Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
28/08/2024, 19:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
242c24be996e827979509c71f8574398c0a373ae1d07e67ef6df2c03c61f4edd.dll
Resource
win7-20240708-en
windows7-x64
16 signatures
150 seconds
General
-
Target
242c24be996e827979509c71f8574398c0a373ae1d07e67ef6df2c03c61f4edd.dll
-
Size
120KB
-
MD5
bf6f3505ca59136d08d699dca52ff9af
-
SHA1
a5774984f78fd1b8320001aa411ab50cee22a742
-
SHA256
242c24be996e827979509c71f8574398c0a373ae1d07e67ef6df2c03c61f4edd
-
SHA512
30fdab92c21a08f81ede70eedb91a798db884ec0d5b36dd72e7e35a1ba94cc1dadf4862c95e8ed7974487e0bfc3940492fad8a601094870ef35b4842ca091e16
-
SSDEEP
1536:zGHBh/EVHy4LDCsixQ0BZ+eADf3atU08WMDBoxGxbFTkXUkmOBgZoaEYFl6l:aT/WDDixQ4boiU08WJ0xxIkaCoaEu
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76afdf.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76b165.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76b165.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76cb6a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76afdf.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76afdf.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76b165.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76cb6a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76cb6a.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76afdf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b165.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76cb6a.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76afdf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76afdf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b165.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76cb6a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76afdf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b165.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b165.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76cb6a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76cb6a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76afdf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b165.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b165.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76cb6a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76afdf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76afdf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b165.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76cb6a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76cb6a.exe -
Executes dropped EXE 3 IoCs
pid Process 2408 f76afdf.exe 2848 f76b165.exe 2680 f76cb6a.exe -
Loads dropped DLL 6 IoCs
pid Process 2584 rundll32.exe 2584 rundll32.exe 2584 rundll32.exe 2584 rundll32.exe 2584 rundll32.exe 2584 rundll32.exe -
resource yara_rule behavioral1/memory/2408-15-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2408-19-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2408-12-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2408-14-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2408-16-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2408-18-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2408-17-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2408-21-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2408-13-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2408-20-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2408-61-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2408-62-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2408-63-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2408-65-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2408-64-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2408-67-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2408-68-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2408-84-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2408-85-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2408-87-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2408-107-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2408-151-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2680-169-0x0000000000910000-0x00000000019CA000-memory.dmp upx behavioral1/memory/2680-210-0x0000000000910000-0x00000000019CA000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b165.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b165.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76b165.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76cb6a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76cb6a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76afdf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76afdf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b165.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76cb6a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b165.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76cb6a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76afdf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76afdf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76afdf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b165.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76cb6a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76cb6a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76cb6a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76afdf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76afdf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b165.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b165.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76cb6a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76afdf.exe -
Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: f76cb6a.exe File opened (read-only) \??\E: f76afdf.exe File opened (read-only) \??\G: f76afdf.exe File opened (read-only) \??\H: f76afdf.exe File opened (read-only) \??\Q: f76afdf.exe File opened (read-only) \??\T: f76afdf.exe File opened (read-only) \??\J: f76afdf.exe File opened (read-only) \??\O: f76afdf.exe File opened (read-only) \??\E: f76cb6a.exe File opened (read-only) \??\I: f76afdf.exe File opened (read-only) \??\L: f76afdf.exe File opened (read-only) \??\N: f76afdf.exe File opened (read-only) \??\P: f76afdf.exe File opened (read-only) \??\R: f76afdf.exe File opened (read-only) \??\K: f76afdf.exe File opened (read-only) \??\M: f76afdf.exe File opened (read-only) \??\S: f76afdf.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\f76b04c f76afdf.exe File opened for modification C:\Windows\SYSTEM.INI f76afdf.exe File created C:\Windows\f76ffd2 f76b165.exe File created C:\Windows\f77004f f76cb6a.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76cb6a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76afdf.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2408 f76afdf.exe 2408 f76afdf.exe 2680 f76cb6a.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 2408 f76afdf.exe Token: SeDebugPrivilege 2408 f76afdf.exe Token: SeDebugPrivilege 2408 f76afdf.exe Token: SeDebugPrivilege 2408 f76afdf.exe Token: SeDebugPrivilege 2408 f76afdf.exe Token: SeDebugPrivilege 2408 f76afdf.exe Token: SeDebugPrivilege 2408 f76afdf.exe Token: SeDebugPrivilege 2408 f76afdf.exe Token: SeDebugPrivilege 2408 f76afdf.exe Token: SeDebugPrivilege 2408 f76afdf.exe Token: SeDebugPrivilege 2408 f76afdf.exe Token: SeDebugPrivilege 2408 f76afdf.exe Token: SeDebugPrivilege 2408 f76afdf.exe Token: SeDebugPrivilege 2408 f76afdf.exe Token: SeDebugPrivilege 2408 f76afdf.exe Token: SeDebugPrivilege 2408 f76afdf.exe Token: SeDebugPrivilege 2408 f76afdf.exe Token: SeDebugPrivilege 2408 f76afdf.exe Token: SeDebugPrivilege 2408 f76afdf.exe Token: SeDebugPrivilege 2408 f76afdf.exe Token: SeDebugPrivilege 2408 f76afdf.exe Token: SeDebugPrivilege 2408 f76afdf.exe Token: SeDebugPrivilege 2408 f76afdf.exe Token: SeDebugPrivilege 2408 f76afdf.exe Token: SeDebugPrivilege 2680 f76cb6a.exe Token: SeDebugPrivilege 2680 f76cb6a.exe Token: SeDebugPrivilege 2680 f76cb6a.exe Token: SeDebugPrivilege 2680 f76cb6a.exe Token: SeDebugPrivilege 2680 f76cb6a.exe Token: SeDebugPrivilege 2680 f76cb6a.exe Token: SeDebugPrivilege 2680 f76cb6a.exe Token: SeDebugPrivilege 2680 f76cb6a.exe Token: SeDebugPrivilege 2680 f76cb6a.exe Token: SeDebugPrivilege 2680 f76cb6a.exe Token: SeDebugPrivilege 2680 f76cb6a.exe Token: SeDebugPrivilege 2680 f76cb6a.exe Token: SeDebugPrivilege 2680 f76cb6a.exe Token: SeDebugPrivilege 2680 f76cb6a.exe Token: SeDebugPrivilege 2680 f76cb6a.exe Token: SeDebugPrivilege 2680 f76cb6a.exe Token: SeDebugPrivilege 2680 f76cb6a.exe Token: SeDebugPrivilege 2680 f76cb6a.exe Token: SeDebugPrivilege 2680 f76cb6a.exe Token: SeDebugPrivilege 2680 f76cb6a.exe Token: SeDebugPrivilege 2680 f76cb6a.exe Token: SeDebugPrivilege 2680 f76cb6a.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2536 wrote to memory of 2584 2536 rundll32.exe 30 PID 2536 wrote to memory of 2584 2536 rundll32.exe 30 PID 2536 wrote to memory of 2584 2536 rundll32.exe 30 PID 2536 wrote to memory of 2584 2536 rundll32.exe 30 PID 2536 wrote to memory of 2584 2536 rundll32.exe 30 PID 2536 wrote to memory of 2584 2536 rundll32.exe 30 PID 2536 wrote to memory of 2584 2536 rundll32.exe 30 PID 2584 wrote to memory of 2408 2584 rundll32.exe 31 PID 2584 wrote to memory of 2408 2584 rundll32.exe 31 PID 2584 wrote to memory of 2408 2584 rundll32.exe 31 PID 2584 wrote to memory of 2408 2584 rundll32.exe 31 PID 2408 wrote to memory of 1104 2408 f76afdf.exe 19 PID 2408 wrote to memory of 1164 2408 f76afdf.exe 20 PID 2408 wrote to memory of 1192 2408 f76afdf.exe 21 PID 2408 wrote to memory of 272 2408 f76afdf.exe 25 PID 2408 wrote to memory of 2536 2408 f76afdf.exe 29 PID 2408 wrote to memory of 2584 2408 f76afdf.exe 30 PID 2408 wrote to memory of 2584 2408 f76afdf.exe 30 PID 2584 wrote to memory of 2848 2584 rundll32.exe 32 PID 2584 wrote to memory of 2848 2584 rundll32.exe 32 PID 2584 wrote to memory of 2848 2584 rundll32.exe 32 PID 2584 wrote to memory of 2848 2584 rundll32.exe 32 PID 2584 wrote to memory of 2680 2584 rundll32.exe 33 PID 2584 wrote to memory of 2680 2584 rundll32.exe 33 PID 2584 wrote to memory of 2680 2584 rundll32.exe 33 PID 2584 wrote to memory of 2680 2584 rundll32.exe 33 PID 2408 wrote to memory of 1104 2408 f76afdf.exe 19 PID 2408 wrote to memory of 1164 2408 f76afdf.exe 20 PID 2408 wrote to memory of 1192 2408 f76afdf.exe 21 PID 2408 wrote to memory of 272 2408 f76afdf.exe 25 PID 2408 wrote to memory of 2848 2408 f76afdf.exe 32 PID 2408 wrote to memory of 2848 2408 f76afdf.exe 32 PID 2408 wrote to memory of 2680 2408 f76afdf.exe 33 PID 2408 wrote to memory of 2680 2408 f76afdf.exe 33 PID 2680 wrote to memory of 1104 2680 f76cb6a.exe 19 PID 2680 wrote to memory of 1164 2680 f76cb6a.exe 20 PID 2680 wrote to memory of 1192 2680 f76cb6a.exe 21 PID 2680 wrote to memory of 272 2680 f76cb6a.exe 25 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76afdf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b165.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76cb6a.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1104
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1164
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1192
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\242c24be996e827979509c71f8574398c0a373ae1d07e67ef6df2c03c61f4edd.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\242c24be996e827979509c71f8574398c0a373ae1d07e67ef6df2c03c61f4edd.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\f76afdf.exeC:\Users\Admin\AppData\Local\Temp\f76afdf.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2408
-
-
C:\Users\Admin\AppData\Local\Temp\f76b165.exeC:\Users\Admin\AppData\Local\Temp\f76b165.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System policy modification
PID:2848
-
-
C:\Users\Admin\AppData\Local\Temp\f76cb6a.exeC:\Users\Admin\AppData\Local\Temp\f76cb6a.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2680
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:272
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD5dd08f943bad32ef5bd9e7d6cbf9884cb
SHA1afa4d51081cc2380e13a4b84502831dc86db3c17
SHA2566626e5e0d5feba6a1bd33a0ee9dce0854e97e6736b16e44cb63d9bbbe20fe302
SHA5124d69a693bb852b2ed69acba3593f889d01b1cced1a43f1a5a42d441daca0f94c05bc7308420aba8ea5c9c1504274508d3e8a7fbba3f7e2bd39d07156d0e9ffdf
-
Filesize
97KB
MD5b622c2b50d7a8ecc3438f44b7f930253
SHA1333d61e04b8143e546bf894d79cce19a42c5a48e
SHA2564a5a3f86c8836f4f9cd4b37dc04bc02024e3bba70b90e2212c68bd57da14c5e9
SHA51217a7886f2094edaa6862e46891809be3972632fd7ef1cb8435681c5693d9e0f7fc83aaa32027b532dc7f22b1ac9a6999582915778af07889c879427332147e16