Analysis
-
max time kernel
94s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
06/12/2024, 17:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5f8c94e042c754e3a312ee7c38aea8937edf0b9ec34e10f49bc5686232fd152d.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
120 seconds
General
-
Target
5f8c94e042c754e3a312ee7c38aea8937edf0b9ec34e10f49bc5686232fd152d.dll
-
Size
120KB
-
MD5
e1c5631f1ba92f549b17772d6a995b54
-
SHA1
caaa56ba62143458fc465d590359fd3b4ddb1067
-
SHA256
5f8c94e042c754e3a312ee7c38aea8937edf0b9ec34e10f49bc5686232fd152d
-
SHA512
1fd1bbfbbcb50c979a30ca69f1670c240ad4c7a242e43b9dd4412816cee7a8bdf2e455e3f09d8ee07e4575b0074131f78e0b4911869538180d7fc319b92394d0
-
SSDEEP
1536:28IrE5hfDx7LhMbveVkp09k7k8VY7BMiwwHQjTPdw836Zk4xUnR5LPVNXu:28V5RpLhAWINY7BfwwHQjTVwB5evt8
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e5796a2.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e5796a2.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e5796a2.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57cd91.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57cd91.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57cd91.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5796a2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57cd91.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57cd91.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57cd91.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5796a2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5796a2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5796a2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57cd91.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57cd91.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5796a2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5796a2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5796a2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57cd91.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57cd91.exe -
Executes dropped EXE 3 IoCs
pid Process 3988 e5796a2.exe 4320 e579ad8.exe 4756 e57cd91.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57cd91.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e5796a2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57cd91.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57cd91.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5796a2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5796a2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5796a2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5796a2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5796a2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57cd91.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57cd91.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57cd91.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5796a2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57cd91.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5796a2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57cd91.exe -
Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: e5796a2.exe File opened (read-only) \??\G: e5796a2.exe File opened (read-only) \??\H: e5796a2.exe File opened (read-only) \??\E: e57cd91.exe -
resource yara_rule behavioral2/memory/3988-6-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/3988-8-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/3988-9-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/3988-12-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/3988-11-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/3988-10-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/3988-20-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/3988-22-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/3988-21-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/3988-19-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/3988-18-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/3988-36-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/3988-37-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/3988-42-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/3988-51-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/3988-52-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/3988-54-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/3988-56-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/3988-57-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/3988-59-0x00000000007E0000-0x000000000189A000-memory.dmp upx behavioral2/memory/4756-82-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/4756-84-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/4756-90-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/4756-87-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/4756-89-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/4756-91-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/4756-88-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/4756-86-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/4756-85-0x0000000000820000-0x00000000018DA000-memory.dmp upx behavioral2/memory/4756-126-0x0000000000820000-0x00000000018DA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e57971f e5796a2.exe File opened for modification C:\Windows\SYSTEM.INI e5796a2.exe File created C:\Windows\e57f52d e57cd91.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e5796a2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e579ad8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57cd91.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3988 e5796a2.exe 3988 e5796a2.exe 3988 e5796a2.exe 3988 e5796a2.exe 4756 e57cd91.exe 4756 e57cd91.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe Token: SeDebugPrivilege 3988 e5796a2.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4436 wrote to memory of 1488 4436 rundll32.exe 83 PID 4436 wrote to memory of 1488 4436 rundll32.exe 83 PID 4436 wrote to memory of 1488 4436 rundll32.exe 83 PID 1488 wrote to memory of 3988 1488 rundll32.exe 84 PID 1488 wrote to memory of 3988 1488 rundll32.exe 84 PID 1488 wrote to memory of 3988 1488 rundll32.exe 84 PID 3988 wrote to memory of 788 3988 e5796a2.exe 9 PID 3988 wrote to memory of 780 3988 e5796a2.exe 10 PID 3988 wrote to memory of 64 3988 e5796a2.exe 13 PID 3988 wrote to memory of 2652 3988 e5796a2.exe 44 PID 3988 wrote to memory of 2724 3988 e5796a2.exe 47 PID 3988 wrote to memory of 3040 3988 e5796a2.exe 51 PID 3988 wrote to memory of 3432 3988 e5796a2.exe 56 PID 3988 wrote to memory of 3544 3988 e5796a2.exe 57 PID 3988 wrote to memory of 3748 3988 e5796a2.exe 58 PID 3988 wrote to memory of 3844 3988 e5796a2.exe 59 PID 3988 wrote to memory of 3908 3988 e5796a2.exe 60 PID 3988 wrote to memory of 3992 3988 e5796a2.exe 61 PID 3988 wrote to memory of 3112 3988 e5796a2.exe 62 PID 3988 wrote to memory of 2096 3988 e5796a2.exe 75 PID 3988 wrote to memory of 4088 3988 e5796a2.exe 76 PID 3988 wrote to memory of 3368 3988 e5796a2.exe 81 PID 3988 wrote to memory of 4436 3988 e5796a2.exe 82 PID 3988 wrote to memory of 1488 3988 e5796a2.exe 83 PID 3988 wrote to memory of 1488 3988 e5796a2.exe 83 PID 1488 wrote to memory of 4320 1488 rundll32.exe 85 PID 1488 wrote to memory of 4320 1488 rundll32.exe 85 PID 1488 wrote to memory of 4320 1488 rundll32.exe 85 PID 3988 wrote to memory of 788 3988 e5796a2.exe 9 PID 3988 wrote to memory of 780 3988 e5796a2.exe 10 PID 3988 wrote to memory of 64 3988 e5796a2.exe 13 PID 3988 wrote to memory of 2652 3988 e5796a2.exe 44 PID 3988 wrote to memory of 2724 3988 e5796a2.exe 47 PID 3988 wrote to memory of 3040 3988 e5796a2.exe 51 PID 3988 wrote to memory of 3432 3988 e5796a2.exe 56 PID 3988 wrote to memory of 3544 3988 e5796a2.exe 57 PID 3988 wrote to memory of 3748 3988 e5796a2.exe 58 PID 3988 wrote to memory of 3844 3988 e5796a2.exe 59 PID 3988 wrote to memory of 3908 3988 e5796a2.exe 60 PID 3988 wrote to memory of 3992 3988 e5796a2.exe 61 PID 3988 wrote to memory of 3112 3988 e5796a2.exe 62 PID 3988 wrote to memory of 2096 3988 e5796a2.exe 75 PID 3988 wrote to memory of 4088 3988 e5796a2.exe 76 PID 3988 wrote to memory of 3368 3988 e5796a2.exe 81 PID 3988 wrote to memory of 4436 3988 e5796a2.exe 82 PID 3988 wrote to memory of 4320 3988 e5796a2.exe 85 PID 3988 wrote to memory of 4320 3988 e5796a2.exe 85 PID 1488 wrote to memory of 4756 1488 rundll32.exe 86 PID 1488 wrote to memory of 4756 1488 rundll32.exe 86 PID 1488 wrote to memory of 4756 1488 rundll32.exe 86 PID 4756 wrote to memory of 788 4756 e57cd91.exe 9 PID 4756 wrote to memory of 780 4756 e57cd91.exe 10 PID 4756 wrote to memory of 64 4756 e57cd91.exe 13 PID 4756 wrote to memory of 2652 4756 e57cd91.exe 44 PID 4756 wrote to memory of 2724 4756 e57cd91.exe 47 PID 4756 wrote to memory of 3040 4756 e57cd91.exe 51 PID 4756 wrote to memory of 3432 4756 e57cd91.exe 56 PID 4756 wrote to memory of 3544 4756 e57cd91.exe 57 PID 4756 wrote to memory of 3748 4756 e57cd91.exe 58 PID 4756 wrote to memory of 3844 4756 e57cd91.exe 59 PID 4756 wrote to memory of 3908 4756 e57cd91.exe 60 PID 4756 wrote to memory of 3992 4756 e57cd91.exe 61 PID 4756 wrote to memory of 3112 4756 e57cd91.exe 62 PID 4756 wrote to memory of 2096 4756 e57cd91.exe 75 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5796a2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57cd91.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:64
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2652
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2724
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3040
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3432
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5f8c94e042c754e3a312ee7c38aea8937edf0b9ec34e10f49bc5686232fd152d.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5f8c94e042c754e3a312ee7c38aea8937edf0b9ec34e10f49bc5686232fd152d.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\e5796a2.exeC:\Users\Admin\AppData\Local\Temp\e5796a2.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3988
-
-
C:\Users\Admin\AppData\Local\Temp\e579ad8.exeC:\Users\Admin\AppData\Local\Temp\e579ad8.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4320
-
-
C:\Users\Admin\AppData\Local\Temp\e57cd91.exeC:\Users\Admin\AppData\Local\Temp\e57cd91.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4756
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3544
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3748
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3844
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3908
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3992
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3112
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:2096
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4088
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:3368
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD59fc0cd5a4f1c19bed7377e85cae10534
SHA1339ca153b5ae9f350ab647dbbe0c044d748c93f1
SHA256545f6fb262838c2a8def80a440199694e13b60b828651162d872dce9bd38d966
SHA51228bf5c6e11cf2a8ef7dd8da1d310feac8d5bc08ba84ea68312ea9f73b802e0441bbff3e2453516d380affcd561173d924b2336e09da6df7ca212a45662c78ae3
-
Filesize
257B
MD5d8f90e45dfe4f907b757eed41cfa7927
SHA184109d3fe499b569669f1969e7db1ba996fcec64
SHA256ff4f34ed4eeaac6cc5860ffebe87bd0e72b05590f9927fd21a7be85b65a14722
SHA512075742a43c1bd2bb4551f0101ea71f1cd7cb62f605d3042fb534a380efaecd9ec9a4bc40efac678b0c91641591d04ab89b5a3c3ae4e8f3fd6b2c2ec68903d79d