Analysis
-
max time kernel
30s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16-12-2024 17:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0540361d0dd18f167fc1eb8ae0eba8088eff04642d181c4c947e0ff3ead2c5d2N.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
120 seconds
General
-
Target
0540361d0dd18f167fc1eb8ae0eba8088eff04642d181c4c947e0ff3ead2c5d2N.dll
-
Size
120KB
-
MD5
4c5d70bc20dfdb2d3ddabba04583f640
-
SHA1
708cbc05e806ad4ed1791d12a09d0d0da61e6749
-
SHA256
0540361d0dd18f167fc1eb8ae0eba8088eff04642d181c4c947e0ff3ead2c5d2
-
SHA512
87d3f3df80ce1c28c6af7e1a843051d7b0f0a715beac45651c1173fe2e960239e5f085ee399fec4439911533525d97e49cf0582cc76037e2562c1dd9e9d88633
-
SSDEEP
3072:gR0wdlVz2escm9mYToPvI2aaAxxnO/Gec7qE0sj4L:gR0DB9mYTCvIVaAxxO+ecKsj0
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76e31e.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76e31e.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76c735.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76c735.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76c89c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76c89c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76c89c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76e31e.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76c735.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76c735.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76c89c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76e31e.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76c89c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76e31e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76c735.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76c89c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76c89c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76e31e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76e31e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76c735.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76c735.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76c89c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76c89c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76e31e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76c735.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76c735.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76c735.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76c89c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76e31e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76e31e.exe -
Executes dropped EXE 3 IoCs
pid Process 2808 f76c735.exe 2552 f76c89c.exe 2620 f76e31e.exe -
Loads dropped DLL 6 IoCs
pid Process 2628 rundll32.exe 2628 rundll32.exe 2628 rundll32.exe 2628 rundll32.exe 2628 rundll32.exe 2628 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76c735.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76c735.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76c89c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76c89c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76c89c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76c89c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76c89c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76c735.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76e31e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76e31e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76e31e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76e31e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76e31e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76e31e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76e31e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76c735.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76c735.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76c89c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76c735.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76c89c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76c735.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76c735.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76c89c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76e31e.exe -
Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: f76e31e.exe File opened (read-only) \??\H: f76c735.exe File opened (read-only) \??\I: f76c735.exe File opened (read-only) \??\K: f76c735.exe File opened (read-only) \??\N: f76c735.exe File opened (read-only) \??\O: f76c735.exe File opened (read-only) \??\G: f76c735.exe File opened (read-only) \??\J: f76c735.exe File opened (read-only) \??\P: f76c735.exe File opened (read-only) \??\R: f76c735.exe File opened (read-only) \??\E: f76e31e.exe File opened (read-only) \??\E: f76c735.exe File opened (read-only) \??\L: f76c735.exe File opened (read-only) \??\Q: f76c735.exe File opened (read-only) \??\T: f76c735.exe File opened (read-only) \??\M: f76c735.exe File opened (read-only) \??\S: f76c735.exe -
resource yara_rule behavioral1/memory/2808-11-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2808-15-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2808-14-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2808-18-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2808-17-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2808-20-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2808-21-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2808-19-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2808-16-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2808-13-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2808-58-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2808-59-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2808-60-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2808-61-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2808-62-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2808-64-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2808-65-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2808-83-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2808-84-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2808-87-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2808-106-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2808-108-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2808-109-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2552-172-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2808-151-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2620-193-0x0000000000930000-0x00000000019EA000-memory.dmp upx behavioral1/memory/2620-224-0x0000000000930000-0x00000000019EA000-memory.dmp upx -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\f76c774 f76c735.exe File opened for modification C:\Windows\SYSTEM.INI f76c735.exe File created C:\Windows\f77170a f76c89c.exe File created C:\Windows\f771851 f76e31e.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76c735.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76e31e.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2808 f76c735.exe 2808 f76c735.exe 2620 f76e31e.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeDebugPrivilege 2808 f76c735.exe Token: SeDebugPrivilege 2808 f76c735.exe Token: SeDebugPrivilege 2808 f76c735.exe Token: SeDebugPrivilege 2808 f76c735.exe Token: SeDebugPrivilege 2808 f76c735.exe Token: SeDebugPrivilege 2808 f76c735.exe Token: SeDebugPrivilege 2808 f76c735.exe Token: SeDebugPrivilege 2808 f76c735.exe Token: SeDebugPrivilege 2808 f76c735.exe Token: SeDebugPrivilege 2808 f76c735.exe Token: SeDebugPrivilege 2808 f76c735.exe Token: SeDebugPrivilege 2808 f76c735.exe Token: SeDebugPrivilege 2808 f76c735.exe Token: SeDebugPrivilege 2808 f76c735.exe Token: SeDebugPrivilege 2808 f76c735.exe Token: SeDebugPrivilege 2808 f76c735.exe Token: SeDebugPrivilege 2808 f76c735.exe Token: SeDebugPrivilege 2808 f76c735.exe Token: SeDebugPrivilege 2808 f76c735.exe Token: SeDebugPrivilege 2808 f76c735.exe Token: SeDebugPrivilege 2808 f76c735.exe Token: SeDebugPrivilege 2808 f76c735.exe Token: SeDebugPrivilege 2808 f76c735.exe Token: SeDebugPrivilege 2620 f76e31e.exe Token: SeDebugPrivilege 2620 f76e31e.exe Token: SeDebugPrivilege 2620 f76e31e.exe Token: SeDebugPrivilege 2620 f76e31e.exe Token: SeDebugPrivilege 2620 f76e31e.exe Token: SeDebugPrivilege 2620 f76e31e.exe Token: SeDebugPrivilege 2620 f76e31e.exe Token: SeDebugPrivilege 2620 f76e31e.exe Token: SeDebugPrivilege 2620 f76e31e.exe Token: SeDebugPrivilege 2620 f76e31e.exe Token: SeDebugPrivilege 2620 f76e31e.exe Token: SeDebugPrivilege 2620 f76e31e.exe Token: SeDebugPrivilege 2620 f76e31e.exe Token: SeDebugPrivilege 2620 f76e31e.exe Token: SeDebugPrivilege 2620 f76e31e.exe Token: SeDebugPrivilege 2620 f76e31e.exe Token: SeDebugPrivilege 2620 f76e31e.exe Token: SeDebugPrivilege 2620 f76e31e.exe Token: SeDebugPrivilege 2620 f76e31e.exe Token: SeDebugPrivilege 2620 f76e31e.exe Token: SeDebugPrivilege 2620 f76e31e.exe Token: SeDebugPrivilege 2620 f76e31e.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2208 wrote to memory of 2628 2208 rundll32.exe 30 PID 2208 wrote to memory of 2628 2208 rundll32.exe 30 PID 2208 wrote to memory of 2628 2208 rundll32.exe 30 PID 2208 wrote to memory of 2628 2208 rundll32.exe 30 PID 2208 wrote to memory of 2628 2208 rundll32.exe 30 PID 2208 wrote to memory of 2628 2208 rundll32.exe 30 PID 2208 wrote to memory of 2628 2208 rundll32.exe 30 PID 2628 wrote to memory of 2808 2628 rundll32.exe 31 PID 2628 wrote to memory of 2808 2628 rundll32.exe 31 PID 2628 wrote to memory of 2808 2628 rundll32.exe 31 PID 2628 wrote to memory of 2808 2628 rundll32.exe 31 PID 2808 wrote to memory of 1056 2808 f76c735.exe 17 PID 2808 wrote to memory of 1072 2808 f76c735.exe 18 PID 2808 wrote to memory of 1132 2808 f76c735.exe 20 PID 2808 wrote to memory of 1124 2808 f76c735.exe 23 PID 2808 wrote to memory of 2208 2808 f76c735.exe 29 PID 2808 wrote to memory of 2628 2808 f76c735.exe 30 PID 2808 wrote to memory of 2628 2808 f76c735.exe 30 PID 2628 wrote to memory of 2552 2628 rundll32.exe 32 PID 2628 wrote to memory of 2552 2628 rundll32.exe 32 PID 2628 wrote to memory of 2552 2628 rundll32.exe 32 PID 2628 wrote to memory of 2552 2628 rundll32.exe 32 PID 2628 wrote to memory of 2620 2628 rundll32.exe 34 PID 2628 wrote to memory of 2620 2628 rundll32.exe 34 PID 2628 wrote to memory of 2620 2628 rundll32.exe 34 PID 2628 wrote to memory of 2620 2628 rundll32.exe 34 PID 2808 wrote to memory of 1056 2808 f76c735.exe 17 PID 2808 wrote to memory of 1072 2808 f76c735.exe 18 PID 2808 wrote to memory of 1132 2808 f76c735.exe 20 PID 2808 wrote to memory of 1124 2808 f76c735.exe 23 PID 2808 wrote to memory of 2552 2808 f76c735.exe 32 PID 2808 wrote to memory of 2552 2808 f76c735.exe 32 PID 2808 wrote to memory of 2620 2808 f76c735.exe 34 PID 2808 wrote to memory of 2620 2808 f76c735.exe 34 PID 2620 wrote to memory of 1056 2620 f76e31e.exe 17 PID 2620 wrote to memory of 1072 2620 f76e31e.exe 18 PID 2620 wrote to memory of 1132 2620 f76e31e.exe 20 PID 2620 wrote to memory of 1124 2620 f76e31e.exe 23 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76e31e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76c735.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76c89c.exe
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1056
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1072
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1132
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0540361d0dd18f167fc1eb8ae0eba8088eff04642d181c4c947e0ff3ead2c5d2N.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0540361d0dd18f167fc1eb8ae0eba8088eff04642d181c4c947e0ff3ead2c5d2N.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\f76c735.exeC:\Users\Admin\AppData\Local\Temp\f76c735.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2808
-
-
C:\Users\Admin\AppData\Local\Temp\f76c89c.exeC:\Users\Admin\AppData\Local\Temp\f76c89c.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System policy modification
PID:2552
-
-
C:\Users\Admin\AppData\Local\Temp\f76e31e.exeC:\Users\Admin\AppData\Local\Temp\f76e31e.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2620
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1124
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD57c7a06c7032b8563c614207ac9c8a8f6
SHA1748d818ea76b39897cb709e89a2bbbbe23781302
SHA256676e4d2f43fa671b444f96583694d1e0853f355820b361eca3ea905fd03ea568
SHA51205422fef27628e613d89984992d925a77389b466bf15f927fa3fc85e5ecdcc6ff7b6a0362c6f0240ffdac396b688b0c753b57f08138b38566bb6a5bf7170e236
-
Filesize
257B
MD54c8e0931bde62542ced2105e3b374883
SHA19d2b3433d962134b2c46f5613ce529a421ac96b6
SHA256a2fdd0a8d503a71809cdf2a8037f0f1931431b606865dc9693bab6a1279f1cf2
SHA51222e47da6d2ef323f469604e57ba36f8b1cf3b560c4b4be70fbc6da3481254399f16af2ae32340037c5f645eb06d57307d52948921e1a34c736b5e1dcb0d00d33