sality | 3448e6f9abfb651bb0e3a0628f8a7c5b6eb8634ceb9d5695df0a5aa4d4d41cb5

Analysis

max time kernel
140s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 21:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Size

143KB
MD5

1793ac874494e658e927ffd2c129c823
SHA1

e9e15b34dab437fe5d70a2a9ffa7b0bc4cb3b7df
SHA256

3448e6f9abfb651bb0e3a0628f8a7c5b6eb8634ceb9d5695df0a5aa4d4d41cb5
SHA512

9f4071324aac9db9bc0b86d5cc2ac71ba1a4497f1a62223fc77e987b61c662381012d1473c4d17709d049e265e89ce8572d4387a1b42294bdb8d265b4102f3c2
SSDEEP

1536:gUeHiWRgkkqH8nyWmJrYRN6QcICA7x9LQgAnWySpU9IL8D6pWPxFj4b8SVaIA8FZ:gd/UyWmJrqn9U7nzD9Ps8CA6AaP

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Au_.exe

Executes dropped EXE 1 IoCs

pid	Process
3924	Au_.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2468-1-0x0000000002360000-0x0000000003390000-memory.dmp	upx
behavioral2/memory/2468-3-0x0000000002360000-0x0000000003390000-memory.dmp	upx
behavioral2/memory/2468-7-0x0000000002360000-0x0000000003390000-memory.dmp	upx
behavioral2/memory/2468-16-0x0000000002360000-0x0000000003390000-memory.dmp	upx
behavioral2/memory/2468-17-0x0000000002360000-0x0000000003390000-memory.dmp	upx
behavioral2/memory/3924-53-0x0000000006840000-0x0000000007870000-memory.dmp	upx
behavioral2/memory/3924-61-0x0000000006840000-0x0000000007870000-memory.dmp	upx
behavioral2/memory/3924-57-0x0000000006840000-0x0000000007870000-memory.dmp	upx
behavioral2/memory/3924-67-0x0000000006840000-0x0000000007870000-memory.dmp	upx
behavioral2/memory/3924-68-0x0000000006840000-0x0000000007870000-memory.dmp	upx

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Au_.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SYSTEM.INI	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral2/files/0x000700000002327b-26.dat	nsis_installer_1
behavioral2/files/0x000700000002327b-26.dat	nsis_installer_2
behavioral2/files/0x000700000002327c-47.dat	nsis_installer_1
behavioral2/files/0x000700000002327c-47.dat	nsis_installer_2

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
3924	Au_.exe
3924	Au_.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Token: SeDebugPrivilege	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 788	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe	9
PID 2468 wrote to memory of 784	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe	10
PID 2468 wrote to memory of 1020	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe	13
PID 2468 wrote to memory of 2572	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe	44
PID 2468 wrote to memory of 2580	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe	45
PID 2468 wrote to memory of 2824	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe	51
PID 2468 wrote to memory of 3332	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe	56
PID 2468 wrote to memory of 3512	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe	57
PID 2468 wrote to memory of 3712	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe	58
PID 2468 wrote to memory of 3856	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe	59
PID 2468 wrote to memory of 3932	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe	60
PID 2468 wrote to memory of 4016	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe	61
PID 2468 wrote to memory of 3444	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe	62
PID 2468 wrote to memory of 4704	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe	64
PID 2468 wrote to memory of 4332	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe	74
PID 2468 wrote to memory of 2368	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe	75
PID 2468 wrote to memory of 3008	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe	77
PID 2468 wrote to memory of 4916	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe	78
PID 2468 wrote to memory of 3580	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe	79
PID 2468 wrote to memory of 2724	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe	80
PID 2468 wrote to memory of 3452	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe	81
PID 2468 wrote to memory of 3032	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe	83
PID 2468 wrote to memory of 3920	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe	84
PID 2468 wrote to memory of 3924	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe	91
PID 2468 wrote to memory of 3924	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe	91
PID 2468 wrote to memory of 3924	2468	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe	91
PID 3924 wrote to memory of 788	3924	Au_.exe	9
PID 3924 wrote to memory of 784	3924	Au_.exe	10
PID 3924 wrote to memory of 1020	3924	Au_.exe	13
PID 3924 wrote to memory of 2572	3924	Au_.exe	44
PID 3924 wrote to memory of 2580	3924	Au_.exe	45
PID 3924 wrote to memory of 2824	3924	Au_.exe	51
PID 3924 wrote to memory of 3332	3924	Au_.exe	56
PID 3924 wrote to memory of 3512	3924	Au_.exe	57
PID 3924 wrote to memory of 3712	3924	Au_.exe	58
PID 3924 wrote to memory of 3856	3924	Au_.exe	59
PID 3924 wrote to memory of 3932	3924	Au_.exe	60
PID 3924 wrote to memory of 4016	3924	Au_.exe	61
PID 3924 wrote to memory of 3444	3924	Au_.exe	62
PID 3924 wrote to memory of 4704	3924	Au_.exe	64
PID 3924 wrote to memory of 4332	3924	Au_.exe	74
PID 3924 wrote to memory of 2368	3924	Au_.exe	75
PID 3924 wrote to memory of 3008	3924	Au_.exe	77
PID 3924 wrote to memory of 4916	3924	Au_.exe	78
PID 3924 wrote to memory of 3580	3924	Au_.exe	79
PID 3924 wrote to memory of 2724	3924	Au_.exe	80
PID 3924 wrote to memory of 3452	3924	Au_.exe	81
PID 3924 wrote to memory of 3032	3924	Au_.exe	83
PID 3924 wrote to memory of 3920	3924	Au_.exe	84

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Au_.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:788

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:784

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:1020

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2580

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2824

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3332
- C:\Users\Admin\AppData\Local\Temp\1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\1793ac874494e658e927ffd2c129c823_JaffaCakes118.exe"
  2⤵
  - UAC bypass
  - Checks whether UAC is enabled
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2468
- - C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
    "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:3924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3512

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3712

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3856

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3932

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4016

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3444

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4704

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:4332

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7ffc9b282e98,0x7ffc9b282ea4,0x7ffc9b282eb0
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2652 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:2
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2756 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:3
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2860 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5424 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=5580 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4232 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:4164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0E587097_Rar\Au_.exe

Filesize
63KB

MD5
180efefcac396ea49261d657a2a752f7

SHA1
162d21c0bd6f66d3a72247e4a9aee288bf8664fb

SHA256
e4d74e49b242ad465d5375915bec08b1f68cfbb6fdcf673b58775883ef42ef34

SHA512
474e38f0730b13fe4a51d80d22a09498e41ab67b2935e63508380d4c5445d1f10d60afe391045943f882085318dbee31e58c04b39a748c1d9e2e2fe8247b8ad4

Download Submit
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
143KB

MD5
1793ac874494e658e927ffd2c129c823

SHA1
e9e15b34dab437fe5d70a2a9ffa7b0bc4cb3b7df

SHA256
3448e6f9abfb651bb0e3a0628f8a7c5b6eb8634ceb9d5695df0a5aa4d4d41cb5

SHA512
9f4071324aac9db9bc0b86d5cc2ac71ba1a4497f1a62223fc77e987b61c662381012d1473c4d17709d049e265e89ce8572d4387a1b42294bdb8d265b4102f3c2

Download Submit
C:\Windows\SYSTEM.INI

Filesize
258B

MD5
765d184b2cc4f2d64ce823dbd35b7b28

SHA1
f9edbbb4b54685611456563accfbb86ebbe1375c

SHA256
88ed1a98fda84a56a3f9537c140856ce957b43c6557b8a815f1d3e0f3f96bda2

SHA512
0c606e191143ecc2796851e577ac08e93625dadfe88881ac870523133e33b533ac1ad9b4f52b3804f116cedfebf597ced326de6044af4870883d8bb473b1a2b5

Download Submit
memory/2468-13-0x0000000002320000-0x0000000002322000-memory.dmp

Filesize
8KB

Download
memory/2468-11-0x0000000002320000-0x0000000002322000-memory.dmp

Filesize
8KB

Download
memory/2468-7-0x0000000002360000-0x0000000003390000-memory.dmp

Filesize
16.2MB

Download
memory/2468-12-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/2468-14-0x0000000002320000-0x0000000002322000-memory.dmp

Filesize
8KB

Download
memory/2468-16-0x0000000002360000-0x0000000003390000-memory.dmp

Filesize
16.2MB

Download
memory/2468-17-0x0000000002360000-0x0000000003390000-memory.dmp

Filesize
16.2MB

Download
memory/2468-3-0x0000000002360000-0x0000000003390000-memory.dmp

Filesize
16.2MB

Download
memory/2468-46-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2468-0-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2468-1-0x0000000002360000-0x0000000003390000-memory.dmp

Filesize
16.2MB

Download
memory/3924-45-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/3924-53-0x0000000006840000-0x0000000007870000-memory.dmp

Filesize
16.2MB

Download
memory/3924-61-0x0000000006840000-0x0000000007870000-memory.dmp

Filesize
16.2MB

Download
memory/3924-57-0x0000000006840000-0x0000000007870000-memory.dmp

Filesize
16.2MB

Download
memory/3924-63-0x0000000006820000-0x0000000006821000-memory.dmp

Filesize
4KB

Download
memory/3924-64-0x00000000067D0000-0x00000000067D2000-memory.dmp

Filesize
8KB

Download
memory/3924-65-0x00000000067D0000-0x00000000067D2000-memory.dmp

Filesize
8KB

Download
memory/3924-67-0x0000000006840000-0x0000000007870000-memory.dmp

Filesize
16.2MB

Download
memory/3924-68-0x0000000006840000-0x0000000007870000-memory.dmp

Filesize
16.2MB

Download
memory/3924-88-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download