Analysis
-
max time kernel
91s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-11-2024 20:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
296262f4673d016f99bd7c126b7934b37469dd275b6dd44805356e081d2ebb74.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
150 seconds
General
-
Target
296262f4673d016f99bd7c126b7934b37469dd275b6dd44805356e081d2ebb74.dll
-
Size
120KB
-
MD5
64aab437ce8b596ab03d4f8ba65419c2
-
SHA1
7da8f20c4b9492d934232a8b424b70d9311b058f
-
SHA256
296262f4673d016f99bd7c126b7934b37469dd275b6dd44805356e081d2ebb74
-
SHA512
2b7d4284090f85b592dd5274bf7cb825c5d73891f294709ec645afe1460d87dfbc6f6f065280a2aaf2c56763723a247e5fc196eb41ac3e0b845534a031dc7167
-
SSDEEP
1536:Kx+CPdV5tOvMqUIJzU3KGo79PJD0sVKkaqEBb4Z+aVWEObNFky7Z/PmR8tNIAGJ:MVnOfUIJ4olJD0sR4B5a0EqFk4cSJi
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57b100.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57b100.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57b100.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57e399.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57e399.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57e399.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57b100.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57e399.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57b100.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57b100.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57b100.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57e399.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57e399.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57e399.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57b100.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57b100.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57b100.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57e399.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57e399.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57e399.exe -
Executes dropped EXE 4 IoCs
pid Process 3536 e57b100.exe 1496 e57b342.exe 3580 e57e399.exe 404 e57e3a9.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57b100.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57e399.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57e399.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57b100.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57b100.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57b100.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57e399.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57e399.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57b100.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57b100.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57e399.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57e399.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57b100.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57e399.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57b100.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57e399.exe -
Enumerates connected drives 3 TTPs 13 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: e57b100.exe File opened (read-only) \??\E: e57e399.exe File opened (read-only) \??\H: e57e399.exe File opened (read-only) \??\H: e57b100.exe File opened (read-only) \??\J: e57b100.exe File opened (read-only) \??\K: e57b100.exe File opened (read-only) \??\L: e57b100.exe File opened (read-only) \??\I: e57e399.exe File opened (read-only) \??\J: e57e399.exe File opened (read-only) \??\E: e57b100.exe File opened (read-only) \??\G: e57b100.exe File opened (read-only) \??\I: e57b100.exe File opened (read-only) \??\G: e57e399.exe -
resource yara_rule behavioral2/memory/3536-6-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/3536-8-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/3536-9-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/3536-10-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/3536-11-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/3536-12-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/3536-33-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/3536-31-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/3536-34-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/3536-35-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/3536-18-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/3536-37-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/3536-36-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/3536-38-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/3536-39-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/3536-40-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/3536-61-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/3536-63-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/3536-64-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/3536-65-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/3536-67-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/3536-68-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/3536-71-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/3536-89-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/3580-113-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3580-158-0x0000000000850000-0x000000000190A000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e57b15e e57b100.exe File opened for modification C:\Windows\SYSTEM.INI e57b100.exe File created C:\Windows\e580b07 e57e399.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57b100.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57b342.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57e399.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57e3a9.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3536 e57b100.exe 3536 e57b100.exe 3536 e57b100.exe 3536 e57b100.exe 3580 e57e399.exe 3580 e57e399.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe Token: SeDebugPrivilege 3536 e57b100.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2596 wrote to memory of 2228 2596 rundll32.exe 82 PID 2596 wrote to memory of 2228 2596 rundll32.exe 82 PID 2596 wrote to memory of 2228 2596 rundll32.exe 82 PID 2228 wrote to memory of 3536 2228 rundll32.exe 83 PID 2228 wrote to memory of 3536 2228 rundll32.exe 83 PID 2228 wrote to memory of 3536 2228 rundll32.exe 83 PID 3536 wrote to memory of 780 3536 e57b100.exe 8 PID 3536 wrote to memory of 784 3536 e57b100.exe 9 PID 3536 wrote to memory of 336 3536 e57b100.exe 13 PID 3536 wrote to memory of 2556 3536 e57b100.exe 42 PID 3536 wrote to memory of 2584 3536 e57b100.exe 43 PID 3536 wrote to memory of 2672 3536 e57b100.exe 45 PID 3536 wrote to memory of 3540 3536 e57b100.exe 56 PID 3536 wrote to memory of 3668 3536 e57b100.exe 57 PID 3536 wrote to memory of 3848 3536 e57b100.exe 58 PID 3536 wrote to memory of 3948 3536 e57b100.exe 59 PID 3536 wrote to memory of 4012 3536 e57b100.exe 60 PID 3536 wrote to memory of 868 3536 e57b100.exe 61 PID 3536 wrote to memory of 3116 3536 e57b100.exe 62 PID 3536 wrote to memory of 1900 3536 e57b100.exe 75 PID 3536 wrote to memory of 4592 3536 e57b100.exe 76 PID 3536 wrote to memory of 2596 3536 e57b100.exe 81 PID 3536 wrote to memory of 2228 3536 e57b100.exe 82 PID 3536 wrote to memory of 2228 3536 e57b100.exe 82 PID 2228 wrote to memory of 1496 2228 rundll32.exe 84 PID 2228 wrote to memory of 1496 2228 rundll32.exe 84 PID 2228 wrote to memory of 1496 2228 rundll32.exe 84 PID 3536 wrote to memory of 780 3536 e57b100.exe 8 PID 3536 wrote to memory of 784 3536 e57b100.exe 9 PID 3536 wrote to memory of 336 3536 e57b100.exe 13 PID 3536 wrote to memory of 2556 3536 e57b100.exe 42 PID 3536 wrote to memory of 2584 3536 e57b100.exe 43 PID 3536 wrote to memory of 2672 3536 e57b100.exe 45 PID 3536 wrote to memory of 3540 3536 e57b100.exe 56 PID 3536 wrote to memory of 3668 3536 e57b100.exe 57 PID 3536 wrote to memory of 3848 3536 e57b100.exe 58 PID 3536 wrote to memory of 3948 3536 e57b100.exe 59 PID 3536 wrote to memory of 4012 3536 e57b100.exe 60 PID 3536 wrote to memory of 868 3536 e57b100.exe 61 PID 3536 wrote to memory of 3116 3536 e57b100.exe 62 PID 3536 wrote to memory of 1900 3536 e57b100.exe 75 PID 3536 wrote to memory of 4592 3536 e57b100.exe 76 PID 3536 wrote to memory of 2596 3536 e57b100.exe 81 PID 3536 wrote to memory of 1496 3536 e57b100.exe 84 PID 3536 wrote to memory of 1496 3536 e57b100.exe 84 PID 2228 wrote to memory of 3580 2228 rundll32.exe 87 PID 2228 wrote to memory of 3580 2228 rundll32.exe 87 PID 2228 wrote to memory of 3580 2228 rundll32.exe 87 PID 2228 wrote to memory of 404 2228 rundll32.exe 88 PID 2228 wrote to memory of 404 2228 rundll32.exe 88 PID 2228 wrote to memory of 404 2228 rundll32.exe 88 PID 3580 wrote to memory of 780 3580 e57e399.exe 8 PID 3580 wrote to memory of 784 3580 e57e399.exe 9 PID 3580 wrote to memory of 336 3580 e57e399.exe 13 PID 3580 wrote to memory of 2556 3580 e57e399.exe 42 PID 3580 wrote to memory of 2584 3580 e57e399.exe 43 PID 3580 wrote to memory of 2672 3580 e57e399.exe 45 PID 3580 wrote to memory of 3540 3580 e57e399.exe 56 PID 3580 wrote to memory of 3668 3580 e57e399.exe 57 PID 3580 wrote to memory of 3848 3580 e57e399.exe 58 PID 3580 wrote to memory of 3948 3580 e57e399.exe 59 PID 3580 wrote to memory of 4012 3580 e57e399.exe 60 PID 3580 wrote to memory of 868 3580 e57e399.exe 61 PID 3580 wrote to memory of 3116 3580 e57e399.exe 62 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57b100.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57e399.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:336
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2556
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2584
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2672
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3540
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\296262f4673d016f99bd7c126b7934b37469dd275b6dd44805356e081d2ebb74.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\296262f4673d016f99bd7c126b7934b37469dd275b6dd44805356e081d2ebb74.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\e57b100.exeC:\Users\Admin\AppData\Local\Temp\e57b100.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3536
-
-
C:\Users\Admin\AppData\Local\Temp\e57b342.exeC:\Users\Admin\AppData\Local\Temp\e57b342.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1496
-
-
C:\Users\Admin\AppData\Local\Temp\e57e399.exeC:\Users\Admin\AppData\Local\Temp\e57e399.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3580
-
-
C:\Users\Admin\AppData\Local\Temp\e57e3a9.exeC:\Users\Admin\AppData\Local\Temp\e57e3a9.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:404
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3668
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3848
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3948
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4012
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:868
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3116
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:1900
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4592
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD505487fd5eb2af30197379382f806cd14
SHA1b68d5bc7dad2d14884cc5fdb043fc4f1ba9f7134
SHA256a6c1985aa4016b5ad2c3e2b2f1ba2b23125d22ed480db30468a9527dc6cfe5b3
SHA512258e815fa700e22f1547509e37ae5a897d46efb10bc53720ab316db709b4d375675f706b65c9b2e498fef22a299848fe17b2a26e6486561610150b391197ec25
-
Filesize
257B
MD5dce7c6d987fb26fe1fabb3d250fd45a4
SHA1a105ac017ac1a1fcb93b638b8b773ddebe10392c
SHA2565ca2685f95e79f7b535f2b8d17ed02755a1b47bb3cfbd743ed8e9b8f471b1cec
SHA5126dcbc9f84282918914ae754d6c66fe413518912bf1e7fd7c18fe20864115c8658771091d5126eb5732decb34dbf20b42ec2b4625905729e5f0cf4a8cb5448297