Analysis
- max time kernel
144s - max time network
128s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
20/06/2024, 02:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
57d82c0498c078851cc82b17d73c1520.dll
Resource
win7-20240611-en
windows7-x64
15 signatures
150 seconds
General
- Target 57d82c0498c078851cc82b17d73c1520.dll
- Size 120KB
- Sample240620-c9vrdaygln
- SHA256 07d130f17f41f6a1c46f5d927d8f3b94a1d2f4637891a9b7c7f4422b76ced9d3
- MD5 57d82c0498c078851cc82b17d73c1520
- SHA1 56d9522af0546a1aedad9169a6577d935c7d15af
- SHA512 883217b361bae7e4a865ac02079f77ae230592a0e4cf4e2c6779c75211c379b352f1640e68928c9e1cdb2414c0ea84e01b3dafe1b3c75bbd63fe85464e1d1b0b
- SSDEEP 1536:q1El9htk+c01EXCKUY9KvCcewIn2+OVaSfuJ3mSLZqHnDfOQlVh2y:q1E5t1c06CepnyV6mIqjf5lVsy
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57589f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57589f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e573cea.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e573cea.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e573cea.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57589f.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e573cea.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57589f.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57589f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57589f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57589f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e573cea.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57589f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57589f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e573cea.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e573cea.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e573cea.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e573cea.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e573cea.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57589f.exe - Executes dropped EXE 3 IoCs
pid Process 1360 e573cea.exe 4428 e573de4.exe 1108 e57589f.exe -
resource yara_rule behavioral2/memory/1360-13-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1360-11-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1360-9-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1360-8-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1360-21-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1360-22-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1360-23-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1360-31-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1360-12-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1360-10-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1360-37-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1360-36-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1360-38-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1360-39-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1360-40-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1360-42-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1360-51-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1360-52-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1360-54-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1360-64-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1360-65-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1360-66-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1360-69-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1360-71-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1360-74-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1360-75-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1360-78-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1360-79-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1360-80-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1360-82-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1360-85-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1108-118-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx behavioral2/memory/1108-148-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57589f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57589f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e573cea.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e573cea.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57589f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57589f.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57589f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e573cea.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e573cea.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e573cea.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57589f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57589f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e573cea.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e573cea.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e573cea.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57589f.exe - Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: e573cea.exe File opened (read-only) \??\G: e573cea.exe File opened (read-only) \??\I: e573cea.exe File opened (read-only) \??\M: e573cea.exe File opened (read-only) \??\O: e573cea.exe File opened (read-only) \??\J: e573cea.exe File opened (read-only) \??\Q: e573cea.exe File opened (read-only) \??\S: e573cea.exe File opened (read-only) \??\K: e573cea.exe File opened (read-only) \??\L: e573cea.exe File opened (read-only) \??\N: e573cea.exe File opened (read-only) \??\E: e57589f.exe File opened (read-only) \??\H: e573cea.exe File opened (read-only) \??\P: e573cea.exe File opened (read-only) \??\R: e573cea.exe - Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe e573cea.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e573cea.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e573cea.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e573cea.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e578eb3 e57589f.exe File created C:\Windows\e573d57 e573cea.exe File opened for modification C:\Windows\SYSTEM.INI e573cea.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1360 e573cea.exe 1360 e573cea.exe 1360 e573cea.exe 1360 e573cea.exe 1108 e57589f.exe 1108 e57589f.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe Token: SeDebugPrivilege 1360 e573cea.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3032 wrote to memory of 2064 3032 rundll32.exe 83 PID 3032 wrote to memory of 2064 3032 rundll32.exe 83 PID 3032 wrote to memory of 2064 3032 rundll32.exe 83 PID 2064 wrote to memory of 1360 2064 rundll32.exe 84 PID 2064 wrote to memory of 1360 2064 rundll32.exe 84 PID 2064 wrote to memory of 1360 2064 rundll32.exe 84 PID 1360 wrote to memory of 796 1360 e573cea.exe 9 PID 1360 wrote to memory of 804 1360 e573cea.exe 10 PID 1360 wrote to memory of 384 1360 e573cea.exe 13 PID 1360 wrote to memory of 2644 1360 e573cea.exe 44 PID 1360 wrote to memory of 2680 1360 e573cea.exe 45 PID 1360 wrote to memory of 2784 1360 e573cea.exe 47 PID 1360 wrote to memory of 3508 1360 e573cea.exe 56 PID 1360 wrote to memory of 3628 1360 e573cea.exe 57 PID 1360 wrote to memory of 3824 1360 e573cea.exe 58 PID 1360 wrote to memory of 3924 1360 e573cea.exe 59 PID 1360 wrote to memory of 3984 1360 e573cea.exe 60 PID 1360 wrote to memory of 4068 1360 e573cea.exe 61 PID 1360 wrote to memory of 3232 1360 e573cea.exe 62 PID 1360 wrote to memory of 2364 1360 e573cea.exe 64 PID 1360 wrote to memory of 4924 1360 e573cea.exe 75 PID 1360 wrote to memory of 4552 1360 e573cea.exe 80 PID 1360 wrote to memory of 4416 1360 e573cea.exe 81 PID 1360 wrote to memory of 3032 1360 e573cea.exe 82 PID 1360 wrote to memory of 2064 1360 e573cea.exe 83 PID 1360 wrote to memory of 2064 1360 e573cea.exe 83 PID 2064 wrote to memory of 4428 2064 rundll32.exe 85 PID 2064 wrote to memory of 4428 2064 rundll32.exe 85 PID 2064 wrote to memory of 4428 2064 rundll32.exe 85 PID 2064 wrote to memory of 1108 2064 rundll32.exe 93 PID 2064 wrote to memory of 1108 2064 rundll32.exe 93 PID 2064 wrote to memory of 1108 2064 rundll32.exe 93 PID 1360 wrote to memory of 796 1360 e573cea.exe 9 PID 1360 wrote to memory of 804 1360 e573cea.exe 10 PID 1360 wrote to memory of 384 1360 e573cea.exe 13 PID 1360 wrote to memory of 2644 1360 e573cea.exe 44 PID 1360 wrote to memory of 2680 1360 e573cea.exe 45 PID 1360 wrote to memory of 2784 1360 e573cea.exe 47 PID 1360 wrote to memory of 3508 1360 e573cea.exe 56 PID 1360 wrote to memory of 3628 1360 e573cea.exe 57 PID 1360 wrote to memory of 3824 1360 e573cea.exe 58 PID 1360 wrote to memory of 3924 1360 e573cea.exe 59 PID 1360 wrote to memory of 3984 1360 e573cea.exe 60 PID 1360 wrote to memory of 4068 1360 e573cea.exe 61 PID 1360 wrote to memory of 3232 1360 e573cea.exe 62 PID 1360 wrote to memory of 2364 1360 e573cea.exe 64 PID 1360 wrote to memory of 4924 1360 e573cea.exe 75 PID 1360 wrote to memory of 4552 1360 e573cea.exe 80 PID 1360 wrote to memory of 4428 1360 e573cea.exe 85 PID 1360 wrote to memory of 4428 1360 e573cea.exe 85 PID 1360 wrote to memory of 2040 1360 e573cea.exe 87 PID 1360 wrote to memory of 3608 1360 e573cea.exe 88 PID 1360 wrote to memory of 1108 1360 e573cea.exe 93 PID 1360 wrote to memory of 1108 1360 e573cea.exe 93 PID 1108 wrote to memory of 796 1108 e57589f.exe 9 PID 1108 wrote to memory of 804 1108 e57589f.exe 10 PID 1108 wrote to memory of 384 1108 e57589f.exe 13 PID 1108 wrote to memory of 2644 1108 e57589f.exe 44 PID 1108 wrote to memory of 2680 1108 e57589f.exe 45 PID 1108 wrote to memory of 2784 1108 e57589f.exe 47 PID 1108 wrote to memory of 3508 1108 e57589f.exe 56 PID 1108 wrote to memory of 3628 1108 e57589f.exe 57 PID 1108 wrote to memory of 3824 1108 e57589f.exe 58 PID 1108 wrote to memory of 3924 1108 e57589f.exe 59 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e573cea.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57589f.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:796
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:804
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:384
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2644
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2680
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2784
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3508
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\57d82c0498c078851cc82b17d73c1520.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\57d82c0498c078851cc82b17d73c1520.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\e573cea.exeC:\Users\Admin\AppData\Local\Temp\e573cea.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1360
-
-
C:\Users\Admin\AppData\Local\Temp\e573de4.exeC:\Users\Admin\AppData\Local\Temp\e573de4.exe4⤵
- Executes dropped EXE
PID:4428
-
-
C:\Users\Admin\AppData\Local\Temp\e57589f.exeC:\Users\Admin\AppData\Local\Temp\e57589f.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1108
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3628
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3824
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3924
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3984
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4068
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3232
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2364
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4924
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:4552
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4416
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2040
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3608
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\e573cea.exe
- Size 97KB
- SHA256 259b7af75fe98383b3b8dd765aa3b7361b4218a66c86a5bba27be883fffe086b
- MD5 03f4281c094b003da95d0cb2a9097ac0
- SHA1 79ab900872d57b1d4065494c17cda29a753203d6
- SHA512 1f13973bf09fd12ba6ac84980e1178cf4564a63134a4079ed59407c0eaaac742f3a51174fc3b7de3d8438a9da1bdd44a31e05d4f2985633fb9d211bec0c8afea
- SSDEEP 3072:l1HgxxJGlEDnbuTD1w9V15SoF5hUFquCFBcgRrV:l12uluU1xShSq7BcU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 e27de41f600b0106d2eb0023f49bc44ba17fa0c53de1b93ea2e10382531191e4
- MD5 0a5d4e3c92b0dd371e6fb84db8b504d7
- SHA1 6fb4e15422fd76b1c287f7f725ae6ce7420943a4
- SHA512 66c593e3c0dc4449d74fb57048104210de6fe852c1466e1d1f47b211501761cf541f7643da50e5fe8755c18c03d442f80620ee5df04a9bb051517dfffadcb2e1
- MD5 SHA1 SHA512