Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
09-12-2024 03:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e069bfa3e09ad06aabbc6b759779004f6617925df8192dcf3e20a85f9fd67f2f.dll
Resource
win7-20240729-en
windows7-x64
17 signatures
150 seconds
General
-
Target
e069bfa3e09ad06aabbc6b759779004f6617925df8192dcf3e20a85f9fd67f2f.dll
-
Size
120KB
-
MD5
db76e3e707cbf4b4a48b72920287d912
-
SHA1
e8c9dec393821ea344e8d1f7d5fb75afe764aaf7
-
SHA256
e069bfa3e09ad06aabbc6b759779004f6617925df8192dcf3e20a85f9fd67f2f
-
SHA512
e6d826d2bc62882947ca32bf1835bf8d7f77bb5112295d4ffce52f8d83a14335f00bd02e912e0628f09b5ccbb120c75df31f60173f7fa8d1f9f4ba4b7562e6a2
-
SSDEEP
1536:1qbD03V9xQFXJo5SkkXmQlSUKcsA50T06pkpOYZD9DKylP74jlTodWBjW4w42S:G0MXyMZmrcB7SYvOSP74+4wJS
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76b2bc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76b442.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76b442.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76b2bc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76b2bc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76b442.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76d105.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76d105.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76d105.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b2bc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b442.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76d105.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b2bc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b2bc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b2bc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b2bc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b442.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76d105.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76d105.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b2bc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b442.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76d105.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76d105.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76d105.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b2bc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b442.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b442.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b442.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b442.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76d105.exe -
Executes dropped EXE 3 IoCs
pid Process 2528 f76b2bc.exe 2876 f76b442.exe 2736 f76d105.exe -
Loads dropped DLL 6 IoCs
pid Process 2916 rundll32.exe 2916 rundll32.exe 2916 rundll32.exe 2916 rundll32.exe 2916 rundll32.exe 2916 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b2bc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b2bc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b442.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76d105.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76d105.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76d105.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76d105.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b2bc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76b442.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76d105.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b2bc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b442.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b442.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b442.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76d105.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b2bc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b2bc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76b2bc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b442.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b442.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76d105.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b442.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76d105.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b2bc.exe -
Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: f76b2bc.exe File opened (read-only) \??\J: f76b2bc.exe File opened (read-only) \??\L: f76b2bc.exe File opened (read-only) \??\M: f76b2bc.exe File opened (read-only) \??\O: f76b2bc.exe File opened (read-only) \??\E: f76b2bc.exe File opened (read-only) \??\G: f76b2bc.exe File opened (read-only) \??\I: f76b2bc.exe File opened (read-only) \??\K: f76b2bc.exe File opened (read-only) \??\N: f76b2bc.exe -
resource yara_rule behavioral1/memory/2528-17-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2528-22-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2528-16-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2528-18-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2528-14-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2528-21-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2528-19-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2528-15-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2528-13-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2528-20-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2528-60-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2528-62-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2528-61-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2528-63-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2528-65-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2528-66-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2528-80-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2528-102-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2528-103-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2528-105-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2528-107-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2528-109-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2876-167-0x0000000000910000-0x00000000019CA000-memory.dmp upx behavioral1/memory/2528-143-0x0000000000620000-0x00000000016DA000-memory.dmp upx -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\f7702af f76b442.exe File created C:\Windows\f771fa1 f76d105.exe File created C:\Windows\f76b319 f76b2bc.exe File opened for modification C:\Windows\SYSTEM.INI f76b2bc.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76d105.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76b2bc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76b442.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2528 f76b2bc.exe 2528 f76b2bc.exe 2876 f76b442.exe 2736 f76d105.exe -
Suspicious use of AdjustPrivilegeToken 47 IoCs
description pid Process Token: SeDebugPrivilege 2528 f76b2bc.exe Token: SeDebugPrivilege 2528 f76b2bc.exe Token: SeDebugPrivilege 2528 f76b2bc.exe Token: SeDebugPrivilege 2528 f76b2bc.exe Token: SeDebugPrivilege 2528 f76b2bc.exe Token: SeDebugPrivilege 2528 f76b2bc.exe Token: SeDebugPrivilege 2528 f76b2bc.exe Token: SeDebugPrivilege 2528 f76b2bc.exe Token: SeDebugPrivilege 2528 f76b2bc.exe Token: SeDebugPrivilege 2528 f76b2bc.exe Token: SeDebugPrivilege 2528 f76b2bc.exe Token: SeDebugPrivilege 2528 f76b2bc.exe Token: SeDebugPrivilege 2528 f76b2bc.exe Token: SeDebugPrivilege 2528 f76b2bc.exe Token: SeDebugPrivilege 2528 f76b2bc.exe Token: SeDebugPrivilege 2528 f76b2bc.exe Token: SeDebugPrivilege 2528 f76b2bc.exe Token: SeDebugPrivilege 2528 f76b2bc.exe Token: SeDebugPrivilege 2528 f76b2bc.exe Token: SeDebugPrivilege 2528 f76b2bc.exe Token: SeDebugPrivilege 2528 f76b2bc.exe Token: SeDebugPrivilege 2528 f76b2bc.exe Token: SeDebugPrivilege 2528 f76b2bc.exe Token: SeDebugPrivilege 2528 f76b2bc.exe Token: SeDebugPrivilege 2876 f76b442.exe Token: SeDebugPrivilege 2736 f76d105.exe Token: SeDebugPrivilege 2736 f76d105.exe Token: SeDebugPrivilege 2736 f76d105.exe Token: SeDebugPrivilege 2736 f76d105.exe Token: SeDebugPrivilege 2736 f76d105.exe Token: SeDebugPrivilege 2736 f76d105.exe Token: SeDebugPrivilege 2736 f76d105.exe Token: SeDebugPrivilege 2736 f76d105.exe Token: SeDebugPrivilege 2736 f76d105.exe Token: SeDebugPrivilege 2736 f76d105.exe Token: SeDebugPrivilege 2736 f76d105.exe Token: SeDebugPrivilege 2736 f76d105.exe Token: SeDebugPrivilege 2736 f76d105.exe Token: SeDebugPrivilege 2736 f76d105.exe Token: SeDebugPrivilege 2736 f76d105.exe Token: SeDebugPrivilege 2736 f76d105.exe Token: SeDebugPrivilege 2736 f76d105.exe Token: SeDebugPrivilege 2736 f76d105.exe Token: SeDebugPrivilege 2736 f76d105.exe Token: SeDebugPrivilege 2736 f76d105.exe Token: SeDebugPrivilege 2736 f76d105.exe Token: SeDebugPrivilege 2736 f76d105.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2584 wrote to memory of 2916 2584 rundll32.exe 30 PID 2584 wrote to memory of 2916 2584 rundll32.exe 30 PID 2584 wrote to memory of 2916 2584 rundll32.exe 30 PID 2584 wrote to memory of 2916 2584 rundll32.exe 30 PID 2584 wrote to memory of 2916 2584 rundll32.exe 30 PID 2584 wrote to memory of 2916 2584 rundll32.exe 30 PID 2584 wrote to memory of 2916 2584 rundll32.exe 30 PID 2916 wrote to memory of 2528 2916 rundll32.exe 31 PID 2916 wrote to memory of 2528 2916 rundll32.exe 31 PID 2916 wrote to memory of 2528 2916 rundll32.exe 31 PID 2916 wrote to memory of 2528 2916 rundll32.exe 31 PID 2528 wrote to memory of 1076 2528 f76b2bc.exe 18 PID 2528 wrote to memory of 1168 2528 f76b2bc.exe 20 PID 2528 wrote to memory of 1208 2528 f76b2bc.exe 21 PID 2528 wrote to memory of 1800 2528 f76b2bc.exe 25 PID 2528 wrote to memory of 2584 2528 f76b2bc.exe 29 PID 2528 wrote to memory of 2916 2528 f76b2bc.exe 30 PID 2528 wrote to memory of 2916 2528 f76b2bc.exe 30 PID 2916 wrote to memory of 2876 2916 rundll32.exe 32 PID 2916 wrote to memory of 2876 2916 rundll32.exe 32 PID 2916 wrote to memory of 2876 2916 rundll32.exe 32 PID 2916 wrote to memory of 2876 2916 rundll32.exe 32 PID 2916 wrote to memory of 2736 2916 rundll32.exe 33 PID 2916 wrote to memory of 2736 2916 rundll32.exe 33 PID 2916 wrote to memory of 2736 2916 rundll32.exe 33 PID 2916 wrote to memory of 2736 2916 rundll32.exe 33 PID 2528 wrote to memory of 1076 2528 f76b2bc.exe 18 PID 2528 wrote to memory of 1168 2528 f76b2bc.exe 20 PID 2528 wrote to memory of 1208 2528 f76b2bc.exe 21 PID 2528 wrote to memory of 1800 2528 f76b2bc.exe 25 PID 2528 wrote to memory of 2876 2528 f76b2bc.exe 32 PID 2528 wrote to memory of 2876 2528 f76b2bc.exe 32 PID 2528 wrote to memory of 2736 2528 f76b2bc.exe 33 PID 2528 wrote to memory of 2736 2528 f76b2bc.exe 33 PID 2736 wrote to memory of 1076 2736 f76d105.exe 18 PID 2736 wrote to memory of 1168 2736 f76d105.exe 20 PID 2736 wrote to memory of 1208 2736 f76d105.exe 21 PID 2736 wrote to memory of 1800 2736 f76d105.exe 25 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b2bc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b442.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76d105.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1076
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1168
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1208
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e069bfa3e09ad06aabbc6b759779004f6617925df8192dcf3e20a85f9fd67f2f.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e069bfa3e09ad06aabbc6b759779004f6617925df8192dcf3e20a85f9fd67f2f.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\f76b2bc.exeC:\Users\Admin\AppData\Local\Temp\f76b2bc.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2528
-
-
C:\Users\Admin\AppData\Local\Temp\f76b442.exeC:\Users\Admin\AppData\Local\Temp\f76b442.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2876
-
-
C:\Users\Admin\AppData\Local\Temp\f76d105.exeC:\Users\Admin\AppData\Local\Temp\f76d105.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2736
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1800
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD5d8572d2c338ee676ea4e24023ecaf190
SHA1b1829cba55268b18ccfa5453a6c3ae30115e65a6
SHA256615913f8501645651948a56911a9e233955346f8677da608ea4496d29dffc3f6
SHA5120d432099819c861deba7d9f846c7e7dd2637558dfb4ce32c5b21ac94fb4e2eed0e0d39a06f12f4fbdc0fb0eb1a47ce448ae2cb872c23d21d13f0dd89c373ffe7
-
Filesize
97KB
MD509843bfb8c0bf2e94df911d2f9a2ea03
SHA1e123b84c3c12623e5fcc04bd6d1662182682ef2f
SHA25621a15683926844f68207fb81bbc8958ea6df3a2eb940224aadb910d07156e995
SHA5127557aecf28f136e04d97c7887254cbf26412ace242abcbbee02214b96f5493cc102910cbe2db3e5abb9caba9ae6da967cfda57a153b6c4f6038f2d5537a7754c