Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 07:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
54b41f138d721be9a265925f114deaa0_NeikiAnalytics.dll
Resource
win7-20240508-en
windows7-x64
15 signatures
150 seconds
General
-
Target
54b41f138d721be9a265925f114deaa0_NeikiAnalytics.dll
-
Size
120KB
-
MD5
54b41f138d721be9a265925f114deaa0
-
SHA1
06c0f6539f418118ae0484845e591bd931b3be2f
-
SHA256
28e5bcb8b90e27f8194e6e3c5f69eebda70c6f463225f229978d41a67e393d99
-
SHA512
cb5dde6e65664d5a55b89acec8ba05656d284cfde9a829217cca585e1e577b4a79f66f3a41953794e407b782da441d7e10e2e66c2f93a120c7036e7fd76c22f0
-
SSDEEP
3072:biknSgrDg2zVb65qqHvWfGHu9b24Rd8tS:HHz5eq2vdHGb24Rd3
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e576e5a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e574759.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e574759.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e574759.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e576e5a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e576e5a.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e574759.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e576e5a.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e574759.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e576e5a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e576e5a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e576e5a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e574759.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e574759.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e574759.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e576e5a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e576e5a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e576e5a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e574759.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e574759.exe -
Executes dropped EXE 3 IoCs
pid Process 3748 e574759.exe 1928 e57493e.exe 3716 e576e5a.exe -
resource yara_rule behavioral2/memory/3748-6-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3748-9-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3748-8-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3748-11-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3748-12-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3748-19-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3748-29-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3748-35-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3748-18-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3748-10-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3748-36-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3748-37-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3748-38-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3748-39-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3748-41-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3748-40-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3748-59-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3748-60-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3748-62-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3748-63-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3748-64-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3748-66-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3748-68-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3748-70-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3748-72-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3748-74-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3716-109-0x0000000000B50000-0x0000000001C0A000-memory.dmp upx behavioral2/memory/3716-145-0x0000000000B50000-0x0000000001C0A000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e576e5a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e576e5a.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e576e5a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e574759.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e574759.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e574759.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e576e5a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e576e5a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e576e5a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e574759.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e574759.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e574759.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e576e5a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e574759.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e574759.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e576e5a.exe -
Enumerates connected drives 3 TTPs 13 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: e574759.exe File opened (read-only) \??\G: e574759.exe File opened (read-only) \??\M: e574759.exe File opened (read-only) \??\N: e574759.exe File opened (read-only) \??\E: e576e5a.exe File opened (read-only) \??\H: e574759.exe File opened (read-only) \??\I: e574759.exe File opened (read-only) \??\J: e574759.exe File opened (read-only) \??\G: e576e5a.exe File opened (read-only) \??\H: e576e5a.exe File opened (read-only) \??\I: e576e5a.exe File opened (read-only) \??\K: e574759.exe File opened (read-only) \??\L: e574759.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e5798a6 e576e5a.exe File created C:\Windows\e5747d6 e574759.exe File opened for modification C:\Windows\SYSTEM.INI e574759.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3748 e574759.exe 3748 e574759.exe 3748 e574759.exe 3748 e574759.exe 3716 e576e5a.exe 3716 e576e5a.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe Token: SeDebugPrivilege 3748 e574759.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1448 wrote to memory of 1216 1448 rundll32.exe 83 PID 1448 wrote to memory of 1216 1448 rundll32.exe 83 PID 1448 wrote to memory of 1216 1448 rundll32.exe 83 PID 1216 wrote to memory of 3748 1216 rundll32.exe 84 PID 1216 wrote to memory of 3748 1216 rundll32.exe 84 PID 1216 wrote to memory of 3748 1216 rundll32.exe 84 PID 3748 wrote to memory of 796 3748 e574759.exe 9 PID 3748 wrote to memory of 804 3748 e574759.exe 10 PID 3748 wrote to memory of 316 3748 e574759.exe 13 PID 3748 wrote to memory of 2636 3748 e574759.exe 50 PID 3748 wrote to memory of 3120 3748 e574759.exe 51 PID 3748 wrote to memory of 3200 3748 e574759.exe 52 PID 3748 wrote to memory of 3500 3748 e574759.exe 56 PID 3748 wrote to memory of 3628 3748 e574759.exe 57 PID 3748 wrote to memory of 3824 3748 e574759.exe 58 PID 3748 wrote to memory of 3948 3748 e574759.exe 59 PID 3748 wrote to memory of 4012 3748 e574759.exe 60 PID 3748 wrote to memory of 4092 3748 e574759.exe 61 PID 3748 wrote to memory of 4140 3748 e574759.exe 62 PID 3748 wrote to memory of 4288 3748 e574759.exe 64 PID 3748 wrote to memory of 4544 3748 e574759.exe 75 PID 3748 wrote to memory of 4504 3748 e574759.exe 80 PID 3748 wrote to memory of 2552 3748 e574759.exe 81 PID 3748 wrote to memory of 1448 3748 e574759.exe 82 PID 3748 wrote to memory of 1216 3748 e574759.exe 83 PID 3748 wrote to memory of 1216 3748 e574759.exe 83 PID 1216 wrote to memory of 1928 1216 rundll32.exe 85 PID 1216 wrote to memory of 1928 1216 rundll32.exe 85 PID 1216 wrote to memory of 1928 1216 rundll32.exe 85 PID 1216 wrote to memory of 3716 1216 rundll32.exe 89 PID 1216 wrote to memory of 3716 1216 rundll32.exe 89 PID 1216 wrote to memory of 3716 1216 rundll32.exe 89 PID 3748 wrote to memory of 796 3748 e574759.exe 9 PID 3748 wrote to memory of 804 3748 e574759.exe 10 PID 3748 wrote to memory of 316 3748 e574759.exe 13 PID 3748 wrote to memory of 2636 3748 e574759.exe 50 PID 3748 wrote to memory of 3120 3748 e574759.exe 51 PID 3748 wrote to memory of 3200 3748 e574759.exe 52 PID 3748 wrote to memory of 3500 3748 e574759.exe 56 PID 3748 wrote to memory of 3628 3748 e574759.exe 57 PID 3748 wrote to memory of 3824 3748 e574759.exe 58 PID 3748 wrote to memory of 3948 3748 e574759.exe 59 PID 3748 wrote to memory of 4012 3748 e574759.exe 60 PID 3748 wrote to memory of 4092 3748 e574759.exe 61 PID 3748 wrote to memory of 4140 3748 e574759.exe 62 PID 3748 wrote to memory of 4288 3748 e574759.exe 64 PID 3748 wrote to memory of 4544 3748 e574759.exe 75 PID 3748 wrote to memory of 4504 3748 e574759.exe 80 PID 3748 wrote to memory of 2552 3748 e574759.exe 81 PID 3748 wrote to memory of 1928 3748 e574759.exe 85 PID 3748 wrote to memory of 1928 3748 e574759.exe 85 PID 3748 wrote to memory of 4944 3748 e574759.exe 87 PID 3748 wrote to memory of 404 3748 e574759.exe 88 PID 3748 wrote to memory of 3716 3748 e574759.exe 89 PID 3748 wrote to memory of 3716 3748 e574759.exe 89 PID 3716 wrote to memory of 796 3716 e576e5a.exe 9 PID 3716 wrote to memory of 804 3716 e576e5a.exe 10 PID 3716 wrote to memory of 316 3716 e576e5a.exe 13 PID 3716 wrote to memory of 2636 3716 e576e5a.exe 50 PID 3716 wrote to memory of 3120 3716 e576e5a.exe 51 PID 3716 wrote to memory of 3200 3716 e576e5a.exe 52 PID 3716 wrote to memory of 3500 3716 e576e5a.exe 56 PID 3716 wrote to memory of 3628 3716 e576e5a.exe 57 PID 3716 wrote to memory of 3824 3716 e576e5a.exe 58 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e574759.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e576e5a.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:796
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:804
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:316
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2636
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:3120
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3200
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3500
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\54b41f138d721be9a265925f114deaa0_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\54b41f138d721be9a265925f114deaa0_NeikiAnalytics.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\e574759.exeC:\Users\Admin\AppData\Local\Temp\e574759.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3748
-
-
C:\Users\Admin\AppData\Local\Temp\e57493e.exeC:\Users\Admin\AppData\Local\Temp\e57493e.exe4⤵
- Executes dropped EXE
PID:1928
-
-
C:\Users\Admin\AppData\Local\Temp\e576e5a.exeC:\Users\Admin\AppData\Local\Temp\e576e5a.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3716
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3628
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3824
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3948
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4012
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4092
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4140
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4288
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4544
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:4504
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:2552
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4944
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:404
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5c611979b21cf4ca6760216b900c53c71
SHA1df71ac38637f0ce9c2c8e63a191e22074622ff31
SHA256358c2a8a6179285c47d464737ad70637504f200b5254060d62d5e214b27639a1
SHA512d935b87ea9deaece2a5e02dfd299b942171f72d4beea9a52b241878f7916b7f3c0be748e7b3e889e190bdc389f89d2a97ca2fb80c160ef4fcc98e9154c7acd6c
-
Filesize
257B
MD5f572c0ce2891eac874e824dd17dc9b77
SHA11050a9a36a741a5d70e5bca0892fc2dea657c200
SHA2566d912fab9732f6a38fc9e647089f3e95c9478b3d1369b6208ef858c65047014d
SHA512480b4fce916e3b4ab48464ecb8c21761cfa23d162f489b2124434b825a71c498e1614cb4396490dd4b64cd8dd78c7986e12d9071f17acb7d58d6e33e0f7a12f9