Analysis
-
max time kernel
31s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-12-2024 14:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
802cff4a86c3af6af40b650e6b2918f2ad830baecd1e39daec21f21837651ef2.dll
Resource
win7-20240729-en
windows7-x64
17 signatures
120 seconds
General
-
Target
802cff4a86c3af6af40b650e6b2918f2ad830baecd1e39daec21f21837651ef2.dll
-
Size
120KB
-
MD5
aeaba6872c3a903358a0a222d8d47312
-
SHA1
316e8f1c642105fbb831cd34bba02a75dc160e04
-
SHA256
802cff4a86c3af6af40b650e6b2918f2ad830baecd1e39daec21f21837651ef2
-
SHA512
86a608f79a9aa1fd97982285c69b35013e3225eb5615a2ef1c46eae86d56f2b5fc46f9aa38dbc47a458045cecab7ceac0ec34a905427d01982f28f064ce314f9
-
SSDEEP
1536:qt5YR2qurWgG0/bvfxBc57LwjuvpLlnXI/pl/4JFEc7Lv8uNsoycPsoRvIl:G5Y73gG6bHc5/5vpLlnXI/pq0Mjeoji
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57cb10.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57cb10.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57cb10.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57f9d1.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57f9d1.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57f9d1.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57f9d1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57cb10.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57cb10.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57cb10.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57cb10.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57cb10.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57cb10.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57f9d1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57f9d1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57cb10.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57f9d1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57f9d1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57f9d1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57f9d1.exe -
Executes dropped EXE 4 IoCs
pid Process 3804 e57cb10.exe 1948 e57cc49.exe 1844 e57f9d1.exe 3820 e57f9f0.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57cb10.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57f9d1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57f9d1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57f9d1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57cb10.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57cb10.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57f9d1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57f9d1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57cb10.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57cb10.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57f9d1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57cb10.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57cb10.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57f9d1.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57cb10.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57f9d1.exe -
Enumerates connected drives 3 TTPs 11 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: e57cb10.exe File opened (read-only) \??\I: e57cb10.exe File opened (read-only) \??\J: e57cb10.exe File opened (read-only) \??\K: e57cb10.exe File opened (read-only) \??\H: e57f9d1.exe File opened (read-only) \??\E: e57cb10.exe File opened (read-only) \??\L: e57cb10.exe File opened (read-only) \??\E: e57f9d1.exe File opened (read-only) \??\G: e57f9d1.exe File opened (read-only) \??\I: e57f9d1.exe File opened (read-only) \??\G: e57cb10.exe -
resource yara_rule behavioral2/memory/3804-8-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/3804-9-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/3804-18-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/3804-12-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/3804-31-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/3804-19-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/3804-17-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/3804-11-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/3804-10-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/3804-34-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/3804-36-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/3804-37-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/3804-38-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/3804-43-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/3804-44-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/3804-57-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/3804-61-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/3804-62-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/3804-64-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/3804-65-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/3804-67-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/3804-68-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/3804-71-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral2/memory/1844-100-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/1844-101-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/1844-95-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/1844-151-0x0000000000780000-0x000000000183A000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e57cb6e e57cb10.exe File opened for modification C:\Windows\SYSTEM.INI e57cb10.exe File created C:\Windows\e58213f e57f9d1.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57cb10.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57cc49.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57f9d1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57f9f0.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3804 e57cb10.exe 3804 e57cb10.exe 3804 e57cb10.exe 3804 e57cb10.exe 1844 e57f9d1.exe 1844 e57f9d1.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe Token: SeDebugPrivilege 3804 e57cb10.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 844 wrote to memory of 708 844 rundll32.exe 85 PID 844 wrote to memory of 708 844 rundll32.exe 85 PID 844 wrote to memory of 708 844 rundll32.exe 85 PID 708 wrote to memory of 3804 708 rundll32.exe 86 PID 708 wrote to memory of 3804 708 rundll32.exe 86 PID 708 wrote to memory of 3804 708 rundll32.exe 86 PID 3804 wrote to memory of 764 3804 e57cb10.exe 8 PID 3804 wrote to memory of 772 3804 e57cb10.exe 9 PID 3804 wrote to memory of 332 3804 e57cb10.exe 13 PID 3804 wrote to memory of 2900 3804 e57cb10.exe 49 PID 3804 wrote to memory of 2992 3804 e57cb10.exe 51 PID 3804 wrote to memory of 2780 3804 e57cb10.exe 52 PID 3804 wrote to memory of 3452 3804 e57cb10.exe 55 PID 3804 wrote to memory of 3620 3804 e57cb10.exe 57 PID 3804 wrote to memory of 3824 3804 e57cb10.exe 58 PID 3804 wrote to memory of 3920 3804 e57cb10.exe 59 PID 3804 wrote to memory of 3980 3804 e57cb10.exe 60 PID 3804 wrote to memory of 4076 3804 e57cb10.exe 61 PID 3804 wrote to memory of 4216 3804 e57cb10.exe 62 PID 3804 wrote to memory of 2156 3804 e57cb10.exe 74 PID 3804 wrote to memory of 4072 3804 e57cb10.exe 76 PID 3804 wrote to memory of 5056 3804 e57cb10.exe 83 PID 3804 wrote to memory of 844 3804 e57cb10.exe 84 PID 3804 wrote to memory of 708 3804 e57cb10.exe 85 PID 3804 wrote to memory of 708 3804 e57cb10.exe 85 PID 708 wrote to memory of 1948 708 rundll32.exe 87 PID 708 wrote to memory of 1948 708 rundll32.exe 87 PID 708 wrote to memory of 1948 708 rundll32.exe 87 PID 3804 wrote to memory of 764 3804 e57cb10.exe 8 PID 3804 wrote to memory of 772 3804 e57cb10.exe 9 PID 3804 wrote to memory of 332 3804 e57cb10.exe 13 PID 3804 wrote to memory of 2900 3804 e57cb10.exe 49 PID 3804 wrote to memory of 2992 3804 e57cb10.exe 51 PID 3804 wrote to memory of 2780 3804 e57cb10.exe 52 PID 3804 wrote to memory of 3452 3804 e57cb10.exe 55 PID 3804 wrote to memory of 3620 3804 e57cb10.exe 57 PID 3804 wrote to memory of 3824 3804 e57cb10.exe 58 PID 3804 wrote to memory of 3920 3804 e57cb10.exe 59 PID 3804 wrote to memory of 3980 3804 e57cb10.exe 60 PID 3804 wrote to memory of 4076 3804 e57cb10.exe 61 PID 3804 wrote to memory of 4216 3804 e57cb10.exe 62 PID 3804 wrote to memory of 2156 3804 e57cb10.exe 74 PID 3804 wrote to memory of 4072 3804 e57cb10.exe 76 PID 3804 wrote to memory of 5056 3804 e57cb10.exe 83 PID 3804 wrote to memory of 844 3804 e57cb10.exe 84 PID 3804 wrote to memory of 1948 3804 e57cb10.exe 87 PID 3804 wrote to memory of 1948 3804 e57cb10.exe 87 PID 708 wrote to memory of 1844 708 rundll32.exe 88 PID 708 wrote to memory of 1844 708 rundll32.exe 88 PID 708 wrote to memory of 1844 708 rundll32.exe 88 PID 708 wrote to memory of 3820 708 rundll32.exe 89 PID 708 wrote to memory of 3820 708 rundll32.exe 89 PID 708 wrote to memory of 3820 708 rundll32.exe 89 PID 1844 wrote to memory of 764 1844 e57f9d1.exe 8 PID 1844 wrote to memory of 772 1844 e57f9d1.exe 9 PID 1844 wrote to memory of 332 1844 e57f9d1.exe 13 PID 1844 wrote to memory of 2900 1844 e57f9d1.exe 49 PID 1844 wrote to memory of 2992 1844 e57f9d1.exe 51 PID 1844 wrote to memory of 2780 1844 e57f9d1.exe 52 PID 1844 wrote to memory of 3452 1844 e57f9d1.exe 55 PID 1844 wrote to memory of 3620 1844 e57f9d1.exe 57 PID 1844 wrote to memory of 3824 1844 e57f9d1.exe 58 PID 1844 wrote to memory of 3920 1844 e57f9d1.exe 59 PID 1844 wrote to memory of 3980 1844 e57f9d1.exe 60 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57cb10.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57f9d1.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:764
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:772
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:332
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2900
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2992
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2780
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3452
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\802cff4a86c3af6af40b650e6b2918f2ad830baecd1e39daec21f21837651ef2.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\802cff4a86c3af6af40b650e6b2918f2ad830baecd1e39daec21f21837651ef2.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Users\Admin\AppData\Local\Temp\e57cb10.exeC:\Users\Admin\AppData\Local\Temp\e57cb10.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3804
-
-
C:\Users\Admin\AppData\Local\Temp\e57cc49.exeC:\Users\Admin\AppData\Local\Temp\e57cc49.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1948
-
-
C:\Users\Admin\AppData\Local\Temp\e57f9d1.exeC:\Users\Admin\AppData\Local\Temp\e57f9d1.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1844
-
-
C:\Users\Admin\AppData\Local\Temp\e57f9f0.exeC:\Users\Admin\AppData\Local\Temp\e57f9f0.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3820
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3620
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3824
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3920
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3980
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4076
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4216
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:2156
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4072
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:5056
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD59579b29cf01a7d2b3be3009210245f8a
SHA1e00dd55cd1fe78dc6a68351212b83c8018df0997
SHA256683f6bc5b76d99bd5fef1d6c9fcb20c3765948eaf6aed90409becbf3021a920a
SHA5125314527fcc56fbae2b60ba0ea705d3f8916de68a85b8ab32dc841e27cffffeee556e0878c8e074c3840ea065a4eadefbda1ab87bc55baa2d43191201f27c2855
-
Filesize
257B
MD577edca58e1d4d132ed698e4394d139c3
SHA1549d7165a9eab14333fff24cfdcefffac09751c7
SHA256847332900ff93e8adc4f7b8d311029c9fd5a77d4aa027ee00a2bde7475635677
SHA5124c2b5121a7dcc6dc35303e0e1312cc00b6e669595b1e947cc47fd70c325d4aec24ec29b0bcc6d6ad5b5f53534abdc8083fcb474dc027f902063f8fb854588048