Analysis
-
max time kernel
29s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04/11/2024, 04:48
Static task
static1
Behavioral task
behavioral1
Sample
cbcc142fa4a7e960109f9643e56edcb989ad47063539aa6c20348a05355dc827N.dll
Resource
win7-20240903-en
General
-
Target
cbcc142fa4a7e960109f9643e56edcb989ad47063539aa6c20348a05355dc827N.dll
-
Size
120KB
-
MD5
a14fecf5587b5f5d06ff34b9c28b57b0
-
SHA1
5ec813098a0440e845b1f6d42314f2338a123b66
-
SHA256
cbcc142fa4a7e960109f9643e56edcb989ad47063539aa6c20348a05355dc827
-
SHA512
d2fe024e613b6a6ae690af1990ab56a464803328cf6603f8343e80b94ac3dfe336a38e4e0b80333990f618a646554356957cde177667da1b4e67c822517f9bff
-
SSDEEP
3072:ZzPH4V6YWortvX5Q2em3+rzRK+JxonS2LwE:ZzQVCortvpQc3+HRRJxonSw
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57bf58.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57bf58.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57bf58.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57eb2b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57eb2b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57eb2b.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57bf58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57eb2b.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57bf58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57eb2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57eb2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57eb2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57eb2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57bf58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57bf58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57bf58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57bf58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57eb2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57eb2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57bf58.exe -
Executes dropped EXE 4 IoCs
pid Process 792 e57bf58.exe 4260 e57c747.exe 3496 e57eaae.exe 4992 e57eb2b.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57bf58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57bf58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57eb2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57eb2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57bf58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57bf58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57bf58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57eb2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57eb2b.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57eb2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57bf58.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57bf58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57eb2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57eb2b.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57bf58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57eb2b.exe -
Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: e57bf58.exe File opened (read-only) \??\H: e57bf58.exe File opened (read-only) \??\K: e57bf58.exe File opened (read-only) \??\G: e57eb2b.exe File opened (read-only) \??\H: e57eb2b.exe File opened (read-only) \??\G: e57bf58.exe File opened (read-only) \??\I: e57bf58.exe File opened (read-only) \??\J: e57bf58.exe File opened (read-only) \??\L: e57bf58.exe File opened (read-only) \??\E: e57eb2b.exe -
resource yara_rule behavioral2/memory/792-6-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/792-8-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/792-9-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/792-10-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/792-11-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/792-12-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/792-14-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/792-13-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/792-15-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/792-16-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/792-35-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/792-36-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/792-37-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/792-38-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/792-39-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/792-66-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/792-67-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/792-70-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/792-71-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/792-72-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/792-75-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/792-76-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/792-92-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/4992-114-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx behavioral2/memory/4992-155-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI e57bf58.exe File created C:\Windows\e5812f6 e57eb2b.exe File created C:\Windows\e57c023 e57bf58.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57bf58.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57c747.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57eb2b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57eaae.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 792 e57bf58.exe 792 e57bf58.exe 792 e57bf58.exe 792 e57bf58.exe 4992 e57eb2b.exe 4992 e57eb2b.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe Token: SeDebugPrivilege 792 e57bf58.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1324 wrote to memory of 3672 1324 rundll32.exe 84 PID 1324 wrote to memory of 3672 1324 rundll32.exe 84 PID 1324 wrote to memory of 3672 1324 rundll32.exe 84 PID 3672 wrote to memory of 792 3672 rundll32.exe 85 PID 3672 wrote to memory of 792 3672 rundll32.exe 85 PID 3672 wrote to memory of 792 3672 rundll32.exe 85 PID 792 wrote to memory of 760 792 e57bf58.exe 8 PID 792 wrote to memory of 764 792 e57bf58.exe 9 PID 792 wrote to memory of 60 792 e57bf58.exe 13 PID 792 wrote to memory of 2552 792 e57bf58.exe 44 PID 792 wrote to memory of 2632 792 e57bf58.exe 45 PID 792 wrote to memory of 2844 792 e57bf58.exe 49 PID 792 wrote to memory of 3488 792 e57bf58.exe 56 PID 792 wrote to memory of 3676 792 e57bf58.exe 57 PID 792 wrote to memory of 3876 792 e57bf58.exe 58 PID 792 wrote to memory of 3972 792 e57bf58.exe 59 PID 792 wrote to memory of 4040 792 e57bf58.exe 60 PID 792 wrote to memory of 2832 792 e57bf58.exe 61 PID 792 wrote to memory of 4112 792 e57bf58.exe 62 PID 792 wrote to memory of 456 792 e57bf58.exe 74 PID 792 wrote to memory of 3344 792 e57bf58.exe 76 PID 792 wrote to memory of 4796 792 e57bf58.exe 81 PID 792 wrote to memory of 2500 792 e57bf58.exe 82 PID 792 wrote to memory of 1324 792 e57bf58.exe 83 PID 792 wrote to memory of 3672 792 e57bf58.exe 84 PID 792 wrote to memory of 3672 792 e57bf58.exe 84 PID 792 wrote to memory of 4488 792 e57bf58.exe 86 PID 3672 wrote to memory of 4260 3672 rundll32.exe 87 PID 3672 wrote to memory of 4260 3672 rundll32.exe 87 PID 3672 wrote to memory of 4260 3672 rundll32.exe 87 PID 3672 wrote to memory of 3496 3672 rundll32.exe 90 PID 3672 wrote to memory of 3496 3672 rundll32.exe 90 PID 3672 wrote to memory of 3496 3672 rundll32.exe 90 PID 3672 wrote to memory of 4992 3672 rundll32.exe 91 PID 3672 wrote to memory of 4992 3672 rundll32.exe 91 PID 3672 wrote to memory of 4992 3672 rundll32.exe 91 PID 792 wrote to memory of 760 792 e57bf58.exe 8 PID 792 wrote to memory of 764 792 e57bf58.exe 9 PID 792 wrote to memory of 60 792 e57bf58.exe 13 PID 792 wrote to memory of 2552 792 e57bf58.exe 44 PID 792 wrote to memory of 2632 792 e57bf58.exe 45 PID 792 wrote to memory of 2844 792 e57bf58.exe 49 PID 792 wrote to memory of 3488 792 e57bf58.exe 56 PID 792 wrote to memory of 3676 792 e57bf58.exe 57 PID 792 wrote to memory of 3876 792 e57bf58.exe 58 PID 792 wrote to memory of 3972 792 e57bf58.exe 59 PID 792 wrote to memory of 4040 792 e57bf58.exe 60 PID 792 wrote to memory of 2832 792 e57bf58.exe 61 PID 792 wrote to memory of 4112 792 e57bf58.exe 62 PID 792 wrote to memory of 456 792 e57bf58.exe 74 PID 792 wrote to memory of 3344 792 e57bf58.exe 76 PID 792 wrote to memory of 4796 792 e57bf58.exe 81 PID 792 wrote to memory of 2500 792 e57bf58.exe 82 PID 792 wrote to memory of 4260 792 e57bf58.exe 87 PID 792 wrote to memory of 4260 792 e57bf58.exe 87 PID 792 wrote to memory of 3184 792 e57bf58.exe 88 PID 792 wrote to memory of 4140 792 e57bf58.exe 89 PID 792 wrote to memory of 3496 792 e57bf58.exe 90 PID 792 wrote to memory of 3496 792 e57bf58.exe 90 PID 792 wrote to memory of 4992 792 e57bf58.exe 91 PID 792 wrote to memory of 4992 792 e57bf58.exe 91 PID 4992 wrote to memory of 760 4992 e57eb2b.exe 8 PID 4992 wrote to memory of 764 4992 e57eb2b.exe 9 PID 4992 wrote to memory of 60 4992 e57eb2b.exe 13 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57eb2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57bf58.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:760
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:764
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:60
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2552
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2632
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2844
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3488
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cbcc142fa4a7e960109f9643e56edcb989ad47063539aa6c20348a05355dc827N.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cbcc142fa4a7e960109f9643e56edcb989ad47063539aa6c20348a05355dc827N.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\e57bf58.exeC:\Users\Admin\AppData\Local\Temp\e57bf58.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:792
-
-
C:\Users\Admin\AppData\Local\Temp\e57c747.exeC:\Users\Admin\AppData\Local\Temp\e57c747.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4260
-
-
C:\Users\Admin\AppData\Local\Temp\e57eaae.exeC:\Users\Admin\AppData\Local\Temp\e57eaae.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3496
-
-
C:\Users\Admin\AppData\Local\Temp\e57eb2b.exeC:\Users\Admin\AppData\Local\Temp\e57eb2b.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4992
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3676
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3876
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3972
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4040
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2832
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4112
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:456
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3344
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:4796
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:2500
-
C:\Windows\system32\BackgroundTaskHost.exe"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider1⤵PID:4488
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3184
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4140
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD53f4855e34ca66d4a8d94da47ea4b3cbc
SHA10ff399f134c2bd145b036be821422c2103d5edb0
SHA25657aaf3e40638ea3b12e7c2b5626d777125d2a484ddefec767271132195842fb0
SHA51242e89070a4dcdaae7368b3543a3bf5a7750872ac3405f66478def13d3a33db9799fee767c312fa1e13190ee9caee8db194e551631900bb868e04f6d6244a7be3
-
Filesize
257B
MD52da620dac9082628369bcf12b0247526
SHA190249f16d9486ebe19a312888869abacc6c1011c
SHA256dfaad4a90ab1f5a44ebd6335de11e90b1440204ea1bdfc513e845c196f9424fb
SHA512c5f27c1f75a4af0f3f3c363518b8bbabca85148164d397fc790f0de3fdb24e98abe6deccb9733e1abdfb019e120fd22422f0b80888689f36094431be4c9f5fa1