Analysis
-
max time kernel
30s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
16-12-2024 22:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1dfada41083d3a3f8390120c7d402636c1983e3870cff2962e08b10aab5aaadc.dll
Resource
win7-20240708-en
windows7-x64
17 signatures
120 seconds
General
-
Target
1dfada41083d3a3f8390120c7d402636c1983e3870cff2962e08b10aab5aaadc.dll
-
Size
120KB
-
MD5
45aa6febc3a89e5271faf9fac8a0d591
-
SHA1
dcafd896c71e5441c23282c89db9219917840e29
-
SHA256
1dfada41083d3a3f8390120c7d402636c1983e3870cff2962e08b10aab5aaadc
-
SHA512
fd6e5eef12c1e483cd69ce2e541d5cb3be0764b564b72fcac71966a88e590559107b8f7e2b83b9ebdc1ac460df86afe2143445f33911fe5102eee6dc74f76fc8
-
SSDEEP
1536:2HNmz46IQB9nPQA6qCvFXVTLh+acQNyZYBS00hFpl5EsnSRItDioQ0jYSbRACpd:Q04JQBq1VnhIQBB0d59SRaioDjYSbqCD
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f764cf8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f764cf8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f764cf8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f764e8d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f7672c0.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f764e8d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f764e8d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f7672c0.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f7672c0.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f764cf8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f764e8d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7672c0.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f764cf8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f764e8d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f764e8d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f764e8d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7672c0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7672c0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7672c0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7672c0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f764cf8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f764cf8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f764cf8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f764e8d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f764e8d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f764e8d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7672c0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7672c0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f764cf8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f764cf8.exe -
Executes dropped EXE 3 IoCs
pid Process 2248 f764cf8.exe 2628 f764e8d.exe 584 f7672c0.exe -
Loads dropped DLL 6 IoCs
pid Process 3052 rundll32.exe 3052 rundll32.exe 3052 rundll32.exe 3052 rundll32.exe 3052 rundll32.exe 3052 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7672c0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f764cf8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f764cf8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f764e8d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7672c0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7672c0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7672c0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f764cf8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f764cf8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f764e8d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f764e8d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f764e8d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f764e8d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7672c0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7672c0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f764cf8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f764cf8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f764cf8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f764e8d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f764e8d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f7672c0.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f764cf8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f764e8d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7672c0.exe -
Enumerates connected drives 3 TTPs 12 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: f764cf8.exe File opened (read-only) \??\Q: f764cf8.exe File opened (read-only) \??\L: f764cf8.exe File opened (read-only) \??\N: f764cf8.exe File opened (read-only) \??\O: f764cf8.exe File opened (read-only) \??\I: f764cf8.exe File opened (read-only) \??\J: f764cf8.exe File opened (read-only) \??\K: f764cf8.exe File opened (read-only) \??\M: f764cf8.exe File opened (read-only) \??\E: f764cf8.exe File opened (read-only) \??\G: f764cf8.exe File opened (read-only) \??\H: f764cf8.exe -
resource yara_rule behavioral1/memory/2248-12-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2248-14-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2248-15-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2248-18-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2248-20-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2248-16-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2248-22-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2248-21-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2248-19-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2248-17-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2248-60-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2248-61-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2248-62-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2248-63-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2248-64-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2248-65-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2248-68-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2248-69-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2248-83-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2248-104-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2248-105-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2248-107-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2248-108-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2248-150-0x00000000006D0000-0x000000000178A000-memory.dmp upx behavioral1/memory/2628-166-0x00000000009A0000-0x0000000001A5A000-memory.dmp upx behavioral1/memory/2628-172-0x00000000009A0000-0x0000000001A5A000-memory.dmp upx behavioral1/memory/584-186-0x0000000000990000-0x0000000001A4A000-memory.dmp upx behavioral1/memory/584-210-0x0000000000990000-0x0000000001A4A000-memory.dmp upx -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\f764da3 f764cf8.exe File opened for modification C:\Windows\SYSTEM.INI f764cf8.exe File created C:\Windows\f769d1a f764e8d.exe File created C:\Windows\f769eee f7672c0.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f7672c0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f764cf8.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2248 f764cf8.exe 2248 f764cf8.exe 584 f7672c0.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeDebugPrivilege 2248 f764cf8.exe Token: SeDebugPrivilege 2248 f764cf8.exe Token: SeDebugPrivilege 2248 f764cf8.exe Token: SeDebugPrivilege 2248 f764cf8.exe Token: SeDebugPrivilege 2248 f764cf8.exe Token: SeDebugPrivilege 2248 f764cf8.exe Token: SeDebugPrivilege 2248 f764cf8.exe Token: SeDebugPrivilege 2248 f764cf8.exe Token: SeDebugPrivilege 2248 f764cf8.exe Token: SeDebugPrivilege 2248 f764cf8.exe Token: SeDebugPrivilege 2248 f764cf8.exe Token: SeDebugPrivilege 2248 f764cf8.exe Token: SeDebugPrivilege 2248 f764cf8.exe Token: SeDebugPrivilege 2248 f764cf8.exe Token: SeDebugPrivilege 2248 f764cf8.exe Token: SeDebugPrivilege 2248 f764cf8.exe Token: SeDebugPrivilege 2248 f764cf8.exe Token: SeDebugPrivilege 2248 f764cf8.exe Token: SeDebugPrivilege 2248 f764cf8.exe Token: SeDebugPrivilege 2248 f764cf8.exe Token: SeDebugPrivilege 2248 f764cf8.exe Token: SeDebugPrivilege 2248 f764cf8.exe Token: SeDebugPrivilege 2248 f764cf8.exe Token: SeDebugPrivilege 584 f7672c0.exe Token: SeDebugPrivilege 584 f7672c0.exe Token: SeDebugPrivilege 584 f7672c0.exe Token: SeDebugPrivilege 584 f7672c0.exe Token: SeDebugPrivilege 584 f7672c0.exe Token: SeDebugPrivilege 584 f7672c0.exe Token: SeDebugPrivilege 584 f7672c0.exe Token: SeDebugPrivilege 584 f7672c0.exe Token: SeDebugPrivilege 584 f7672c0.exe Token: SeDebugPrivilege 584 f7672c0.exe Token: SeDebugPrivilege 584 f7672c0.exe Token: SeDebugPrivilege 584 f7672c0.exe Token: SeDebugPrivilege 584 f7672c0.exe Token: SeDebugPrivilege 584 f7672c0.exe Token: SeDebugPrivilege 584 f7672c0.exe Token: SeDebugPrivilege 584 f7672c0.exe Token: SeDebugPrivilege 584 f7672c0.exe Token: SeDebugPrivilege 584 f7672c0.exe Token: SeDebugPrivilege 584 f7672c0.exe Token: SeDebugPrivilege 584 f7672c0.exe Token: SeDebugPrivilege 584 f7672c0.exe Token: SeDebugPrivilege 584 f7672c0.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2432 wrote to memory of 3052 2432 rundll32.exe 30 PID 2432 wrote to memory of 3052 2432 rundll32.exe 30 PID 2432 wrote to memory of 3052 2432 rundll32.exe 30 PID 2432 wrote to memory of 3052 2432 rundll32.exe 30 PID 2432 wrote to memory of 3052 2432 rundll32.exe 30 PID 2432 wrote to memory of 3052 2432 rundll32.exe 30 PID 2432 wrote to memory of 3052 2432 rundll32.exe 30 PID 3052 wrote to memory of 2248 3052 rundll32.exe 31 PID 3052 wrote to memory of 2248 3052 rundll32.exe 31 PID 3052 wrote to memory of 2248 3052 rundll32.exe 31 PID 3052 wrote to memory of 2248 3052 rundll32.exe 31 PID 2248 wrote to memory of 1108 2248 f764cf8.exe 19 PID 2248 wrote to memory of 1168 2248 f764cf8.exe 20 PID 2248 wrote to memory of 1204 2248 f764cf8.exe 21 PID 2248 wrote to memory of 1488 2248 f764cf8.exe 25 PID 2248 wrote to memory of 2432 2248 f764cf8.exe 29 PID 2248 wrote to memory of 3052 2248 f764cf8.exe 30 PID 2248 wrote to memory of 3052 2248 f764cf8.exe 30 PID 3052 wrote to memory of 2628 3052 rundll32.exe 32 PID 3052 wrote to memory of 2628 3052 rundll32.exe 32 PID 3052 wrote to memory of 2628 3052 rundll32.exe 32 PID 3052 wrote to memory of 2628 3052 rundll32.exe 32 PID 3052 wrote to memory of 584 3052 rundll32.exe 33 PID 3052 wrote to memory of 584 3052 rundll32.exe 33 PID 3052 wrote to memory of 584 3052 rundll32.exe 33 PID 3052 wrote to memory of 584 3052 rundll32.exe 33 PID 2248 wrote to memory of 1108 2248 f764cf8.exe 19 PID 2248 wrote to memory of 1168 2248 f764cf8.exe 20 PID 2248 wrote to memory of 1204 2248 f764cf8.exe 21 PID 2248 wrote to memory of 1488 2248 f764cf8.exe 25 PID 2248 wrote to memory of 2628 2248 f764cf8.exe 32 PID 2248 wrote to memory of 2628 2248 f764cf8.exe 32 PID 2248 wrote to memory of 584 2248 f764cf8.exe 33 PID 2248 wrote to memory of 584 2248 f764cf8.exe 33 PID 584 wrote to memory of 1108 584 f7672c0.exe 19 PID 584 wrote to memory of 1168 584 f7672c0.exe 20 PID 584 wrote to memory of 1204 584 f7672c0.exe 21 PID 584 wrote to memory of 1488 584 f7672c0.exe 25 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f764cf8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f764e8d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7672c0.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1108
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1168
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1dfada41083d3a3f8390120c7d402636c1983e3870cff2962e08b10aab5aaadc.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1dfada41083d3a3f8390120c7d402636c1983e3870cff2962e08b10aab5aaadc.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\f764cf8.exeC:\Users\Admin\AppData\Local\Temp\f764cf8.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2248
-
-
C:\Users\Admin\AppData\Local\Temp\f764e8d.exeC:\Users\Admin\AppData\Local\Temp\f764e8d.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System policy modification
PID:2628
-
-
C:\Users\Admin\AppData\Local\Temp\f7672c0.exeC:\Users\Admin\AppData\Local\Temp\f7672c0.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:584
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1488
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b360fa63134a63f9acfe046d2dfe10d9
SHA1b47a7f2ad61c79e454b55e39b0d7500aca753a17
SHA25603e0c6c4ca8a24f961477887763397045e67862e059f7494014aefc21891d40e
SHA512575673255d389fc6667f46931301925bf4bb3030d7a3f6da3d3e7d878f86bb496ad6706e20191a1daa2e177cacda9b677424327bd9d438c1ad109c4222064102
-
Filesize
257B
MD5fff842c79b5fdb1003518d49dfc50c8d
SHA1080f8f1c1c5e2a13037d8a4ce39241da31f0fdec
SHA256a5fc34e2839beb9b2e66cb958d1ed42d4633467545b6e6a000b9bea93ef95c9e
SHA51295ac0c202a64a3d4f351645c82fb1a5770064411cfb77e1957d81d13994fc30955816acd7dd33c4dd2fcfae9d1eef1a91864a1f90b1725e2d3f80813be0ef9af
-
Filesize
97KB
MD55e69ec71ef0e6197016c73c6ec9f3594
SHA15ed251d21228ac768911387915c55ebd0c8633b3
SHA256976ce05521da2b4bdfd59f001f7e7b65cb0521a3522067b12f93bc9eb43bb30f
SHA5125d033079d12dd302bb6987ecf7665bc67b30431e8545f9d2b6ee1edd104917560b965e8c633327b701baf3f5fe2aa2edff130de3dd81a4bfcaaa064f3fe593fd