Analysis
-
max time kernel
27s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
06/12/2024, 17:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
941141369b0ea038852f7ac31dc3b01b702e2c593a5393d382136f60b8a74006.dll
Resource
win7-20241023-en
windows7-x64
17 signatures
150 seconds
General
-
Target
941141369b0ea038852f7ac31dc3b01b702e2c593a5393d382136f60b8a74006.dll
-
Size
120KB
-
MD5
0ed76b4ab049d3fe172ad37b6d1aa18f
-
SHA1
fa86fdc12ef524f17eb7ad8926215db3e722a7a7
-
SHA256
941141369b0ea038852f7ac31dc3b01b702e2c593a5393d382136f60b8a74006
-
SHA512
675a020b83fa1788173488d9d8d5133148273d62eaa4982476b7100a888bb32c8f0d8a7dda93946f04efbc5e56a268040bb8f1539c3888d3d5ee1aa072c45959
-
SSDEEP
1536:qUhl/TceF4CXr5AjAV8+1oTkWslyTkkT/4ckiILrUHNK7qiDdRjEoDQoho7uyZdJ:5l7NGq1oTIlX2Wj/UtMHp9Ewlsuh9Xe
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76c14c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76c14c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76c2d2.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76c2d2.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76dd64.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76dd64.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76dd64.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76c14c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76c2d2.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76c14c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76c2d2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76dd64.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76dd64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76dd64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76c2d2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76c2d2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76c14c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76dd64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76c2d2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76c2d2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76c2d2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76dd64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76dd64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76c14c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76c2d2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76c14c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76c14c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76dd64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76c14c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76c14c.exe -
Executes dropped EXE 3 IoCs
pid Process 2028 f76c14c.exe 2896 f76c2d2.exe 1648 f76dd64.exe -
Loads dropped DLL 6 IoCs
pid Process 2320 rundll32.exe 2320 rundll32.exe 2320 rundll32.exe 2320 rundll32.exe 2320 rundll32.exe 2320 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76c14c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76c14c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76c2d2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76c2d2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76c2d2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76c14c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76dd64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76dd64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76dd64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76c14c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76c14c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76c2d2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76c2d2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76dd64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76dd64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76dd64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76c14c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76c14c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76c2d2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76c2d2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76dd64.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76c14c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76c2d2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76dd64.exe -
Enumerates connected drives 3 TTPs 16 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: f76c14c.exe File opened (read-only) \??\L: f76c14c.exe File opened (read-only) \??\N: f76c14c.exe File opened (read-only) \??\O: f76c14c.exe File opened (read-only) \??\P: f76c14c.exe File opened (read-only) \??\E: f76dd64.exe File opened (read-only) \??\E: f76c14c.exe File opened (read-only) \??\G: f76c14c.exe File opened (read-only) \??\J: f76c14c.exe File opened (read-only) \??\I: f76c14c.exe File opened (read-only) \??\M: f76c14c.exe File opened (read-only) \??\R: f76c14c.exe File opened (read-only) \??\S: f76c14c.exe File opened (read-only) \??\T: f76c14c.exe File opened (read-only) \??\H: f76c14c.exe File opened (read-only) \??\Q: f76c14c.exe -
resource yara_rule behavioral1/memory/2028-11-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2028-17-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2028-14-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2028-20-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2028-19-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2028-21-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2028-13-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2028-18-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2028-16-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2028-15-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2028-61-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2028-62-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2028-63-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2028-64-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2028-65-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2028-67-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2028-68-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2028-85-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2028-86-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2028-88-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2028-107-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2896-205-0x0000000000910000-0x00000000019CA000-memory.dmp upx behavioral1/memory/2028-152-0x00000000005B0000-0x000000000166A000-memory.dmp upx -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\f771130 f76c2d2.exe File created C:\Windows\f771333 f76dd64.exe File created C:\Windows\f76c18b f76c14c.exe File opened for modification C:\Windows\SYSTEM.INI f76c14c.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76c2d2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76dd64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76c14c.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2028 f76c14c.exe 2028 f76c14c.exe 2896 f76c2d2.exe 1648 f76dd64.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 2028 f76c14c.exe Token: SeDebugPrivilege 2028 f76c14c.exe Token: SeDebugPrivilege 2028 f76c14c.exe Token: SeDebugPrivilege 2028 f76c14c.exe Token: SeDebugPrivilege 2028 f76c14c.exe Token: SeDebugPrivilege 2028 f76c14c.exe Token: SeDebugPrivilege 2028 f76c14c.exe Token: SeDebugPrivilege 2028 f76c14c.exe Token: SeDebugPrivilege 2028 f76c14c.exe Token: SeDebugPrivilege 2028 f76c14c.exe Token: SeDebugPrivilege 2028 f76c14c.exe Token: SeDebugPrivilege 2028 f76c14c.exe Token: SeDebugPrivilege 2028 f76c14c.exe Token: SeDebugPrivilege 2028 f76c14c.exe Token: SeDebugPrivilege 2028 f76c14c.exe Token: SeDebugPrivilege 2028 f76c14c.exe Token: SeDebugPrivilege 2028 f76c14c.exe Token: SeDebugPrivilege 2028 f76c14c.exe Token: SeDebugPrivilege 2028 f76c14c.exe Token: SeDebugPrivilege 2028 f76c14c.exe Token: SeDebugPrivilege 2028 f76c14c.exe Token: SeDebugPrivilege 2028 f76c14c.exe Token: SeDebugPrivilege 2028 f76c14c.exe Token: SeDebugPrivilege 2028 f76c14c.exe Token: SeDebugPrivilege 1648 f76dd64.exe Token: SeDebugPrivilege 1648 f76dd64.exe Token: SeDebugPrivilege 1648 f76dd64.exe Token: SeDebugPrivilege 1648 f76dd64.exe Token: SeDebugPrivilege 1648 f76dd64.exe Token: SeDebugPrivilege 1648 f76dd64.exe Token: SeDebugPrivilege 1648 f76dd64.exe Token: SeDebugPrivilege 1648 f76dd64.exe Token: SeDebugPrivilege 1648 f76dd64.exe Token: SeDebugPrivilege 1648 f76dd64.exe Token: SeDebugPrivilege 1648 f76dd64.exe Token: SeDebugPrivilege 1648 f76dd64.exe Token: SeDebugPrivilege 1648 f76dd64.exe Token: SeDebugPrivilege 1648 f76dd64.exe Token: SeDebugPrivilege 1648 f76dd64.exe Token: SeDebugPrivilege 1648 f76dd64.exe Token: SeDebugPrivilege 1648 f76dd64.exe Token: SeDebugPrivilege 1648 f76dd64.exe Token: SeDebugPrivilege 1648 f76dd64.exe Token: SeDebugPrivilege 1648 f76dd64.exe Token: SeDebugPrivilege 1648 f76dd64.exe Token: SeDebugPrivilege 1648 f76dd64.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2036 wrote to memory of 2320 2036 rundll32.exe 30 PID 2036 wrote to memory of 2320 2036 rundll32.exe 30 PID 2036 wrote to memory of 2320 2036 rundll32.exe 30 PID 2036 wrote to memory of 2320 2036 rundll32.exe 30 PID 2036 wrote to memory of 2320 2036 rundll32.exe 30 PID 2036 wrote to memory of 2320 2036 rundll32.exe 30 PID 2036 wrote to memory of 2320 2036 rundll32.exe 30 PID 2320 wrote to memory of 2028 2320 rundll32.exe 31 PID 2320 wrote to memory of 2028 2320 rundll32.exe 31 PID 2320 wrote to memory of 2028 2320 rundll32.exe 31 PID 2320 wrote to memory of 2028 2320 rundll32.exe 31 PID 2028 wrote to memory of 1092 2028 f76c14c.exe 19 PID 2028 wrote to memory of 1156 2028 f76c14c.exe 20 PID 2028 wrote to memory of 1184 2028 f76c14c.exe 21 PID 2028 wrote to memory of 1244 2028 f76c14c.exe 23 PID 2028 wrote to memory of 2036 2028 f76c14c.exe 29 PID 2028 wrote to memory of 2320 2028 f76c14c.exe 30 PID 2028 wrote to memory of 2320 2028 f76c14c.exe 30 PID 2320 wrote to memory of 2896 2320 rundll32.exe 32 PID 2320 wrote to memory of 2896 2320 rundll32.exe 32 PID 2320 wrote to memory of 2896 2320 rundll32.exe 32 PID 2320 wrote to memory of 2896 2320 rundll32.exe 32 PID 2320 wrote to memory of 1648 2320 rundll32.exe 34 PID 2320 wrote to memory of 1648 2320 rundll32.exe 34 PID 2320 wrote to memory of 1648 2320 rundll32.exe 34 PID 2320 wrote to memory of 1648 2320 rundll32.exe 34 PID 2028 wrote to memory of 1092 2028 f76c14c.exe 19 PID 2028 wrote to memory of 1156 2028 f76c14c.exe 20 PID 2028 wrote to memory of 1184 2028 f76c14c.exe 21 PID 2028 wrote to memory of 1244 2028 f76c14c.exe 23 PID 2028 wrote to memory of 2896 2028 f76c14c.exe 32 PID 2028 wrote to memory of 2896 2028 f76c14c.exe 32 PID 2028 wrote to memory of 1648 2028 f76c14c.exe 34 PID 2028 wrote to memory of 1648 2028 f76c14c.exe 34 PID 1648 wrote to memory of 1092 1648 f76dd64.exe 19 PID 1648 wrote to memory of 1156 1648 f76dd64.exe 20 PID 1648 wrote to memory of 1184 1648 f76dd64.exe 21 PID 1648 wrote to memory of 1244 1648 f76dd64.exe 23 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76c14c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76c2d2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76dd64.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1092
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1156
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1184
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\941141369b0ea038852f7ac31dc3b01b702e2c593a5393d382136f60b8a74006.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\941141369b0ea038852f7ac31dc3b01b702e2c593a5393d382136f60b8a74006.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\f76c14c.exeC:\Users\Admin\AppData\Local\Temp\f76c14c.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2028
-
-
C:\Users\Admin\AppData\Local\Temp\f76c2d2.exeC:\Users\Admin\AppData\Local\Temp\f76c2d2.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- System policy modification
PID:2896
-
-
C:\Users\Admin\AppData\Local\Temp\f76dd64.exeC:\Users\Admin\AppData\Local\Temp\f76dd64.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1648
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1244
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD53883035105b22df75eb729ce723edb04
SHA10f073daa9644494ad727ef395e596af01cb84379
SHA256189d64129a54cdd71c034d7ed80400f218bd7469d83565ebd738f772a0247d63
SHA512ed84f339d2807a23ca1e9fed010d9888206ea9c14e91623730ae47b60b3c745a59b44e9cbb39a7b6ab03013df779085c30ab624a637a53c3e98b608395f018ca
-
Filesize
257B
MD531240d3381007683795962e8dfce463d
SHA1b53b6943b79e3d469cb7250ec6167a12d804f1ab
SHA256d2bc0a64ba00e640ded70fa252cf82b7ed62b8e7e638dfeddbf7ab379cac65f0
SHA512f8318494c27685889b87885f2c7f8fc59543b6e3f67485cb53ac141fa9234b04f6eed484bd5f0afbd97c897da89e11e3c55c2bce742c4a88357c98d163a5f158