Analysis
-
max time kernel
95s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17-12-2024 00:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
08397413e81976768c03b63210ca8bf324715bb20ad821d04afdfc50c3adeb3d.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
120 seconds
General
-
Target
08397413e81976768c03b63210ca8bf324715bb20ad821d04afdfc50c3adeb3d.dll
-
Size
120KB
-
MD5
d317053302c55622f1ae96a872e69873
-
SHA1
f56a76cd3054619050f02edb95a02d7f7d3dbe9c
-
SHA256
08397413e81976768c03b63210ca8bf324715bb20ad821d04afdfc50c3adeb3d
-
SHA512
7b1700e4010090758e85c4733dcc4c0f30299df33c9914d15b95fc0e36bbfc9317edfeba481bf344de799936b583cde3073c9609a3284d8f86e64a9930948e23
-
SSDEEP
1536:Wx3JhohEf7DPl8wPrlKif5+4ZCB5KPJnMWQ6tNqgdzWRp1MkZjpqeE1fJYMw:Q5ZfPPl8MZKCZCyPJn1XfgpVWg
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e578637.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e578637.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e578637.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57a1ce.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57a1ce.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57a1ce.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578637.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57a1ce.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57a1ce.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57a1ce.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57a1ce.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57a1ce.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e578637.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e578637.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e578637.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e578637.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e578637.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e578637.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57a1ce.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57a1ce.exe -
Executes dropped EXE 4 IoCs
pid Process 2712 e578637.exe 2840 e578750.exe 228 e57a1ce.exe 3692 e57a1dd.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57a1ce.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57a1ce.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57a1ce.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e578637.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e578637.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e578637.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e578637.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e578637.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57a1ce.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57a1ce.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e578637.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e578637.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57a1ce.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57a1ce.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578637.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57a1ce.exe -
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: e578637.exe File opened (read-only) \??\G: e578637.exe File opened (read-only) \??\I: e578637.exe File opened (read-only) \??\J: e578637.exe File opened (read-only) \??\M: e578637.exe File opened (read-only) \??\H: e578637.exe File opened (read-only) \??\K: e578637.exe File opened (read-only) \??\Q: e578637.exe File opened (read-only) \??\R: e578637.exe File opened (read-only) \??\S: e578637.exe File opened (read-only) \??\E: e578637.exe File opened (read-only) \??\L: e578637.exe File opened (read-only) \??\N: e578637.exe File opened (read-only) \??\P: e578637.exe -
resource yara_rule behavioral2/memory/2712-8-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2712-11-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2712-10-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2712-9-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2712-13-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2712-15-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2712-12-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2712-23-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2712-14-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2712-31-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2712-37-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2712-38-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2712-39-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2712-41-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2712-40-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2712-43-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2712-44-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2712-56-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2712-59-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2712-60-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2712-74-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2712-76-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2712-79-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2712-81-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2712-83-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2712-85-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2712-87-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2712-90-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2712-92-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2712-96-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/228-126-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx behavioral2/memory/228-136-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7zG.exe e578637.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e578637.exe File opened for modification C:\Program Files\7-Zip\7z.exe e578637.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e578637.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e578676 e578637.exe File opened for modification C:\Windows\SYSTEM.INI e578637.exe File created C:\Windows\e57f03c e57a1ce.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e578637.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e578750.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57a1ce.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57a1dd.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2712 e578637.exe 2712 e578637.exe 2712 e578637.exe 2712 e578637.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe Token: SeDebugPrivilege 2712 e578637.exe -
Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 1828 wrote to memory of 1252 1828 rundll32.exe 82 PID 1828 wrote to memory of 1252 1828 rundll32.exe 82 PID 1828 wrote to memory of 1252 1828 rundll32.exe 82 PID 1252 wrote to memory of 2712 1252 rundll32.exe 83 PID 1252 wrote to memory of 2712 1252 rundll32.exe 83 PID 1252 wrote to memory of 2712 1252 rundll32.exe 83 PID 2712 wrote to memory of 764 2712 e578637.exe 8 PID 2712 wrote to memory of 768 2712 e578637.exe 9 PID 2712 wrote to memory of 376 2712 e578637.exe 13 PID 2712 wrote to memory of 2652 2712 e578637.exe 44 PID 2712 wrote to memory of 2700 2712 e578637.exe 45 PID 2712 wrote to memory of 2940 2712 e578637.exe 51 PID 2712 wrote to memory of 3416 2712 e578637.exe 56 PID 2712 wrote to memory of 3552 2712 e578637.exe 57 PID 2712 wrote to memory of 3772 2712 e578637.exe 58 PID 2712 wrote to memory of 3864 2712 e578637.exe 59 PID 2712 wrote to memory of 3928 2712 e578637.exe 60 PID 2712 wrote to memory of 4020 2712 e578637.exe 61 PID 2712 wrote to memory of 3492 2712 e578637.exe 62 PID 2712 wrote to memory of 2252 2712 e578637.exe 75 PID 2712 wrote to memory of 4444 2712 e578637.exe 76 PID 2712 wrote to memory of 1828 2712 e578637.exe 81 PID 2712 wrote to memory of 1252 2712 e578637.exe 82 PID 2712 wrote to memory of 1252 2712 e578637.exe 82 PID 1252 wrote to memory of 2840 1252 rundll32.exe 84 PID 1252 wrote to memory of 2840 1252 rundll32.exe 84 PID 1252 wrote to memory of 2840 1252 rundll32.exe 84 PID 1252 wrote to memory of 228 1252 rundll32.exe 85 PID 1252 wrote to memory of 228 1252 rundll32.exe 85 PID 1252 wrote to memory of 228 1252 rundll32.exe 85 PID 1252 wrote to memory of 3692 1252 rundll32.exe 86 PID 1252 wrote to memory of 3692 1252 rundll32.exe 86 PID 1252 wrote to memory of 3692 1252 rundll32.exe 86 PID 2712 wrote to memory of 764 2712 e578637.exe 8 PID 2712 wrote to memory of 768 2712 e578637.exe 9 PID 2712 wrote to memory of 376 2712 e578637.exe 13 PID 2712 wrote to memory of 2652 2712 e578637.exe 44 PID 2712 wrote to memory of 2700 2712 e578637.exe 45 PID 2712 wrote to memory of 2940 2712 e578637.exe 51 PID 2712 wrote to memory of 3416 2712 e578637.exe 56 PID 2712 wrote to memory of 3552 2712 e578637.exe 57 PID 2712 wrote to memory of 3772 2712 e578637.exe 58 PID 2712 wrote to memory of 3864 2712 e578637.exe 59 PID 2712 wrote to memory of 3928 2712 e578637.exe 60 PID 2712 wrote to memory of 4020 2712 e578637.exe 61 PID 2712 wrote to memory of 3492 2712 e578637.exe 62 PID 2712 wrote to memory of 2252 2712 e578637.exe 75 PID 2712 wrote to memory of 4444 2712 e578637.exe 76 PID 2712 wrote to memory of 2840 2712 e578637.exe 84 PID 2712 wrote to memory of 2840 2712 e578637.exe 84 PID 2712 wrote to memory of 228 2712 e578637.exe 85 PID 2712 wrote to memory of 228 2712 e578637.exe 85 PID 2712 wrote to memory of 3692 2712 e578637.exe 86 PID 2712 wrote to memory of 3692 2712 e578637.exe 86 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578637.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57a1ce.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:764
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:768
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:376
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2652
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2700
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2940
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3416
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\08397413e81976768c03b63210ca8bf324715bb20ad821d04afdfc50c3adeb3d.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\08397413e81976768c03b63210ca8bf324715bb20ad821d04afdfc50c3adeb3d.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\e578637.exeC:\Users\Admin\AppData\Local\Temp\e578637.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2712
-
-
C:\Users\Admin\AppData\Local\Temp\e578750.exeC:\Users\Admin\AppData\Local\Temp\e578750.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2840
-
-
C:\Users\Admin\AppData\Local\Temp\e57a1ce.exeC:\Users\Admin\AppData\Local\Temp\e57a1ce.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- System policy modification
PID:228
-
-
C:\Users\Admin\AppData\Local\Temp\e57a1dd.exeC:\Users\Admin\AppData\Local\Temp\e57a1dd.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3692
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3552
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3772
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3864
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3928
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4020
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3492
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:2252
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4444
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5982a7307358b46a3cfdf3e0bd4cbdc21
SHA1593f2c4a6127bdfcb183e60ca327b3e6a6716470
SHA2560ce404ca683b71242117321b6dd67e294dcffad38cdbc79ec0aafae9f5e9f1e0
SHA512a316a854cfcf71939459297869bb7638cc9b780820c804b84e94d0e5102f913d5e884de5bce311601a4a332cabfac2f1a80772771a861c7b3dc83d627eadadd9
-
Filesize
257B
MD52d44810b38840bf15f609d6233604305
SHA131a42bd80137eecf40685d00576b55f9863de0e6
SHA256139fd2b39a9bf48c7624530a40eb97416ecc933d737e992cc0c8fac2796d3bce
SHA5120190601217150a50261175aa304c90379896fbce946939c104955a551bbade0bd3e8c9f5cb4d12fc6997e82f761e6b97779cc30db87754d9822911653b8f8cc5