b9af69ac821a649f211c99e3edf32a76a213e9450b5e972a6cdda5758af530dd

max time kernel
143s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 02:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DisplaySwitch.exe
Size

1.8MB
MD5

2618d4df8df1edc121f545f88a73ba96
SHA1

2beef104d2bd905d42664e7f12f7cd44a16dbad5
SHA256

68bf50a2e98f4f8f492dc2a20977e6246157590d47499b7858129f9b143c3b6f
SHA512

608b1d55d6de72ae8bd3b18b0e2b51a250cafa9288a123d0f738c281e674302aaee7225a9755440d5ad3823debee6db903980c37789fb6b40db8896a1400e7dd
SSDEEP

3072:yKqaKOfUBQ1WvKRz6sXKKMqYi11gPvkYM15uSf/N1:yKqaDDQKRHXHMqfss5j

Score

3^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

C:\Users\Admin\AppData\Local\Temp\DisplaySwitch.exe
"C:\Users\Admin\AppData\Local\Temp\DisplaySwitch.exe"
1⤵
PID:2716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:1872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicePickerUserSvc
1⤵
PID:2996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:1128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads