Analysis
-
max time kernel
27s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
07-12-2024 02:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6cc8e384759f88a56c7e678c903d29835818aa24a373e20b7200d46fb85edc58.dll
Resource
win7-20240708-en
windows7-x64
17 signatures
120 seconds
General
-
Target
6cc8e384759f88a56c7e678c903d29835818aa24a373e20b7200d46fb85edc58.dll
-
Size
120KB
-
MD5
c17f990d1d19cd16f2dbe46315f53571
-
SHA1
5bc328d99a6432e2085cb6f01aff4bbb9fc464c5
-
SHA256
6cc8e384759f88a56c7e678c903d29835818aa24a373e20b7200d46fb85edc58
-
SHA512
7250d4eb1467dbfb170dfd5de662268ecca1cd6b35726d6ce0d664b25071056526b314fa010e1619ebf8b07fb8653e068735143bc20be09e9ab08ba16c987dd1
-
SSDEEP
3072:4rb7pHapnLftKZxYp+wv2X+VXCsfemYY2S:2F6pn7gZ+pKknf3FF
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76d1ef.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76d1ef.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76b645.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76b7f9.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76b7f9.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76b7f9.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76d1ef.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76b645.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76b645.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76d1ef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b645.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b7f9.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76d1ef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76d1ef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b645.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b645.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b7f9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b7f9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76d1ef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b7f9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76d1ef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76d1ef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b645.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b645.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b645.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b7f9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b7f9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b645.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b7f9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76d1ef.exe -
Executes dropped EXE 3 IoCs
pid Process 2384 f76b645.exe 2820 f76b7f9.exe 2212 f76d1ef.exe -
Loads dropped DLL 6 IoCs
pid Process 2372 rundll32.exe 2372 rundll32.exe 2372 rundll32.exe 2372 rundll32.exe 2372 rundll32.exe 2372 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76d1ef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76d1ef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76d1ef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b645.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b645.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b645.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b7f9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b645.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b7f9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b7f9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76d1ef.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76d1ef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b7f9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76b7f9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76d1ef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76d1ef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b7f9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b645.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b645.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76b645.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b7f9.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b7f9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76d1ef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b645.exe -
Enumerates connected drives 3 TTPs 16 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: f76b645.exe File opened (read-only) \??\Q: f76b645.exe File opened (read-only) \??\R: f76b645.exe File opened (read-only) \??\S: f76b645.exe File opened (read-only) \??\J: f76b645.exe File opened (read-only) \??\K: f76b645.exe File opened (read-only) \??\E: f76b645.exe File opened (read-only) \??\G: f76b645.exe File opened (read-only) \??\P: f76b645.exe File opened (read-only) \??\M: f76b645.exe File opened (read-only) \??\N: f76b645.exe File opened (read-only) \??\L: f76b645.exe File opened (read-only) \??\T: f76b645.exe File opened (read-only) \??\E: f76d1ef.exe File opened (read-only) \??\H: f76b645.exe File opened (read-only) \??\I: f76b645.exe -
resource yara_rule behavioral1/memory/2384-15-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2384-19-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2384-22-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2384-20-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2384-24-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2384-25-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2384-21-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2384-18-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2384-17-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2384-23-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2384-59-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2384-60-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2384-61-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2384-62-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2384-63-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2384-65-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2384-66-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2384-83-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2384-84-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2384-86-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2384-87-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2384-106-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2384-108-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2384-154-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2820-184-0x0000000000980000-0x0000000001A3A000-memory.dmp upx -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI f76b645.exe File created C:\Windows\f770667 f76b7f9.exe File created C:\Windows\f77082b f76d1ef.exe File created C:\Windows\f76b6c1 f76b645.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76b645.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76b7f9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76d1ef.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2384 f76b645.exe 2384 f76b645.exe 2820 f76b7f9.exe 2212 f76d1ef.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 2384 f76b645.exe Token: SeDebugPrivilege 2384 f76b645.exe Token: SeDebugPrivilege 2384 f76b645.exe Token: SeDebugPrivilege 2384 f76b645.exe Token: SeDebugPrivilege 2384 f76b645.exe Token: SeDebugPrivilege 2384 f76b645.exe Token: SeDebugPrivilege 2384 f76b645.exe Token: SeDebugPrivilege 2384 f76b645.exe Token: SeDebugPrivilege 2384 f76b645.exe Token: SeDebugPrivilege 2384 f76b645.exe Token: SeDebugPrivilege 2384 f76b645.exe Token: SeDebugPrivilege 2384 f76b645.exe Token: SeDebugPrivilege 2384 f76b645.exe Token: SeDebugPrivilege 2384 f76b645.exe Token: SeDebugPrivilege 2384 f76b645.exe Token: SeDebugPrivilege 2384 f76b645.exe Token: SeDebugPrivilege 2384 f76b645.exe Token: SeDebugPrivilege 2384 f76b645.exe Token: SeDebugPrivilege 2384 f76b645.exe Token: SeDebugPrivilege 2384 f76b645.exe Token: SeDebugPrivilege 2384 f76b645.exe Token: SeDebugPrivilege 2384 f76b645.exe Token: SeDebugPrivilege 2384 f76b645.exe Token: SeDebugPrivilege 2384 f76b645.exe Token: SeDebugPrivilege 2212 f76d1ef.exe Token: SeDebugPrivilege 2212 f76d1ef.exe Token: SeDebugPrivilege 2212 f76d1ef.exe Token: SeDebugPrivilege 2212 f76d1ef.exe Token: SeDebugPrivilege 2212 f76d1ef.exe Token: SeDebugPrivilege 2212 f76d1ef.exe Token: SeDebugPrivilege 2212 f76d1ef.exe Token: SeDebugPrivilege 2212 f76d1ef.exe Token: SeDebugPrivilege 2212 f76d1ef.exe Token: SeDebugPrivilege 2212 f76d1ef.exe Token: SeDebugPrivilege 2212 f76d1ef.exe Token: SeDebugPrivilege 2212 f76d1ef.exe Token: SeDebugPrivilege 2212 f76d1ef.exe Token: SeDebugPrivilege 2212 f76d1ef.exe Token: SeDebugPrivilege 2212 f76d1ef.exe Token: SeDebugPrivilege 2212 f76d1ef.exe Token: SeDebugPrivilege 2212 f76d1ef.exe Token: SeDebugPrivilege 2212 f76d1ef.exe Token: SeDebugPrivilege 2212 f76d1ef.exe Token: SeDebugPrivilege 2212 f76d1ef.exe Token: SeDebugPrivilege 2212 f76d1ef.exe Token: SeDebugPrivilege 2212 f76d1ef.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 1244 wrote to memory of 2372 1244 rundll32.exe 30 PID 1244 wrote to memory of 2372 1244 rundll32.exe 30 PID 1244 wrote to memory of 2372 1244 rundll32.exe 30 PID 1244 wrote to memory of 2372 1244 rundll32.exe 30 PID 1244 wrote to memory of 2372 1244 rundll32.exe 30 PID 1244 wrote to memory of 2372 1244 rundll32.exe 30 PID 1244 wrote to memory of 2372 1244 rundll32.exe 30 PID 2372 wrote to memory of 2384 2372 rundll32.exe 31 PID 2372 wrote to memory of 2384 2372 rundll32.exe 31 PID 2372 wrote to memory of 2384 2372 rundll32.exe 31 PID 2372 wrote to memory of 2384 2372 rundll32.exe 31 PID 2384 wrote to memory of 1112 2384 f76b645.exe 19 PID 2384 wrote to memory of 1172 2384 f76b645.exe 20 PID 2384 wrote to memory of 1204 2384 f76b645.exe 21 PID 2384 wrote to memory of 284 2384 f76b645.exe 25 PID 2384 wrote to memory of 1244 2384 f76b645.exe 29 PID 2384 wrote to memory of 2372 2384 f76b645.exe 30 PID 2384 wrote to memory of 2372 2384 f76b645.exe 30 PID 2372 wrote to memory of 2820 2372 rundll32.exe 32 PID 2372 wrote to memory of 2820 2372 rundll32.exe 32 PID 2372 wrote to memory of 2820 2372 rundll32.exe 32 PID 2372 wrote to memory of 2820 2372 rundll32.exe 32 PID 2372 wrote to memory of 2212 2372 rundll32.exe 34 PID 2372 wrote to memory of 2212 2372 rundll32.exe 34 PID 2372 wrote to memory of 2212 2372 rundll32.exe 34 PID 2372 wrote to memory of 2212 2372 rundll32.exe 34 PID 2384 wrote to memory of 1112 2384 f76b645.exe 19 PID 2384 wrote to memory of 1172 2384 f76b645.exe 20 PID 2384 wrote to memory of 1204 2384 f76b645.exe 21 PID 2384 wrote to memory of 284 2384 f76b645.exe 25 PID 2384 wrote to memory of 2820 2384 f76b645.exe 32 PID 2384 wrote to memory of 2820 2384 f76b645.exe 32 PID 2384 wrote to memory of 2212 2384 f76b645.exe 34 PID 2384 wrote to memory of 2212 2384 f76b645.exe 34 PID 2212 wrote to memory of 1112 2212 f76d1ef.exe 19 PID 2212 wrote to memory of 1172 2212 f76d1ef.exe 20 PID 2212 wrote to memory of 1204 2212 f76d1ef.exe 21 PID 2212 wrote to memory of 284 2212 f76d1ef.exe 25 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b645.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b7f9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76d1ef.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1112
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1172
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6cc8e384759f88a56c7e678c903d29835818aa24a373e20b7200d46fb85edc58.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6cc8e384759f88a56c7e678c903d29835818aa24a373e20b7200d46fb85edc58.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\f76b645.exeC:\Users\Admin\AppData\Local\Temp\f76b645.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2384
-
-
C:\Users\Admin\AppData\Local\Temp\f76b7f9.exeC:\Users\Admin\AppData\Local\Temp\f76b7f9.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- System policy modification
PID:2820
-
-
C:\Users\Admin\AppData\Local\Temp\f76d1ef.exeC:\Users\Admin\AppData\Local\Temp\f76d1ef.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2212
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:284
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD5b618577ea219175417d03f2e55391042
SHA13afa5a82bc1fb235a139fca78d9f7acc2c9bfd21
SHA256f48ce72c1247dd9223cfcd2491bce1741fbf19dec8303e03b4e9f1905fde7d8e
SHA512626847defc32bcf8b361cb163d0f8c784f1db42ee407fc64154f9c46a016a9a5baa547cc3cea9719f2391be4b502cf6e616654d29248a1e296d7c17344269fc0
-
Filesize
97KB
MD513ef65b7edd20660fb9366144f8d93a0
SHA16682d5b2045ef75f643ba131d2f8da3a8fd3c202
SHA2560aae9d689eeda216e18fcf8d1beb9abe7e6a3d39895d14c584366701538c261d
SHA51215c8d9cae9e5232963d0df776418686581ea771e9f99912c2d9b50a5a4b18734bc642a4b688465bb310175fe5814c5ed153b53e3c52b2a550431167b3eafea89