Analysis
-
max time kernel
33s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
27-07-2024 04:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8dde9f8d557b042dcf95e325f74fccd0N.dll
Resource
win7-20240708-en
windows7-x64
16 signatures
120 seconds
General
-
Target
8dde9f8d557b042dcf95e325f74fccd0N.dll
-
Size
120KB
-
MD5
8dde9f8d557b042dcf95e325f74fccd0
-
SHA1
85f75565b8e70bd53ff5e8ce7c67cae83d59f937
-
SHA256
bca91bd14a9c86652b19c7cc9bab840502c5e832e80eae16e9f5ca8fcfa92c5b
-
SHA512
a88dc16ef304f677e068ce7278f712d727eefc76cfa7f08307010342459e4ae9015b13f29dc2f8abf35c9f31e0b5ac8741c0f193e9d9327921c08516c70c8f08
-
SSDEEP
3072:KNgV3iOwuIjUVAbjSiz9qvjuqAPNQ+ccoGEf:kOMjAijPzIvjuqAV9cc4f
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57cb3f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57cb3f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57cb3f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e579904.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e579904.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e579904.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e579904.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57cb3f.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e579904.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e579904.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e579904.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57cb3f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57cb3f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57cb3f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57cb3f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e579904.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e579904.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e579904.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57cb3f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57cb3f.exe -
Executes dropped EXE 3 IoCs
pid Process 1280 e579904.exe 944 e579b17.exe 5100 e57cb3f.exe -
resource yara_rule behavioral2/memory/1280-8-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1280-9-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1280-10-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1280-18-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1280-11-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1280-12-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1280-19-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1280-6-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1280-27-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1280-31-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1280-35-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1280-36-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1280-37-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1280-38-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1280-40-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1280-39-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1280-46-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1280-47-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1280-57-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1280-58-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1280-59-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1280-61-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1280-62-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1280-65-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1280-67-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1280-71-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/5100-104-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/5100-148-0x00000000008A0000-0x000000000195A000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57cb3f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57cb3f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e579904.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e579904.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e579904.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e579904.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57cb3f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57cb3f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e579904.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e579904.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e579904.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57cb3f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57cb3f.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57cb3f.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57cb3f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e579904.exe -
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: e579904.exe File opened (read-only) \??\N: e579904.exe File opened (read-only) \??\I: e579904.exe File opened (read-only) \??\L: e579904.exe File opened (read-only) \??\E: e57cb3f.exe File opened (read-only) \??\G: e57cb3f.exe File opened (read-only) \??\H: e57cb3f.exe File opened (read-only) \??\G: e579904.exe File opened (read-only) \??\J: e579904.exe File opened (read-only) \??\H: e579904.exe File opened (read-only) \??\K: e579904.exe File opened (read-only) \??\J: e57cb3f.exe File opened (read-only) \??\E: e579904.exe File opened (read-only) \??\I: e57cb3f.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e579981 e579904.exe File opened for modification C:\Windows\SYSTEM.INI e579904.exe File created C:\Windows\e57f2ad e57cb3f.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e579904.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e579b17.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57cb3f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1280 e579904.exe 1280 e579904.exe 1280 e579904.exe 1280 e579904.exe 5100 e57cb3f.exe 5100 e57cb3f.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe Token: SeDebugPrivilege 1280 e579904.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3956 wrote to memory of 4896 3956 rundll32.exe 84 PID 3956 wrote to memory of 4896 3956 rundll32.exe 84 PID 3956 wrote to memory of 4896 3956 rundll32.exe 84 PID 4896 wrote to memory of 1280 4896 rundll32.exe 85 PID 4896 wrote to memory of 1280 4896 rundll32.exe 85 PID 4896 wrote to memory of 1280 4896 rundll32.exe 85 PID 1280 wrote to memory of 792 1280 e579904.exe 8 PID 1280 wrote to memory of 800 1280 e579904.exe 9 PID 1280 wrote to memory of 336 1280 e579904.exe 13 PID 1280 wrote to memory of 2600 1280 e579904.exe 42 PID 1280 wrote to memory of 2640 1280 e579904.exe 45 PID 1280 wrote to memory of 2852 1280 e579904.exe 48 PID 1280 wrote to memory of 3532 1280 e579904.exe 56 PID 1280 wrote to memory of 3660 1280 e579904.exe 57 PID 1280 wrote to memory of 3848 1280 e579904.exe 58 PID 1280 wrote to memory of 3936 1280 e579904.exe 59 PID 1280 wrote to memory of 4004 1280 e579904.exe 60 PID 1280 wrote to memory of 4092 1280 e579904.exe 61 PID 1280 wrote to memory of 3676 1280 e579904.exe 62 PID 1280 wrote to memory of 4788 1280 e579904.exe 75 PID 1280 wrote to memory of 116 1280 e579904.exe 76 PID 1280 wrote to memory of 2948 1280 e579904.exe 81 PID 1280 wrote to memory of 1760 1280 e579904.exe 82 PID 1280 wrote to memory of 3956 1280 e579904.exe 83 PID 1280 wrote to memory of 4896 1280 e579904.exe 84 PID 1280 wrote to memory of 4896 1280 e579904.exe 84 PID 4896 wrote to memory of 944 4896 rundll32.exe 86 PID 4896 wrote to memory of 944 4896 rundll32.exe 86 PID 4896 wrote to memory of 944 4896 rundll32.exe 86 PID 1280 wrote to memory of 792 1280 e579904.exe 8 PID 1280 wrote to memory of 800 1280 e579904.exe 9 PID 1280 wrote to memory of 336 1280 e579904.exe 13 PID 1280 wrote to memory of 2600 1280 e579904.exe 42 PID 1280 wrote to memory of 2640 1280 e579904.exe 45 PID 1280 wrote to memory of 2852 1280 e579904.exe 48 PID 1280 wrote to memory of 3532 1280 e579904.exe 56 PID 1280 wrote to memory of 3660 1280 e579904.exe 57 PID 1280 wrote to memory of 3848 1280 e579904.exe 58 PID 1280 wrote to memory of 3936 1280 e579904.exe 59 PID 1280 wrote to memory of 4004 1280 e579904.exe 60 PID 1280 wrote to memory of 4092 1280 e579904.exe 61 PID 1280 wrote to memory of 3676 1280 e579904.exe 62 PID 1280 wrote to memory of 4788 1280 e579904.exe 75 PID 1280 wrote to memory of 116 1280 e579904.exe 76 PID 1280 wrote to memory of 2948 1280 e579904.exe 81 PID 1280 wrote to memory of 1760 1280 e579904.exe 82 PID 1280 wrote to memory of 3956 1280 e579904.exe 83 PID 1280 wrote to memory of 944 1280 e579904.exe 86 PID 1280 wrote to memory of 944 1280 e579904.exe 86 PID 1280 wrote to memory of 2124 1280 e579904.exe 88 PID 1280 wrote to memory of 2440 1280 e579904.exe 89 PID 4896 wrote to memory of 5100 4896 rundll32.exe 92 PID 4896 wrote to memory of 5100 4896 rundll32.exe 92 PID 4896 wrote to memory of 5100 4896 rundll32.exe 92 PID 5100 wrote to memory of 792 5100 e57cb3f.exe 8 PID 5100 wrote to memory of 800 5100 e57cb3f.exe 9 PID 5100 wrote to memory of 336 5100 e57cb3f.exe 13 PID 5100 wrote to memory of 2600 5100 e57cb3f.exe 42 PID 5100 wrote to memory of 2640 5100 e57cb3f.exe 45 PID 5100 wrote to memory of 2852 5100 e57cb3f.exe 48 PID 5100 wrote to memory of 3532 5100 e57cb3f.exe 56 PID 5100 wrote to memory of 3660 5100 e57cb3f.exe 57 PID 5100 wrote to memory of 3848 5100 e57cb3f.exe 58 PID 5100 wrote to memory of 3936 5100 e57cb3f.exe 59 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e579904.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57cb3f.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:800
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:336
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2600
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2640
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2852
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3532
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8dde9f8d557b042dcf95e325f74fccd0N.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8dde9f8d557b042dcf95e325f74fccd0N.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\e579904.exeC:\Users\Admin\AppData\Local\Temp\e579904.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1280
-
-
C:\Users\Admin\AppData\Local\Temp\e579b17.exeC:\Users\Admin\AppData\Local\Temp\e579b17.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:944
-
-
C:\Users\Admin\AppData\Local\Temp\e57cb3f.exeC:\Users\Admin\AppData\Local\Temp\e57cb3f.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5100
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3660
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3848
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3936
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4004
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4092
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3676
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4788
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:116
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:2948
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:1760
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2124
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2440
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5502c1aef86bb5ee952cbcf78645a8b0b
SHA1b8c5d5e7dce4a69b6baa8d11a3f12cb588dab0cf
SHA256d4d0e44434730ee43a4994a6cc9d91cc6415510338b0b287e4cbf22a3c9274ab
SHA512606c23e79fdb01021fcfecc2f93eddcc68d4a6ebd9d8db3490c883f52c4d477c8748050873530c563e264b5270947f12b2002fa8566cfab0726309692543935c
-
Filesize
257B
MD5c947d50ca971a662e4455c3e144daf06
SHA10b18f264555717c48eaac71500ac6aeb4878b624
SHA25696596354bc66d006183b187b887a874d86710420111309d5464af2f833f342d2
SHA5126d319ce6da024f7601970ddc3fa207552725ba93eef0ecf43681739ae00f33b420bcd92a8911ecdcf881e480c74de7c2be90d1fba1c85d63e5bd7b50177be152