Analysis
-
max time kernel
93s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16-12-2024 11:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ecb25fc7ee55e3b992a414f10273a37703f93b75209612aa38e51214593274c4N.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
120 seconds
General
-
Target
ecb25fc7ee55e3b992a414f10273a37703f93b75209612aa38e51214593274c4N.dll
-
Size
120KB
-
MD5
0a4003302c5d1779496bb58c5f3600e0
-
SHA1
06210e11f0e4e62ca6876463fa4a6fa181e96e00
-
SHA256
ecb25fc7ee55e3b992a414f10273a37703f93b75209612aa38e51214593274c4
-
SHA512
7414f3566e23d376989ad8e567fd85240b79e7dd8935bd9a7c6ac08cc0796bab907f279cd480700abde5bfbcc80d59ab9b4659723ef2d25063d520ebfdc88d7b
-
SSDEEP
1536:LogSzUh2pJZipYlnx0abSyFN7Ot1ZXp1BZ314CZVXMFP/NgScb93bT11hC0RyDBm:3Szp7m4nxVlNqXfL14CxSwP1/XaBIB
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e576987.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e576987.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e576987.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e5784a1.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e5784a1.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e5784a1.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e576987.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5784a1.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e576987.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e576987.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5784a1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5784a1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5784a1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5784a1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5784a1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e576987.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e576987.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e576987.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e576987.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5784a1.exe -
Executes dropped EXE 3 IoCs
pid Process 4908 e576987.exe 3352 e576b3d.exe 2328 e5784a1.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e576987.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e576987.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e576987.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e576987.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5784a1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5784a1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e576987.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e576987.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5784a1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5784a1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e576987.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5784a1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e5784a1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5784a1.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e576987.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5784a1.exe -
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: e576987.exe File opened (read-only) \??\I: e576987.exe File opened (read-only) \??\J: e576987.exe File opened (read-only) \??\L: e576987.exe File opened (read-only) \??\N: e576987.exe File opened (read-only) \??\G: e576987.exe File opened (read-only) \??\M: e576987.exe File opened (read-only) \??\R: e576987.exe File opened (read-only) \??\S: e576987.exe File opened (read-only) \??\E: e576987.exe File opened (read-only) \??\K: e576987.exe File opened (read-only) \??\O: e576987.exe File opened (read-only) \??\P: e576987.exe File opened (read-only) \??\Q: e576987.exe -
resource yara_rule behavioral2/memory/4908-11-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/4908-8-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/4908-9-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/4908-10-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/4908-12-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/4908-28-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/4908-32-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/4908-35-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/4908-19-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/4908-13-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/4908-36-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/4908-37-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/4908-38-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/4908-39-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/4908-40-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/4908-42-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/4908-43-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/4908-52-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/4908-55-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/4908-57-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/4908-66-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/4908-67-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/4908-70-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/4908-72-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/4908-75-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/4908-76-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/4908-77-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/4908-79-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/4908-82-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/4908-84-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/4908-85-0x0000000000890000-0x000000000194A000-memory.dmp upx behavioral2/memory/2328-126-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx behavioral2/memory/2328-129-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe e576987.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e576987.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e576987.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e576987.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e576a14 e576987.exe File opened for modification C:\Windows\SYSTEM.INI e576987.exe File created C:\Windows\e57d31f e5784a1.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e5784a1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e576987.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e576b3d.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4908 e576987.exe 4908 e576987.exe 4908 e576987.exe 4908 e576987.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe Token: SeDebugPrivilege 4908 e576987.exe -
Suspicious use of WriteProcessMemory 49 IoCs
description pid Process procid_target PID 2888 wrote to memory of 4580 2888 rundll32.exe 82 PID 2888 wrote to memory of 4580 2888 rundll32.exe 82 PID 2888 wrote to memory of 4580 2888 rundll32.exe 82 PID 4580 wrote to memory of 4908 4580 rundll32.exe 83 PID 4580 wrote to memory of 4908 4580 rundll32.exe 83 PID 4580 wrote to memory of 4908 4580 rundll32.exe 83 PID 4908 wrote to memory of 768 4908 e576987.exe 8 PID 4908 wrote to memory of 772 4908 e576987.exe 9 PID 4908 wrote to memory of 1020 4908 e576987.exe 13 PID 4908 wrote to memory of 2920 4908 e576987.exe 49 PID 4908 wrote to memory of 2960 4908 e576987.exe 50 PID 4908 wrote to memory of 2644 4908 e576987.exe 52 PID 4908 wrote to memory of 3432 4908 e576987.exe 56 PID 4908 wrote to memory of 3576 4908 e576987.exe 57 PID 4908 wrote to memory of 3768 4908 e576987.exe 58 PID 4908 wrote to memory of 3864 4908 e576987.exe 59 PID 4908 wrote to memory of 3952 4908 e576987.exe 60 PID 4908 wrote to memory of 4036 4908 e576987.exe 61 PID 4908 wrote to memory of 3468 4908 e576987.exe 62 PID 4908 wrote to memory of 4508 4908 e576987.exe 74 PID 4908 wrote to memory of 4024 4908 e576987.exe 76 PID 4908 wrote to memory of 2888 4908 e576987.exe 81 PID 4908 wrote to memory of 4580 4908 e576987.exe 82 PID 4908 wrote to memory of 4580 4908 e576987.exe 82 PID 4580 wrote to memory of 3352 4580 rundll32.exe 84 PID 4580 wrote to memory of 3352 4580 rundll32.exe 84 PID 4580 wrote to memory of 3352 4580 rundll32.exe 84 PID 4580 wrote to memory of 2328 4580 rundll32.exe 85 PID 4580 wrote to memory of 2328 4580 rundll32.exe 85 PID 4580 wrote to memory of 2328 4580 rundll32.exe 85 PID 4908 wrote to memory of 768 4908 e576987.exe 8 PID 4908 wrote to memory of 772 4908 e576987.exe 9 PID 4908 wrote to memory of 1020 4908 e576987.exe 13 PID 4908 wrote to memory of 2920 4908 e576987.exe 49 PID 4908 wrote to memory of 2960 4908 e576987.exe 50 PID 4908 wrote to memory of 2644 4908 e576987.exe 52 PID 4908 wrote to memory of 3432 4908 e576987.exe 56 PID 4908 wrote to memory of 3576 4908 e576987.exe 57 PID 4908 wrote to memory of 3768 4908 e576987.exe 58 PID 4908 wrote to memory of 3864 4908 e576987.exe 59 PID 4908 wrote to memory of 3952 4908 e576987.exe 60 PID 4908 wrote to memory of 4036 4908 e576987.exe 61 PID 4908 wrote to memory of 3468 4908 e576987.exe 62 PID 4908 wrote to memory of 4508 4908 e576987.exe 74 PID 4908 wrote to memory of 4024 4908 e576987.exe 76 PID 4908 wrote to memory of 3352 4908 e576987.exe 84 PID 4908 wrote to memory of 3352 4908 e576987.exe 84 PID 4908 wrote to memory of 2328 4908 e576987.exe 85 PID 4908 wrote to memory of 2328 4908 e576987.exe 85 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e576987.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5784a1.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:768
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:772
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1020
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2920
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2960
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2644
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3432
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ecb25fc7ee55e3b992a414f10273a37703f93b75209612aa38e51214593274c4N.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ecb25fc7ee55e3b992a414f10273a37703f93b75209612aa38e51214593274c4N.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\e576987.exeC:\Users\Admin\AppData\Local\Temp\e576987.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4908
-
-
C:\Users\Admin\AppData\Local\Temp\e576b3d.exeC:\Users\Admin\AppData\Local\Temp\e576b3d.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3352
-
-
C:\Users\Admin\AppData\Local\Temp\e5784a1.exeC:\Users\Admin\AppData\Local\Temp\e5784a1.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- System policy modification
PID:2328
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3576
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3768
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3864
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3952
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4036
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3468
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4508
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4024
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD506ad69d30499f33dbf1df7790a9b21fb
SHA1c2ccf4af7d7c7bdb04b4d05bf93744cdd3a07c20
SHA25690a413c975eef082f2a4e6c35e546781fa7e3c642e98ee67b7f20575b701bc75
SHA5121a1aa192ae858863d1e7e918f1208ad700cd403ab04e6320381346f4a5fc9667a94c31e975f02fa73f4ad8885e1261663f0640c1a5bb5677e20a3619718cbcb0
-
Filesize
257B
MD51792a275389b0021718fc5db7a0c7dd8
SHA15b6f70eb0645d22e5e82a78e1b21f771bb8468fc
SHA256a42b26324e0f0b2c86675bd52fe26e6fd6ab8e43e98b874b21b284e5df2eb52c
SHA512a8e8771da1ef454a742b6e64b88ee147820524088880429fdf33697c793d0188867b95de511be8cb4da8a62c1efae88f134e6dd96c621f32902de5a353ffe667