Analysis
-
max time kernel
93s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16-12-2024 05:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5a2a08239255b4fb72978a36c942631b4a2b364b8942d173e29cc766ca8fc9e1N.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
120 seconds
General
-
Target
5a2a08239255b4fb72978a36c942631b4a2b364b8942d173e29cc766ca8fc9e1N.dll
-
Size
120KB
-
MD5
da51137d80cd735cb921143734f0c8f0
-
SHA1
5074659d49b5f8ff626b68dc8fdf5b6ccda810da
-
SHA256
5a2a08239255b4fb72978a36c942631b4a2b364b8942d173e29cc766ca8fc9e1
-
SHA512
94aa177726963665fd077921302700e41310ecae880fe0727a311298c1ae5a78a029fba8ea2a9ef6fc5ac5f8b046f111ee22fd8d7341b1cb6b863676cb0142f7
-
SSDEEP
3072:+dBN2V1GRinXMGSDDOLEG5Xa3kSrga/m:+diW8XMRP8EUXcDra
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e579b46.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e579b46.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e579971.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e579971.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e579971.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e579b46.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e579b46.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e579971.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e579971.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e579b46.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e579b46.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e579b46.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e579971.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e579971.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e579971.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e579971.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e579971.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e579b46.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e579b46.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e579b46.exe -
Executes dropped EXE 3 IoCs
pid Process 1532 e579971.exe 1852 e579b46.exe 348 e57b4b9.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e579971.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e579b46.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e579971.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e579b46.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e579971.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e579b46.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e579b46.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e579971.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e579971.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e579971.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e579b46.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e579b46.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e579b46.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e579971.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e579971.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e579b46.exe -
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: e579971.exe File opened (read-only) \??\I: e579971.exe File opened (read-only) \??\J: e579971.exe File opened (read-only) \??\N: e579971.exe File opened (read-only) \??\S: e579971.exe File opened (read-only) \??\H: e579971.exe File opened (read-only) \??\L: e579971.exe File opened (read-only) \??\Q: e579971.exe File opened (read-only) \??\G: e579971.exe File opened (read-only) \??\M: e579971.exe File opened (read-only) \??\K: e579971.exe File opened (read-only) \??\O: e579971.exe File opened (read-only) \??\P: e579971.exe File opened (read-only) \??\R: e579971.exe -
resource yara_rule behavioral2/memory/1532-15-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1532-10-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1532-13-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1532-11-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1532-9-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1532-8-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1532-21-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1532-20-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1532-14-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1532-29-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1532-36-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1532-37-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1532-38-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1532-39-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1532-40-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1532-42-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1532-43-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1532-52-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1532-55-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1532-56-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1532-66-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1532-68-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1532-71-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1532-73-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1532-75-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1532-82-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1532-84-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1532-87-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1532-89-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1532-91-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/1852-121-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx behavioral2/memory/1852-140-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Uninstall.exe e579971.exe File opened for modification C:\Program Files\7-Zip\7z.exe e579971.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e579971.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e579971.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e5799ee e579971.exe File opened for modification C:\Windows\SYSTEM.INI e579971.exe File created C:\Windows\e57ea9e e579b46.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e579971.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e579b46.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57b4b9.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1532 e579971.exe 1532 e579971.exe 1532 e579971.exe 1532 e579971.exe 1852 e579b46.exe 1852 e579b46.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe Token: SeDebugPrivilege 1532 e579971.exe -
Suspicious use of WriteProcessMemory 60 IoCs
description pid Process procid_target PID 1008 wrote to memory of 592 1008 rundll32.exe 82 PID 1008 wrote to memory of 592 1008 rundll32.exe 82 PID 1008 wrote to memory of 592 1008 rundll32.exe 82 PID 592 wrote to memory of 1532 592 rundll32.exe 83 PID 592 wrote to memory of 1532 592 rundll32.exe 83 PID 592 wrote to memory of 1532 592 rundll32.exe 83 PID 1532 wrote to memory of 804 1532 e579971.exe 9 PID 1532 wrote to memory of 812 1532 e579971.exe 10 PID 1532 wrote to memory of 376 1532 e579971.exe 13 PID 1532 wrote to memory of 2924 1532 e579971.exe 50 PID 1532 wrote to memory of 3028 1532 e579971.exe 51 PID 1532 wrote to memory of 2848 1532 e579971.exe 54 PID 1532 wrote to memory of 3432 1532 e579971.exe 56 PID 1532 wrote to memory of 3552 1532 e579971.exe 57 PID 1532 wrote to memory of 3728 1532 e579971.exe 58 PID 1532 wrote to memory of 3820 1532 e579971.exe 59 PID 1532 wrote to memory of 3920 1532 e579971.exe 60 PID 1532 wrote to memory of 3996 1532 e579971.exe 61 PID 1532 wrote to memory of 704 1532 e579971.exe 62 PID 1532 wrote to memory of 2312 1532 e579971.exe 74 PID 1532 wrote to memory of 4788 1532 e579971.exe 76 PID 1532 wrote to memory of 1008 1532 e579971.exe 81 PID 1532 wrote to memory of 592 1532 e579971.exe 82 PID 1532 wrote to memory of 592 1532 e579971.exe 82 PID 592 wrote to memory of 1852 592 rundll32.exe 84 PID 592 wrote to memory of 1852 592 rundll32.exe 84 PID 592 wrote to memory of 1852 592 rundll32.exe 84 PID 592 wrote to memory of 348 592 rundll32.exe 85 PID 592 wrote to memory of 348 592 rundll32.exe 85 PID 592 wrote to memory of 348 592 rundll32.exe 85 PID 1532 wrote to memory of 804 1532 e579971.exe 9 PID 1532 wrote to memory of 812 1532 e579971.exe 10 PID 1532 wrote to memory of 376 1532 e579971.exe 13 PID 1532 wrote to memory of 2924 1532 e579971.exe 50 PID 1532 wrote to memory of 3028 1532 e579971.exe 51 PID 1532 wrote to memory of 2848 1532 e579971.exe 54 PID 1532 wrote to memory of 3432 1532 e579971.exe 56 PID 1532 wrote to memory of 3552 1532 e579971.exe 57 PID 1532 wrote to memory of 3728 1532 e579971.exe 58 PID 1532 wrote to memory of 3820 1532 e579971.exe 59 PID 1532 wrote to memory of 3920 1532 e579971.exe 60 PID 1532 wrote to memory of 3996 1532 e579971.exe 61 PID 1532 wrote to memory of 704 1532 e579971.exe 62 PID 1532 wrote to memory of 2312 1532 e579971.exe 74 PID 1532 wrote to memory of 4788 1532 e579971.exe 76 PID 1532 wrote to memory of 1852 1532 e579971.exe 84 PID 1532 wrote to memory of 1852 1532 e579971.exe 84 PID 1532 wrote to memory of 348 1532 e579971.exe 85 PID 1532 wrote to memory of 348 1532 e579971.exe 85 PID 1852 wrote to memory of 804 1852 e579b46.exe 9 PID 1852 wrote to memory of 812 1852 e579b46.exe 10 PID 1852 wrote to memory of 376 1852 e579b46.exe 13 PID 1852 wrote to memory of 2924 1852 e579b46.exe 50 PID 1852 wrote to memory of 3028 1852 e579b46.exe 51 PID 1852 wrote to memory of 2848 1852 e579b46.exe 54 PID 1852 wrote to memory of 3432 1852 e579b46.exe 56 PID 1852 wrote to memory of 3552 1852 e579b46.exe 57 PID 1852 wrote to memory of 3728 1852 e579b46.exe 58 PID 1852 wrote to memory of 3820 1852 e579b46.exe 59 PID 1852 wrote to memory of 3920 1852 e579b46.exe 60 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e579971.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e579b46.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:804
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:812
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:376
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2924
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:3028
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2848
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3432
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5a2a08239255b4fb72978a36c942631b4a2b364b8942d173e29cc766ca8fc9e1N.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5a2a08239255b4fb72978a36c942631b4a2b364b8942d173e29cc766ca8fc9e1N.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:592 -
C:\Users\Admin\AppData\Local\Temp\e579971.exeC:\Users\Admin\AppData\Local\Temp\e579971.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1532
-
-
C:\Users\Admin\AppData\Local\Temp\e579b46.exeC:\Users\Admin\AppData\Local\Temp\e579b46.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1852
-
-
C:\Users\Admin\AppData\Local\Temp\e57b4b9.exeC:\Users\Admin\AppData\Local\Temp\e57b4b9.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:348
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3552
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3728
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3820
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3920
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3996
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:704
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:2312
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4788
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD52ee273ba01c636638050d3c417362e4f
SHA1c5a9a7e3887a3cd8e965fefdb9add371663a8c39
SHA256fb045142c434935580d78b615862ac54a52314f8f7b547b3ad9f6779ba742d7e
SHA512be1a98423d4152ed86db545bf3734c11230429d106e86ceeb069a431f464f5259b214108ed06f18751f7e32d55962ace8b0f850abf6c05bd629a56a55e2e5b85
-
Filesize
257B
MD5c87726c567f0fad79f4d685579c50b2f
SHA19713f6e042caba63d7851e475017c002629f041b
SHA2568127517377e93cf742daf9e996714fb735c6f8d81af5cdedc383ed98a29f8d82
SHA512b7584d6934b2ad47da282a3d2b84060078fe233ac6d73318123c8abff7fb2c89bcc08aeea1d1e61c1aee1cb40ad9645996900466f83ccec6585549fa4c3ba5d9