Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
32s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
11/12/2024, 13:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6b4bcc5db6714bdfb28a06fa41ab262227ed3186daf60cd5984fd1b93bf69ce0.dll
Resource
win7-20240708-en
windows7-x64
17 signatures
150 seconds
General
-
Target
6b4bcc5db6714bdfb28a06fa41ab262227ed3186daf60cd5984fd1b93bf69ce0.dll
-
Size
120KB
-
MD5
e3f1c306d339483420499dfb38d6eb53
-
SHA1
f0e26be09a0fd80fc417c4d710f50b6749e0e300
-
SHA256
6b4bcc5db6714bdfb28a06fa41ab262227ed3186daf60cd5984fd1b93bf69ce0
-
SHA512
7c4fda6f92d0d73cca0fd356a330f50c2ea85425cb4554cb73df71efc949eb0aead639c488fd94b36ff37a514fb6ea55ec5533163557dd7aef4f8f58c7b32e23
-
SSDEEP
3072:DBfxRBG91cdIjeTA05D8+vTVLe9uXnvmF+SPR:lj8fOiekUNNe9aq+SPR
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76bb44.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f768e3b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f768e3b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f768ff0.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f768ff0.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f768e3b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f768ff0.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76bb44.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76bb44.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f768e3b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f768ff0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76bb44.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f768e3b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76bb44.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76bb44.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f768e3b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f768ff0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f768e3b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f768ff0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76bb44.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f768e3b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f768e3b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f768ff0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f768ff0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f768ff0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f768ff0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76bb44.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76bb44.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f768e3b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76bb44.exe -
Executes dropped EXE 3 IoCs
pid Process 2516 f768e3b.exe 2632 f768ff0.exe 1252 f76bb44.exe -
Loads dropped DLL 6 IoCs
pid Process 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f768e3b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f768ff0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f768ff0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76bb44.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76bb44.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f768e3b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f768e3b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f768e3b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f768ff0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f768ff0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f768ff0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76bb44.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76bb44.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76bb44.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f768ff0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f768ff0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76bb44.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76bb44.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f768e3b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f768e3b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f768e3b.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f768e3b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f768ff0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76bb44.exe -
Enumerates connected drives 3 TTPs 12 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: f76bb44.exe File opened (read-only) \??\E: f768e3b.exe File opened (read-only) \??\J: f768e3b.exe File opened (read-only) \??\K: f768e3b.exe File opened (read-only) \??\E: f76bb44.exe File opened (read-only) \??\G: f76bb44.exe File opened (read-only) \??\H: f76bb44.exe File opened (read-only) \??\G: f768e3b.exe File opened (read-only) \??\H: f768e3b.exe File opened (read-only) \??\I: f768e3b.exe File opened (read-only) \??\L: f768e3b.exe File opened (read-only) \??\I: f76bb44.exe -
resource yara_rule behavioral1/memory/2516-12-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2516-18-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2516-15-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2516-17-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2516-19-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2516-14-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2516-21-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2516-22-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2516-23-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2516-20-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2516-16-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2516-64-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2516-66-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2516-65-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2516-69-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2516-85-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2516-86-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2516-103-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2516-104-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2516-106-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2516-108-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2516-111-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2516-112-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2516-135-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2632-154-0x00000000009B0000-0x0000000001A6A000-memory.dmp upx behavioral1/memory/1252-168-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1252-220-0x0000000000520000-0x00000000015DA000-memory.dmp upx -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\f768ed7 f768e3b.exe File opened for modification C:\Windows\SYSTEM.INI f768e3b.exe File created C:\Windows\f76de5e f768ff0.exe File created C:\Windows\f76e6a7 f76bb44.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76bb44.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f768e3b.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2516 f768e3b.exe 2516 f768e3b.exe 1252 f76bb44.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 2516 f768e3b.exe Token: SeDebugPrivilege 2516 f768e3b.exe Token: SeDebugPrivilege 2516 f768e3b.exe Token: SeDebugPrivilege 2516 f768e3b.exe Token: SeDebugPrivilege 2516 f768e3b.exe Token: SeDebugPrivilege 2516 f768e3b.exe Token: SeDebugPrivilege 2516 f768e3b.exe Token: SeDebugPrivilege 2516 f768e3b.exe Token: SeDebugPrivilege 2516 f768e3b.exe Token: SeDebugPrivilege 2516 f768e3b.exe Token: SeDebugPrivilege 2516 f768e3b.exe Token: SeDebugPrivilege 2516 f768e3b.exe Token: SeDebugPrivilege 2516 f768e3b.exe Token: SeDebugPrivilege 2516 f768e3b.exe Token: SeDebugPrivilege 2516 f768e3b.exe Token: SeDebugPrivilege 2516 f768e3b.exe Token: SeDebugPrivilege 2516 f768e3b.exe Token: SeDebugPrivilege 2516 f768e3b.exe Token: SeDebugPrivilege 2516 f768e3b.exe Token: SeDebugPrivilege 2516 f768e3b.exe Token: SeDebugPrivilege 2516 f768e3b.exe Token: SeDebugPrivilege 2516 f768e3b.exe Token: SeDebugPrivilege 2516 f768e3b.exe Token: SeDebugPrivilege 1252 f76bb44.exe Token: SeDebugPrivilege 1252 f76bb44.exe Token: SeDebugPrivilege 1252 f76bb44.exe Token: SeDebugPrivilege 1252 f76bb44.exe Token: SeDebugPrivilege 1252 f76bb44.exe Token: SeDebugPrivilege 1252 f76bb44.exe Token: SeDebugPrivilege 1252 f76bb44.exe Token: SeDebugPrivilege 1252 f76bb44.exe Token: SeDebugPrivilege 1252 f76bb44.exe Token: SeDebugPrivilege 1252 f76bb44.exe Token: SeDebugPrivilege 1252 f76bb44.exe Token: SeDebugPrivilege 1252 f76bb44.exe Token: SeDebugPrivilege 1252 f76bb44.exe Token: SeDebugPrivilege 1252 f76bb44.exe Token: SeDebugPrivilege 1252 f76bb44.exe Token: SeDebugPrivilege 1252 f76bb44.exe Token: SeDebugPrivilege 1252 f76bb44.exe Token: SeDebugPrivilege 1252 f76bb44.exe Token: SeDebugPrivilege 1252 f76bb44.exe Token: SeDebugPrivilege 1252 f76bb44.exe Token: SeDebugPrivilege 1252 f76bb44.exe Token: SeDebugPrivilege 1252 f76bb44.exe Token: SeDebugPrivilege 1252 f76bb44.exe -
Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 2204 wrote to memory of 1708 2204 rundll32.exe 30 PID 2204 wrote to memory of 1708 2204 rundll32.exe 30 PID 2204 wrote to memory of 1708 2204 rundll32.exe 30 PID 2204 wrote to memory of 1708 2204 rundll32.exe 30 PID 2204 wrote to memory of 1708 2204 rundll32.exe 30 PID 2204 wrote to memory of 1708 2204 rundll32.exe 30 PID 2204 wrote to memory of 1708 2204 rundll32.exe 30 PID 1708 wrote to memory of 2516 1708 rundll32.exe 31 PID 1708 wrote to memory of 2516 1708 rundll32.exe 31 PID 1708 wrote to memory of 2516 1708 rundll32.exe 31 PID 1708 wrote to memory of 2516 1708 rundll32.exe 31 PID 2516 wrote to memory of 1128 2516 f768e3b.exe 19 PID 2516 wrote to memory of 1180 2516 f768e3b.exe 20 PID 2516 wrote to memory of 1216 2516 f768e3b.exe 21 PID 2516 wrote to memory of 1764 2516 f768e3b.exe 23 PID 2516 wrote to memory of 2204 2516 f768e3b.exe 29 PID 2516 wrote to memory of 1708 2516 f768e3b.exe 30 PID 2516 wrote to memory of 1708 2516 f768e3b.exe 30 PID 1708 wrote to memory of 2632 1708 rundll32.exe 32 PID 1708 wrote to memory of 2632 1708 rundll32.exe 32 PID 1708 wrote to memory of 2632 1708 rundll32.exe 32 PID 1708 wrote to memory of 2632 1708 rundll32.exe 32 PID 2516 wrote to memory of 1128 2516 f768e3b.exe 19 PID 2516 wrote to memory of 1180 2516 f768e3b.exe 20 PID 2516 wrote to memory of 1216 2516 f768e3b.exe 21 PID 2516 wrote to memory of 1764 2516 f768e3b.exe 23 PID 2516 wrote to memory of 2204 2516 f768e3b.exe 29 PID 2516 wrote to memory of 2632 2516 f768e3b.exe 32 PID 2516 wrote to memory of 2632 2516 f768e3b.exe 32 PID 1708 wrote to memory of 1252 1708 rundll32.exe 33 PID 1708 wrote to memory of 1252 1708 rundll32.exe 33 PID 1708 wrote to memory of 1252 1708 rundll32.exe 33 PID 1708 wrote to memory of 1252 1708 rundll32.exe 33 PID 1252 wrote to memory of 1128 1252 f76bb44.exe 19 PID 1252 wrote to memory of 1180 1252 f76bb44.exe 20 PID 1252 wrote to memory of 1216 1252 f76bb44.exe 21 PID 1252 wrote to memory of 1764 1252 f76bb44.exe 23 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f768e3b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f768ff0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76bb44.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1128
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1180
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1216
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6b4bcc5db6714bdfb28a06fa41ab262227ed3186daf60cd5984fd1b93bf69ce0.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6b4bcc5db6714bdfb28a06fa41ab262227ed3186daf60cd5984fd1b93bf69ce0.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\f768e3b.exeC:\Users\Admin\AppData\Local\Temp\f768e3b.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2516
-
-
C:\Users\Admin\AppData\Local\Temp\f768ff0.exeC:\Users\Admin\AppData\Local\Temp\f768ff0.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System policy modification
PID:2632
-
-
C:\Users\Admin\AppData\Local\Temp\f76bb44.exeC:\Users\Admin\AppData\Local\Temp\f76bb44.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1252
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1764
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD567b764669fda2241c110de6ef9f9244e
SHA1ae4a961edc8e89f96b0d1bda45c3aeeceba53f23
SHA2561bef050d64b64ac0268686ef561ee83227208196c0ca3703902eae15787f6c54
SHA51274c359fb558934264902b09ee302c9cb22e3f7bed6b15fb04bb933d0704951fd02261d155247e862ac0ef27c2c20c0f607d62bd7a2603008c87b91e84b73d655
-
Filesize
97KB
MD52e3eae26764b1c497b755c37911a5f3f
SHA1d456674790a0128a9f1a5b64e17b10a1e694442a
SHA25632319126961d3811a093cc85d5028e84d0c5bc92d4e94242eddf72f75cf0ccf2
SHA5125b0d9fa164b96d19f3895b4c6c63df9ced52fe585addea4dede97bfeb2df6ab2006993450ceb33590cdf075a2e6b1af1c20cb54d7f024ce4589c65d3896359b9