Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
30s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16/12/2024, 22:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1dfada41083d3a3f8390120c7d402636c1983e3870cff2962e08b10aab5aaadc.dll
Resource
win7-20240708-en
windows7-x64
17 signatures
120 seconds
General
-
Target
1dfada41083d3a3f8390120c7d402636c1983e3870cff2962e08b10aab5aaadc.dll
-
Size
120KB
-
MD5
45aa6febc3a89e5271faf9fac8a0d591
-
SHA1
dcafd896c71e5441c23282c89db9219917840e29
-
SHA256
1dfada41083d3a3f8390120c7d402636c1983e3870cff2962e08b10aab5aaadc
-
SHA512
fd6e5eef12c1e483cd69ce2e541d5cb3be0764b564b72fcac71966a88e590559107b8f7e2b83b9ebdc1ac460df86afe2143445f33911fe5102eee6dc74f76fc8
-
SSDEEP
1536:2HNmz46IQB9nPQA6qCvFXVTLh+acQNyZYBS00hFpl5EsnSRItDioQ0jYSbRACpd:Q04JQBq1VnhIQBB0d59SRaioDjYSbqCD
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e5798d5.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e5798d5.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e5798d5.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57c14c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57c14c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57c14c.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5798d5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57c14c.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5798d5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5798d5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57c14c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57c14c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57c14c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57c14c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57c14c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57c14c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5798d5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5798d5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5798d5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5798d5.exe -
Executes dropped EXE 3 IoCs
pid Process 3532 e5798d5.exe 1960 e5799fe.exe 2996 e57c14c.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e5798d5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57c14c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5798d5.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57c14c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5798d5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5798d5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57c14c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5798d5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5798d5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57c14c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57c14c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57c14c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57c14c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5798d5.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5798d5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57c14c.exe -
Enumerates connected drives 3 TTPs 13 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: e5798d5.exe File opened (read-only) \??\K: e5798d5.exe File opened (read-only) \??\M: e5798d5.exe File opened (read-only) \??\E: e57c14c.exe File opened (read-only) \??\G: e57c14c.exe File opened (read-only) \??\G: e5798d5.exe File opened (read-only) \??\H: e5798d5.exe File opened (read-only) \??\J: e5798d5.exe File opened (read-only) \??\L: e5798d5.exe File opened (read-only) \??\H: e57c14c.exe File opened (read-only) \??\I: e57c14c.exe File opened (read-only) \??\J: e57c14c.exe File opened (read-only) \??\E: e5798d5.exe -
resource yara_rule behavioral2/memory/3532-6-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3532-9-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3532-11-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3532-10-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3532-13-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3532-8-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3532-12-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3532-30-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3532-35-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3532-26-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3532-36-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3532-37-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3532-38-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3532-39-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3532-40-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3532-41-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3532-58-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3532-59-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3532-61-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3532-62-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3532-64-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3532-66-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3532-69-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3532-70-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/3532-72-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2996-114-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx behavioral2/memory/2996-148-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e579913 e5798d5.exe File opened for modification C:\Windows\SYSTEM.INI e5798d5.exe File created C:\Windows\e57e927 e57c14c.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e5798d5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e5799fe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57c14c.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3532 e5798d5.exe 3532 e5798d5.exe 3532 e5798d5.exe 3532 e5798d5.exe 2996 e57c14c.exe 2996 e57c14c.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe Token: SeDebugPrivilege 3532 e5798d5.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4976 wrote to memory of 5076 4976 rundll32.exe 83 PID 4976 wrote to memory of 5076 4976 rundll32.exe 83 PID 4976 wrote to memory of 5076 4976 rundll32.exe 83 PID 5076 wrote to memory of 3532 5076 rundll32.exe 84 PID 5076 wrote to memory of 3532 5076 rundll32.exe 84 PID 5076 wrote to memory of 3532 5076 rundll32.exe 84 PID 3532 wrote to memory of 776 3532 e5798d5.exe 8 PID 3532 wrote to memory of 780 3532 e5798d5.exe 9 PID 3532 wrote to memory of 64 3532 e5798d5.exe 13 PID 3532 wrote to memory of 2684 3532 e5798d5.exe 44 PID 3532 wrote to memory of 2732 3532 e5798d5.exe 45 PID 3532 wrote to memory of 2980 3532 e5798d5.exe 51 PID 3532 wrote to memory of 3436 3532 e5798d5.exe 56 PID 3532 wrote to memory of 3564 3532 e5798d5.exe 57 PID 3532 wrote to memory of 3764 3532 e5798d5.exe 58 PID 3532 wrote to memory of 3852 3532 e5798d5.exe 59 PID 3532 wrote to memory of 3952 3532 e5798d5.exe 60 PID 3532 wrote to memory of 4036 3532 e5798d5.exe 61 PID 3532 wrote to memory of 4212 3532 e5798d5.exe 62 PID 3532 wrote to memory of 2168 3532 e5798d5.exe 71 PID 3532 wrote to memory of 4460 3532 e5798d5.exe 76 PID 3532 wrote to memory of 5088 3532 e5798d5.exe 77 PID 3532 wrote to memory of 4976 3532 e5798d5.exe 82 PID 3532 wrote to memory of 5076 3532 e5798d5.exe 83 PID 3532 wrote to memory of 5076 3532 e5798d5.exe 83 PID 5076 wrote to memory of 1960 5076 rundll32.exe 85 PID 5076 wrote to memory of 1960 5076 rundll32.exe 85 PID 5076 wrote to memory of 1960 5076 rundll32.exe 85 PID 5076 wrote to memory of 2996 5076 rundll32.exe 86 PID 5076 wrote to memory of 2996 5076 rundll32.exe 86 PID 5076 wrote to memory of 2996 5076 rundll32.exe 86 PID 3532 wrote to memory of 776 3532 e5798d5.exe 8 PID 3532 wrote to memory of 780 3532 e5798d5.exe 9 PID 3532 wrote to memory of 64 3532 e5798d5.exe 13 PID 3532 wrote to memory of 2684 3532 e5798d5.exe 44 PID 3532 wrote to memory of 2732 3532 e5798d5.exe 45 PID 3532 wrote to memory of 2980 3532 e5798d5.exe 51 PID 3532 wrote to memory of 3436 3532 e5798d5.exe 56 PID 3532 wrote to memory of 3564 3532 e5798d5.exe 57 PID 3532 wrote to memory of 3764 3532 e5798d5.exe 58 PID 3532 wrote to memory of 3852 3532 e5798d5.exe 59 PID 3532 wrote to memory of 3952 3532 e5798d5.exe 60 PID 3532 wrote to memory of 4036 3532 e5798d5.exe 61 PID 3532 wrote to memory of 4212 3532 e5798d5.exe 62 PID 3532 wrote to memory of 2168 3532 e5798d5.exe 71 PID 3532 wrote to memory of 4460 3532 e5798d5.exe 76 PID 3532 wrote to memory of 5088 3532 e5798d5.exe 77 PID 3532 wrote to memory of 1960 3532 e5798d5.exe 85 PID 3532 wrote to memory of 1960 3532 e5798d5.exe 85 PID 3532 wrote to memory of 2996 3532 e5798d5.exe 86 PID 3532 wrote to memory of 2996 3532 e5798d5.exe 86 PID 2996 wrote to memory of 776 2996 e57c14c.exe 8 PID 2996 wrote to memory of 780 2996 e57c14c.exe 9 PID 2996 wrote to memory of 64 2996 e57c14c.exe 13 PID 2996 wrote to memory of 2684 2996 e57c14c.exe 44 PID 2996 wrote to memory of 2732 2996 e57c14c.exe 45 PID 2996 wrote to memory of 2980 2996 e57c14c.exe 51 PID 2996 wrote to memory of 3436 2996 e57c14c.exe 56 PID 2996 wrote to memory of 3564 2996 e57c14c.exe 57 PID 2996 wrote to memory of 3764 2996 e57c14c.exe 58 PID 2996 wrote to memory of 3852 2996 e57c14c.exe 59 PID 2996 wrote to memory of 3952 2996 e57c14c.exe 60 PID 2996 wrote to memory of 4036 2996 e57c14c.exe 61 PID 2996 wrote to memory of 4212 2996 e57c14c.exe 62 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5798d5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57c14c.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:776
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:64
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2684
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2732
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2980
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3436
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1dfada41083d3a3f8390120c7d402636c1983e3870cff2962e08b10aab5aaadc.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1dfada41083d3a3f8390120c7d402636c1983e3870cff2962e08b10aab5aaadc.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\e5798d5.exeC:\Users\Admin\AppData\Local\Temp\e5798d5.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3532
-
-
C:\Users\Admin\AppData\Local\Temp\e5799fe.exeC:\Users\Admin\AppData\Local\Temp\e5799fe.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1960
-
-
C:\Users\Admin\AppData\Local\Temp\e57c14c.exeC:\Users\Admin\AppData\Local\Temp\e57c14c.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2996
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3564
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3764
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3852
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3952
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4036
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4212
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2168
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4460
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:5088
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD55e69ec71ef0e6197016c73c6ec9f3594
SHA15ed251d21228ac768911387915c55ebd0c8633b3
SHA256976ce05521da2b4bdfd59f001f7e7b65cb0521a3522067b12f93bc9eb43bb30f
SHA5125d033079d12dd302bb6987ecf7665bc67b30431e8545f9d2b6ee1edd104917560b965e8c633327b701baf3f5fe2aa2edff130de3dd81a4bfcaaa064f3fe593fd
-
Filesize
257B
MD502a65358a6f3bcfaae43f8617ca241f5
SHA1fa71e1f534ea71103e6db79c92e5e018fcc0cab2
SHA256c1eb90dad567d5417e842c578e5a8cb5c000a6a6d6fdf9c0f5517887c49607ec
SHA5128749c7c2dae89abbf8bcaebcb0fd4b75d15a6cb9a8a69864fa03e3cdc4922dab74ea93af4262aa228fdd535807696df61df46c4e6dd27dc5b6499590681c1984