Analysis
-
max time kernel
96s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-12-2024 11:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe
Resource
win7-20240903-en
windows7-x64
14 signatures
150 seconds
General
-
Target
6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe
-
Size
1.3MB
-
MD5
caeee35421f46a295011732d3767bce7
-
SHA1
5e0602b65c60ad6af45241842416a5249fba7cf8
-
SHA256
6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab
-
SHA512
ac9dbbe336850a3b1d50e53787bbf878a61b9cb48907a77b31b86fa30534fd508dc12928912f6cd1d0e5265cdc40e1ad07d388a281cbe6367513929d1c90b27a
-
SSDEEP
12288:3rfnhw6hqlcy7PYAI4hEYJcdo7FUsdZAlIqfEFgXTXRTTArwo5m9KnN9fRDxYHp5:3r5w9FqXvoZzdClOFUUrt5ZN9peHxm4H
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe -
resource yara_rule behavioral2/memory/2352-3-0x0000000002590000-0x000000000364A000-memory.dmp upx behavioral2/memory/2352-6-0x0000000002590000-0x000000000364A000-memory.dmp upx behavioral2/memory/2352-7-0x0000000002590000-0x000000000364A000-memory.dmp upx behavioral2/memory/2352-21-0x0000000002590000-0x000000000364A000-memory.dmp upx behavioral2/memory/2352-15-0x0000000002590000-0x000000000364A000-memory.dmp upx behavioral2/memory/2352-4-0x0000000002590000-0x000000000364A000-memory.dmp upx behavioral2/memory/2352-5-0x0000000002590000-0x000000000364A000-memory.dmp upx behavioral2/memory/2352-1-0x0000000002590000-0x000000000364A000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\e57afd7 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe File opened for modification C:\Windows\SYSTEM.INI 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe Token: SeDebugPrivilege 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2352 wrote to memory of 784 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe 8 PID 2352 wrote to memory of 792 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe 9 PID 2352 wrote to memory of 380 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe 13 PID 2352 wrote to memory of 2768 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe 49 PID 2352 wrote to memory of 2824 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe 50 PID 2352 wrote to memory of 2972 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe 51 PID 2352 wrote to memory of 3472 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe 56 PID 2352 wrote to memory of 3592 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe 57 PID 2352 wrote to memory of 3764 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe 58 PID 2352 wrote to memory of 3852 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe 59 PID 2352 wrote to memory of 3920 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe 60 PID 2352 wrote to memory of 4004 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe 61 PID 2352 wrote to memory of 4124 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe 62 PID 2352 wrote to memory of 4392 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe 64 PID 2352 wrote to memory of 3132 2352 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe 75 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:380
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2768
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2824
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2972
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe"C:\Users\Admin\AppData\Local\Temp\6e8f35af9d6f8f562123624c3de35c607ab498798b010bfacc7d39d75b3adbab.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2352
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3592
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3764
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3852
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3920
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4004
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4124
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4392
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:3132
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Pre-OS Boot
1Bootkit
1