Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30-06-2024 22:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1e63211cb2505503947837110fe0e38007fd26f1430dcc86be48560dfaf80d4f_NeikiAnalytics.dll
Resource
win7-20240611-en
windows7-x64
15 signatures
150 seconds
General
-
Target
1e63211cb2505503947837110fe0e38007fd26f1430dcc86be48560dfaf80d4f_NeikiAnalytics.dll
-
Size
120KB
-
MD5
7144b38532c87843b7f66325935cf410
-
SHA1
b9c8faff7e2991498dfad842abd0b66e16a1ef01
-
SHA256
1e63211cb2505503947837110fe0e38007fd26f1430dcc86be48560dfaf80d4f
-
SHA512
5ae28fe7340445f729ea468d750994b916d568666d90fe32ac538e6edb54839a1e68e87ff1bf2466c9d83d2f38b412b7c9cbdfce134165fe6c4289053900e95c
-
SSDEEP
3072:HP4/LEiEUW01B4vmphKuLJuRfCnLJ+fzsTFO:v4/AiEURBWmf9mfCnLJ+fzs
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e575ef8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e574343.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e574343.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e574343.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e575ef8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e575ef8.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e574343.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e575ef8.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e574343.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e575ef8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e575ef8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e575ef8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e575ef8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e574343.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e574343.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e574343.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e574343.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e574343.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e575ef8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e575ef8.exe -
Executes dropped EXE 3 IoCs
pid Process 5088 e574343.exe 4544 e57447b.exe 740 e575ef8.exe -
resource yara_rule behavioral2/memory/5088-6-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/5088-24-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/5088-11-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/5088-10-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/5088-25-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/5088-9-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/5088-32-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/5088-33-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/5088-8-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/5088-34-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/5088-35-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/5088-36-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/5088-37-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/5088-38-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/5088-39-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/5088-41-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/5088-42-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/5088-51-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/5088-53-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/5088-54-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/5088-64-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/5088-66-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/5088-69-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/5088-71-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/5088-73-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/5088-75-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/5088-77-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/5088-79-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/5088-81-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/5088-83-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/740-112-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx behavioral2/memory/740-118-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e574343.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e575ef8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e575ef8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e574343.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e574343.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e574343.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e574343.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e575ef8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e575ef8.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e575ef8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e574343.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e574343.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e575ef8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e575ef8.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e574343.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e575ef8.exe -
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: e574343.exe File opened (read-only) \??\O: e574343.exe File opened (read-only) \??\H: e574343.exe File opened (read-only) \??\J: e574343.exe File opened (read-only) \??\P: e574343.exe File opened (read-only) \??\R: e574343.exe File opened (read-only) \??\S: e574343.exe File opened (read-only) \??\G: e574343.exe File opened (read-only) \??\I: e574343.exe File opened (read-only) \??\M: e574343.exe File opened (read-only) \??\E: e574343.exe File opened (read-only) \??\L: e574343.exe File opened (read-only) \??\K: e574343.exe File opened (read-only) \??\Q: e574343.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7zG.exe e574343.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e574343.exe File opened for modification C:\Program Files\7-Zip\7z.exe e574343.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e574343.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI e574343.exe File created C:\Windows\e57ad76 e575ef8.exe File created C:\Windows\e574391 e574343.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 5088 e574343.exe 5088 e574343.exe 5088 e574343.exe 5088 e574343.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe Token: SeDebugPrivilege 5088 e574343.exe -
Suspicious use of WriteProcessMemory 49 IoCs
description pid Process procid_target PID 1712 wrote to memory of 1940 1712 rundll32.exe 81 PID 1712 wrote to memory of 1940 1712 rundll32.exe 81 PID 1712 wrote to memory of 1940 1712 rundll32.exe 81 PID 1940 wrote to memory of 5088 1940 rundll32.exe 82 PID 1940 wrote to memory of 5088 1940 rundll32.exe 82 PID 1940 wrote to memory of 5088 1940 rundll32.exe 82 PID 5088 wrote to memory of 792 5088 e574343.exe 9 PID 5088 wrote to memory of 800 5088 e574343.exe 10 PID 5088 wrote to memory of 332 5088 e574343.exe 13 PID 5088 wrote to memory of 2876 5088 e574343.exe 49 PID 5088 wrote to memory of 2920 5088 e574343.exe 50 PID 5088 wrote to memory of 2624 5088 e574343.exe 53 PID 5088 wrote to memory of 3512 5088 e574343.exe 56 PID 5088 wrote to memory of 3628 5088 e574343.exe 57 PID 5088 wrote to memory of 3836 5088 e574343.exe 58 PID 5088 wrote to memory of 3924 5088 e574343.exe 59 PID 5088 wrote to memory of 3992 5088 e574343.exe 60 PID 5088 wrote to memory of 4084 5088 e574343.exe 61 PID 5088 wrote to memory of 4124 5088 e574343.exe 62 PID 5088 wrote to memory of 2996 5088 e574343.exe 74 PID 5088 wrote to memory of 4636 5088 e574343.exe 75 PID 5088 wrote to memory of 1712 5088 e574343.exe 80 PID 5088 wrote to memory of 1940 5088 e574343.exe 81 PID 5088 wrote to memory of 1940 5088 e574343.exe 81 PID 1940 wrote to memory of 4544 1940 rundll32.exe 83 PID 1940 wrote to memory of 4544 1940 rundll32.exe 83 PID 1940 wrote to memory of 4544 1940 rundll32.exe 83 PID 1940 wrote to memory of 740 1940 rundll32.exe 84 PID 1940 wrote to memory of 740 1940 rundll32.exe 84 PID 1940 wrote to memory of 740 1940 rundll32.exe 84 PID 5088 wrote to memory of 792 5088 e574343.exe 9 PID 5088 wrote to memory of 800 5088 e574343.exe 10 PID 5088 wrote to memory of 332 5088 e574343.exe 13 PID 5088 wrote to memory of 2876 5088 e574343.exe 49 PID 5088 wrote to memory of 2920 5088 e574343.exe 50 PID 5088 wrote to memory of 2624 5088 e574343.exe 53 PID 5088 wrote to memory of 3512 5088 e574343.exe 56 PID 5088 wrote to memory of 3628 5088 e574343.exe 57 PID 5088 wrote to memory of 3836 5088 e574343.exe 58 PID 5088 wrote to memory of 3924 5088 e574343.exe 59 PID 5088 wrote to memory of 3992 5088 e574343.exe 60 PID 5088 wrote to memory of 4084 5088 e574343.exe 61 PID 5088 wrote to memory of 4124 5088 e574343.exe 62 PID 5088 wrote to memory of 2996 5088 e574343.exe 74 PID 5088 wrote to memory of 4636 5088 e574343.exe 75 PID 5088 wrote to memory of 4544 5088 e574343.exe 83 PID 5088 wrote to memory of 4544 5088 e574343.exe 83 PID 5088 wrote to memory of 740 5088 e574343.exe 84 PID 5088 wrote to memory of 740 5088 e574343.exe 84 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e574343.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e575ef8.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:800
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:332
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2876
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2920
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2624
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3512
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1e63211cb2505503947837110fe0e38007fd26f1430dcc86be48560dfaf80d4f_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1e63211cb2505503947837110fe0e38007fd26f1430dcc86be48560dfaf80d4f_NeikiAnalytics.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\e574343.exeC:\Users\Admin\AppData\Local\Temp\e574343.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5088
-
-
C:\Users\Admin\AppData\Local\Temp\e57447b.exeC:\Users\Admin\AppData\Local\Temp\e57447b.exe4⤵
- Executes dropped EXE
PID:4544
-
-
C:\Users\Admin\AppData\Local\Temp\e575ef8.exeC:\Users\Admin\AppData\Local\Temp\e575ef8.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System policy modification
PID:740
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3628
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3836
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3924
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3992
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4084
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4124
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:2996
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4636
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5b3304659798796c8c06a95bb0ceba755
SHA18556158323976244fcb787e77a2ea89c4a77cf79
SHA2565cedd5c1e37451823cdb4269934e7e6ebda03e7aa80588e6d618fdd616cd8726
SHA512b083219be9bed92301974efbc88a1deab656c12757439824014b7d25fa84162f672a509a77806f9a2cfcfb61f235ed27657dc5d78d77f8a4ac45b8b2a0518cdf
-
Filesize
257B
MD5bc25bc68ec46109190d7cba3a6fbbf66
SHA19e4e2f16d2326f94e964a963c9a0d381e90ab8c4
SHA256a270841cef22125da836379ab67e40846adca4b290844734c4fb01e8e13845a3
SHA512db906693cc5660571684bfbcba82b96d2a25adad384df2c9377abcf0d306bf95f7af1e4ce4ae8c122780661f140ac7feafa809df7aafcb86cd0e61d34f20c2bc