Analysis
-
max time kernel
96s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07-12-2024 10:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
554e51df77aac03c6855206c1fc59be472a7b7fb01d978b671def828556205a2N.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
120 seconds
General
-
Target
554e51df77aac03c6855206c1fc59be472a7b7fb01d978b671def828556205a2N.dll
-
Size
120KB
-
MD5
276d51898c915f96f3fb629416a89cb0
-
SHA1
62f7c9c06bd037e4f210697c1cff9f4a56805149
-
SHA256
554e51df77aac03c6855206c1fc59be472a7b7fb01d978b671def828556205a2
-
SHA512
aba56f58ed2d07fde536a1c038951f1bf2e795278d97c1601b709674ba68ef8e4a8c445f690ff2a50844a52ac84b949a97b814404f7cfed4f98aa1a2f643c4ba
-
SSDEEP
3072:Irpb10i9FjcF4QJ5JRrhvbdCndvXyi+TwoHAMnmPWj:exuwHeJRrhTlTHH5Nj
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57aece.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57aece.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57aece.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57b15e.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57b15e.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57b15e.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57aece.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57b15e.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57b15e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57b15e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57b15e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57b15e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57aece.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57aece.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57b15e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57aece.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57b15e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57aece.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57aece.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57aece.exe -
Executes dropped EXE 3 IoCs
pid Process 1516 e57aece.exe 3168 e57b15e.exe 3444 e57d06f.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57aece.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57aece.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57b15e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57b15e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57b15e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57aece.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57b15e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57b15e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57b15e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57aece.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57aece.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57aece.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57aece.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57b15e.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57b15e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57aece.exe -
Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: e57aece.exe File opened (read-only) \??\K: e57aece.exe File opened (read-only) \??\M: e57aece.exe File opened (read-only) \??\O: e57aece.exe File opened (read-only) \??\E: e57aece.exe File opened (read-only) \??\G: e57aece.exe File opened (read-only) \??\I: e57aece.exe File opened (read-only) \??\J: e57aece.exe File opened (read-only) \??\L: e57aece.exe File opened (read-only) \??\N: e57aece.exe -
resource yara_rule behavioral2/memory/1516-8-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1516-11-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1516-18-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1516-19-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1516-12-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1516-20-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1516-21-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1516-9-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1516-10-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1516-6-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1516-36-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1516-37-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1516-38-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1516-39-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1516-40-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1516-50-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1516-51-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1516-61-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1516-63-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1516-64-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1516-66-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1516-67-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1516-70-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1516-73-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1516-76-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/1516-78-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/3168-108-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx behavioral2/memory/3168-133-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe e57aece.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e57aece.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e57aece.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e57ffeb e57b15e.exe File created C:\Windows\e57af2c e57aece.exe File opened for modification C:\Windows\SYSTEM.INI e57aece.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57aece.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57b15e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57d06f.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1516 e57aece.exe 1516 e57aece.exe 1516 e57aece.exe 1516 e57aece.exe 3168 e57b15e.exe 3168 e57b15e.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe Token: SeDebugPrivilege 1516 e57aece.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4952 wrote to memory of 2168 4952 rundll32.exe 82 PID 4952 wrote to memory of 2168 4952 rundll32.exe 82 PID 4952 wrote to memory of 2168 4952 rundll32.exe 82 PID 2168 wrote to memory of 1516 2168 rundll32.exe 83 PID 2168 wrote to memory of 1516 2168 rundll32.exe 83 PID 2168 wrote to memory of 1516 2168 rundll32.exe 83 PID 1516 wrote to memory of 780 1516 e57aece.exe 9 PID 1516 wrote to memory of 788 1516 e57aece.exe 10 PID 1516 wrote to memory of 316 1516 e57aece.exe 13 PID 1516 wrote to memory of 2488 1516 e57aece.exe 42 PID 1516 wrote to memory of 2536 1516 e57aece.exe 43 PID 1516 wrote to memory of 2684 1516 e57aece.exe 46 PID 1516 wrote to memory of 3500 1516 e57aece.exe 56 PID 1516 wrote to memory of 3656 1516 e57aece.exe 57 PID 1516 wrote to memory of 3828 1516 e57aece.exe 58 PID 1516 wrote to memory of 3936 1516 e57aece.exe 59 PID 1516 wrote to memory of 4048 1516 e57aece.exe 60 PID 1516 wrote to memory of 1412 1516 e57aece.exe 61 PID 1516 wrote to memory of 4148 1516 e57aece.exe 62 PID 1516 wrote to memory of 4756 1516 e57aece.exe 75 PID 1516 wrote to memory of 860 1516 e57aece.exe 76 PID 1516 wrote to memory of 4952 1516 e57aece.exe 81 PID 1516 wrote to memory of 2168 1516 e57aece.exe 82 PID 1516 wrote to memory of 2168 1516 e57aece.exe 82 PID 2168 wrote to memory of 3168 2168 rundll32.exe 84 PID 2168 wrote to memory of 3168 2168 rundll32.exe 84 PID 2168 wrote to memory of 3168 2168 rundll32.exe 84 PID 2168 wrote to memory of 3444 2168 rundll32.exe 85 PID 2168 wrote to memory of 3444 2168 rundll32.exe 85 PID 2168 wrote to memory of 3444 2168 rundll32.exe 85 PID 1516 wrote to memory of 780 1516 e57aece.exe 9 PID 1516 wrote to memory of 788 1516 e57aece.exe 10 PID 1516 wrote to memory of 316 1516 e57aece.exe 13 PID 1516 wrote to memory of 2488 1516 e57aece.exe 42 PID 1516 wrote to memory of 2536 1516 e57aece.exe 43 PID 1516 wrote to memory of 2684 1516 e57aece.exe 46 PID 1516 wrote to memory of 3500 1516 e57aece.exe 56 PID 1516 wrote to memory of 3656 1516 e57aece.exe 57 PID 1516 wrote to memory of 3828 1516 e57aece.exe 58 PID 1516 wrote to memory of 3936 1516 e57aece.exe 59 PID 1516 wrote to memory of 4048 1516 e57aece.exe 60 PID 1516 wrote to memory of 1412 1516 e57aece.exe 61 PID 1516 wrote to memory of 4148 1516 e57aece.exe 62 PID 1516 wrote to memory of 4756 1516 e57aece.exe 75 PID 1516 wrote to memory of 860 1516 e57aece.exe 76 PID 1516 wrote to memory of 3168 1516 e57aece.exe 84 PID 1516 wrote to memory of 3168 1516 e57aece.exe 84 PID 1516 wrote to memory of 3444 1516 e57aece.exe 85 PID 1516 wrote to memory of 3444 1516 e57aece.exe 85 PID 3168 wrote to memory of 780 3168 e57b15e.exe 9 PID 3168 wrote to memory of 788 3168 e57b15e.exe 10 PID 3168 wrote to memory of 316 3168 e57b15e.exe 13 PID 3168 wrote to memory of 2488 3168 e57b15e.exe 42 PID 3168 wrote to memory of 2536 3168 e57b15e.exe 43 PID 3168 wrote to memory of 2684 3168 e57b15e.exe 46 PID 3168 wrote to memory of 3500 3168 e57b15e.exe 56 PID 3168 wrote to memory of 3656 3168 e57b15e.exe 57 PID 3168 wrote to memory of 3828 3168 e57b15e.exe 58 PID 3168 wrote to memory of 3936 3168 e57b15e.exe 59 PID 3168 wrote to memory of 4048 3168 e57b15e.exe 60 PID 3168 wrote to memory of 1412 3168 e57b15e.exe 61 PID 3168 wrote to memory of 4148 3168 e57b15e.exe 62 PID 3168 wrote to memory of 4756 3168 e57b15e.exe 75 PID 3168 wrote to memory of 860 3168 e57b15e.exe 76 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57aece.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57b15e.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:316
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2488
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2536
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2684
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3500
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\554e51df77aac03c6855206c1fc59be472a7b7fb01d978b671def828556205a2N.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\554e51df77aac03c6855206c1fc59be472a7b7fb01d978b671def828556205a2N.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\e57aece.exeC:\Users\Admin\AppData\Local\Temp\e57aece.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1516
-
-
C:\Users\Admin\AppData\Local\Temp\e57b15e.exeC:\Users\Admin\AppData\Local\Temp\e57b15e.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3168
-
-
C:\Users\Admin\AppData\Local\Temp\e57d06f.exeC:\Users\Admin\AppData\Local\Temp\e57d06f.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3444
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3656
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3828
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3936
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4048
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1412
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4148
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4756
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:860
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5991ff666df29a45fab4bce236f578a4f
SHA1129e1ec30f8ec407dc7bc8384ce1ad2b82e32a12
SHA256be956caf05228bc7ad65977e5155cb05c309a139324e02ec8a1d7cde7b7cf6d6
SHA512bf2bb2e13a79537b494c3c89fb9451b983c137663e610e2031f6f373d8691f2985c8ee0663e7d0885ab5a21f5cf7599a58184aa51f2a505899eb219513ccfc29
-
Filesize
257B
MD559ff47f9c6c30766ca52628300615263
SHA1a58cb525e95ea19dd602344dbd4a4b51a28d1a2b
SHA256736bb851a6012aef23a422f572b63843f4550e17ceb4e4f7509d887963e9cc50
SHA5127c1c9043a56b128feb86068e40b5b188250ffe85cb545f8c7cd23cb2bd847b54820a4eadc47a1270764ddd9e30f69398e1c4e8c54931e60f9c15006889fcc08c