Analysis
-
max time kernel
30s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17-12-2024 03:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5880ab2ee457bcf10ad3f4ea56319a05e06391975753e9d4e0be748fab6ee1c9N.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
120 seconds
General
-
Target
5880ab2ee457bcf10ad3f4ea56319a05e06391975753e9d4e0be748fab6ee1c9N.dll
-
Size
120KB
-
MD5
df5c0c149597da0c3f381f99477d9580
-
SHA1
fa49072965237ed6a285de689b7a36dbdfad3a3d
-
SHA256
5880ab2ee457bcf10ad3f4ea56319a05e06391975753e9d4e0be748fab6ee1c9
-
SHA512
b1ac261c1041cd1e8323090fc4c3d1eac7680ce09d0eb9fa188392fdc77a252f702fb7ead683ea0c37a6556421d2602b3c2dcc0b24e24a806ef055f3268517f0
-
SSDEEP
3072:bxrqZzLskmmOzCf1Pnn4khqb7yih1AHhjJGDx:bxrq316nxADG
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76cd7c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76cd7c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76cef3.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76cd7c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76cef3.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76cef3.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76ec33.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76ec33.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76ec33.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76cd7c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76cef3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76ec33.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76cd7c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76ec33.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76ec33.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76cef3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76cef3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76ec33.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76ec33.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76cd7c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76cd7c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76cd7c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76cef3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76cd7c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76ec33.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76ec33.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76cd7c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76cef3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76cef3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76cef3.exe -
Executes dropped EXE 3 IoCs
pid Process 2356 f76cd7c.exe 2956 f76cef3.exe 1600 f76ec33.exe -
Loads dropped DLL 6 IoCs
pid Process 2056 rundll32.exe 2056 rundll32.exe 2056 rundll32.exe 2056 rundll32.exe 2056 rundll32.exe 2056 rundll32.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76cd7c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76cef3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76cef3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76ec33.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76ec33.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76ec33.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76ec33.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76cd7c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76cd7c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76cd7c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76cef3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76ec33.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76cd7c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76cef3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76ec33.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76cd7c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76cef3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76cef3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76cef3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76ec33.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76cd7c.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76cd7c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76cef3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76ec33.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: f76ec33.exe File opened (read-only) \??\G: f76ec33.exe File opened (read-only) \??\O: f76cd7c.exe File opened (read-only) \??\P: f76cd7c.exe File opened (read-only) \??\N: f76cd7c.exe File opened (read-only) \??\R: f76cd7c.exe File opened (read-only) \??\L: f76cd7c.exe File opened (read-only) \??\E: f76cd7c.exe File opened (read-only) \??\H: f76cd7c.exe File opened (read-only) \??\J: f76cd7c.exe File opened (read-only) \??\K: f76cd7c.exe File opened (read-only) \??\M: f76cd7c.exe File opened (read-only) \??\Q: f76cd7c.exe File opened (read-only) \??\G: f76cd7c.exe File opened (read-only) \??\I: f76cd7c.exe -
resource yara_rule behavioral1/memory/2356-16-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2356-11-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2356-13-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2356-18-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2356-15-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2356-19-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2356-21-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2356-14-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2356-20-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2356-17-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2356-59-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2356-60-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2356-61-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2356-63-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2356-64-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2356-66-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2356-80-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2356-81-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2356-84-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2356-108-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2956-177-0x0000000000910000-0x00000000019CA000-memory.dmp upx behavioral1/memory/2356-154-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/1600-201-0x0000000000910000-0x00000000019CA000-memory.dmp upx behavioral1/memory/1600-229-0x0000000000910000-0x00000000019CA000-memory.dmp upx -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\f771f44 f76ec33.exe File created C:\Windows\f76cdca f76cd7c.exe File opened for modification C:\Windows\SYSTEM.INI f76cd7c.exe File created C:\Windows\f771d70 f76cef3.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76cd7c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76ec33.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2356 f76cd7c.exe 2356 f76cd7c.exe 1600 f76ec33.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 2356 f76cd7c.exe Token: SeDebugPrivilege 2356 f76cd7c.exe Token: SeDebugPrivilege 2356 f76cd7c.exe Token: SeDebugPrivilege 2356 f76cd7c.exe Token: SeDebugPrivilege 2356 f76cd7c.exe Token: SeDebugPrivilege 2356 f76cd7c.exe Token: SeDebugPrivilege 2356 f76cd7c.exe Token: SeDebugPrivilege 2356 f76cd7c.exe Token: SeDebugPrivilege 2356 f76cd7c.exe Token: SeDebugPrivilege 2356 f76cd7c.exe Token: SeDebugPrivilege 2356 f76cd7c.exe Token: SeDebugPrivilege 2356 f76cd7c.exe Token: SeDebugPrivilege 2356 f76cd7c.exe Token: SeDebugPrivilege 2356 f76cd7c.exe Token: SeDebugPrivilege 2356 f76cd7c.exe Token: SeDebugPrivilege 2356 f76cd7c.exe Token: SeDebugPrivilege 2356 f76cd7c.exe Token: SeDebugPrivilege 2356 f76cd7c.exe Token: SeDebugPrivilege 2356 f76cd7c.exe Token: SeDebugPrivilege 2356 f76cd7c.exe Token: SeDebugPrivilege 2356 f76cd7c.exe Token: SeDebugPrivilege 2356 f76cd7c.exe Token: SeDebugPrivilege 2356 f76cd7c.exe Token: SeDebugPrivilege 2356 f76cd7c.exe Token: SeDebugPrivilege 1600 f76ec33.exe Token: SeDebugPrivilege 1600 f76ec33.exe Token: SeDebugPrivilege 1600 f76ec33.exe Token: SeDebugPrivilege 1600 f76ec33.exe Token: SeDebugPrivilege 1600 f76ec33.exe Token: SeDebugPrivilege 1600 f76ec33.exe Token: SeDebugPrivilege 1600 f76ec33.exe Token: SeDebugPrivilege 1600 f76ec33.exe Token: SeDebugPrivilege 1600 f76ec33.exe Token: SeDebugPrivilege 1600 f76ec33.exe Token: SeDebugPrivilege 1600 f76ec33.exe Token: SeDebugPrivilege 1600 f76ec33.exe Token: SeDebugPrivilege 1600 f76ec33.exe Token: SeDebugPrivilege 1600 f76ec33.exe Token: SeDebugPrivilege 1600 f76ec33.exe Token: SeDebugPrivilege 1600 f76ec33.exe Token: SeDebugPrivilege 1600 f76ec33.exe Token: SeDebugPrivilege 1600 f76ec33.exe Token: SeDebugPrivilege 1600 f76ec33.exe Token: SeDebugPrivilege 1600 f76ec33.exe Token: SeDebugPrivilege 1600 f76ec33.exe Token: SeDebugPrivilege 1600 f76ec33.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2432 wrote to memory of 2056 2432 rundll32.exe 30 PID 2432 wrote to memory of 2056 2432 rundll32.exe 30 PID 2432 wrote to memory of 2056 2432 rundll32.exe 30 PID 2432 wrote to memory of 2056 2432 rundll32.exe 30 PID 2432 wrote to memory of 2056 2432 rundll32.exe 30 PID 2432 wrote to memory of 2056 2432 rundll32.exe 30 PID 2432 wrote to memory of 2056 2432 rundll32.exe 30 PID 2056 wrote to memory of 2356 2056 rundll32.exe 31 PID 2056 wrote to memory of 2356 2056 rundll32.exe 31 PID 2056 wrote to memory of 2356 2056 rundll32.exe 31 PID 2056 wrote to memory of 2356 2056 rundll32.exe 31 PID 2356 wrote to memory of 1112 2356 f76cd7c.exe 19 PID 2356 wrote to memory of 1180 2356 f76cd7c.exe 20 PID 2356 wrote to memory of 1236 2356 f76cd7c.exe 21 PID 2356 wrote to memory of 1060 2356 f76cd7c.exe 23 PID 2356 wrote to memory of 2432 2356 f76cd7c.exe 29 PID 2356 wrote to memory of 2056 2356 f76cd7c.exe 30 PID 2356 wrote to memory of 2056 2356 f76cd7c.exe 30 PID 2056 wrote to memory of 2956 2056 rundll32.exe 32 PID 2056 wrote to memory of 2956 2056 rundll32.exe 32 PID 2056 wrote to memory of 2956 2056 rundll32.exe 32 PID 2056 wrote to memory of 2956 2056 rundll32.exe 32 PID 2056 wrote to memory of 1600 2056 rundll32.exe 34 PID 2056 wrote to memory of 1600 2056 rundll32.exe 34 PID 2056 wrote to memory of 1600 2056 rundll32.exe 34 PID 2056 wrote to memory of 1600 2056 rundll32.exe 34 PID 2356 wrote to memory of 1112 2356 f76cd7c.exe 19 PID 2356 wrote to memory of 1180 2356 f76cd7c.exe 20 PID 2356 wrote to memory of 1236 2356 f76cd7c.exe 21 PID 2356 wrote to memory of 1060 2356 f76cd7c.exe 23 PID 2356 wrote to memory of 2956 2356 f76cd7c.exe 32 PID 2356 wrote to memory of 2956 2356 f76cd7c.exe 32 PID 2356 wrote to memory of 1600 2356 f76cd7c.exe 34 PID 2356 wrote to memory of 1600 2356 f76cd7c.exe 34 PID 1600 wrote to memory of 1112 1600 f76ec33.exe 19 PID 1600 wrote to memory of 1180 1600 f76ec33.exe 20 PID 1600 wrote to memory of 1236 1600 f76ec33.exe 21 PID 1600 wrote to memory of 1060 1600 f76ec33.exe 23 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76cd7c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76cef3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76ec33.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1112
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1180
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1236
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5880ab2ee457bcf10ad3f4ea56319a05e06391975753e9d4e0be748fab6ee1c9N.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5880ab2ee457bcf10ad3f4ea56319a05e06391975753e9d4e0be748fab6ee1c9N.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\f76cd7c.exeC:\Users\Admin\AppData\Local\Temp\f76cd7c.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2356
-
-
C:\Users\Admin\AppData\Local\Temp\f76cef3.exeC:\Users\Admin\AppData\Local\Temp\f76cef3.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System policy modification
PID:2956
-
-
C:\Users\Admin\AppData\Local\Temp\f76ec33.exeC:\Users\Admin\AppData\Local\Temp\f76ec33.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1600
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1060
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD5b2c2c39f25498cf189b9150fd27c66e6
SHA1670edbf2922d2a1a43cd61beaa3a0bdb0db96031
SHA25637a6cb16ff2de3aad1eb0e23ceace87775fa9ae064da131aba9b7b4e1d80168e
SHA512861caca37f9d046bdd957f4019421d47be82086050dca0441afbd30a2e378d063e484a35cb4b14f35c345e2da1808113ce4108f44b30fefd7c46256a4f2b4fbe
-
Filesize
97KB
MD588067442deaaa41519b2e466526871d6
SHA19ae21d76351c3efb609f35a66cbf33b1aaa3e203
SHA25678afcf920506ee1b62d377ffbf6841f26e3f4988b3412a4f9bf726983e427db8
SHA51286ea01cfc605a35284929ddd89ee9027c6a7b0842e50f03f1e05d9a34ddf4a3409eb670fbd2c6184d671f61eb6653ae98e0b24c2e00423cde959cd75b7c3e6aa