe taskhostw.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:772
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:776
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:68
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2504
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2520
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2620
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe"C:\Users\Admin\AppData\Local\Temp\e71c744f4f9abc0b0807950ac1194a6d3f64d9f0f1eb7b391490b5ca1a16029d.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1000
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3612
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3804
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3928
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3992
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4088
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4128
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:3780
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:316
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:3896
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:3096
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵PID:4852
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4924
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1252
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵PID:916
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵PID:3356
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4512
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Helper_2345\temp\download\0\Helper_2345.NewVersion.dataFilesize
29B
MD599fb8e84b8aa92889349054a60e1f359
SHA11b3dd1afb4fe4533ca16db4dd3e7845c13b0e1c5
SHA2565313e624a817ebcb34675027d12b87465de4fc4fdddfdd74d244490c4911b8e4
SHA5122a99095109445c3ca1b9fad5c87fdfed331641401ca8d19d3ab4d109e18b9dc5feb739485f14f390bd3bcfa3a4325e3b1278fe1bb8690dd8df16edb9af52faac
-
C:\hebg.exeFilesize
97KB
MD5c98976fbaebed3ea5760a6e4468911d6
SHA17380cec39788c9a09af74a315239fc9ba00999f2
SHA256c8631b5623efc82a642009a70b7f73201c774c9b00d43da1eaf06dd3013bd3e9
SHA51256ccb7895cce8b7ff1e7b2fae813589b147f62653a0d32c1bd2268a747f9fc57216ad5e2f7f886ae663a615b6084e58c19f325ba3a9047835fed0dd6bb201564
-
memory/1000-0-0x0000000000400000-0x000000000052D000-memory.dmpFilesize
1.2MB
-
memory/1000-13-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/1000-19-0x00000000040F0000-0x00000000040F1000-memory.dmpFilesize
4KB
-
memory/1000-12-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/1000-22-0x00000000008B0000-0x00000000008B2000-memory.dmpFilesize
8KB
-
memory/1000-28-0x00000000008B0000-0x00000000008B2000-memory.dmpFilesize
8KB
-
memory/1000-16-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/1000-21-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/1000-17-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/1000-29-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/1000-27-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/1000-30-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/1000-15-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/1000-14-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/1000-18-0x00000000008B0000-0x00000000008B2000-memory.dmpFilesize
8KB
-
memory/1000-31-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/1000-32-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/1000-33-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/1000-34-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/1000-35-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/1000-37-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/1000-38-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/1000-39-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/1000-41-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/1000-42-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/1000-45-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/1000-47-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/1000-49-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/1000-52-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/1000-58-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/1000-60-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/1000-61-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/1000-62-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/1000-64-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/1000-68-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/1000-69-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/1000-72-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/1000-74-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/1000-76-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/1000-77-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/1000-79-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/1000-84-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/1000-83-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/1000-99-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/1000-102-0x0000000002360000-0x000000000341A000-memory.dmpFilesize
16.7MB
-
memory/1000-103-0x00000000008B0000-0x00000000008B2000-memory.dmpFilesize
8KB
-
memory/1000-113-0x00000000008B0000-0x00000000008B2000-memory.dmpFilesize
8KB
-
memory/1000-122-0x0000000000400000-0x000000000052D000-memory.dmpFilesize
1.2MB