Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17-12-2024 04:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
16df53c28b78a20c87485f9796cb63fb8e849704afebdcb128574f311a039f2b.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
150 seconds
General
-
Target
16df53c28b78a20c87485f9796cb63fb8e849704afebdcb128574f311a039f2b.dll
-
Size
120KB
-
MD5
b6c3a66d700c351a957b2f886a46b5fb
-
SHA1
17ed6ea125b0f77308c64881c9652055e449adcb
-
SHA256
16df53c28b78a20c87485f9796cb63fb8e849704afebdcb128574f311a039f2b
-
SHA512
5c03eaa789770065c2c36c2fae5d824f5a6de18997eb61e01541228570e482d6bf4625e1df8eff78f0683fe8551e9b93235f5011f0ef9e8adca25f320584b925
-
SSDEEP
1536:LUDFIbOBGqjS+WfDLXZtssJswtaJvsOoHPq9Fv33nyIeLy82JFILNqO:L2kOsmS+cptyJvsDHSnnyIaB2JFILJ
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57c208.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57c208.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57c208.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57dec7.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57dec7.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57dec7.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57dec7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57c208.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57c208.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57dec7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57dec7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57c208.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57c208.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57c208.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57dec7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57dec7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57dec7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57dec7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57c208.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57c208.exe -
Executes dropped EXE 3 IoCs
pid Process 5096 e57c208.exe 4428 e57c41b.exe 5052 e57dec7.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57c208.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57c208.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57dec7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57c208.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57c208.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57c208.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57dec7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57c208.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57c208.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57dec7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57dec7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57dec7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57dec7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57dec7.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57c208.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57dec7.exe -
resource yara_rule behavioral2/memory/5096-6-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/5096-9-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/5096-10-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/5096-11-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/5096-13-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/5096-15-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/5096-20-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/5096-26-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/5096-8-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/5096-14-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/5096-33-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/5096-42-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/5052-75-0x0000000000B50000-0x0000000001C0A000-memory.dmp upx behavioral2/memory/5052-73-0x0000000000B50000-0x0000000001C0A000-memory.dmp upx behavioral2/memory/5052-76-0x0000000000B50000-0x0000000001C0A000-memory.dmp upx behavioral2/memory/5052-77-0x0000000000B50000-0x0000000001C0A000-memory.dmp upx behavioral2/memory/5052-79-0x0000000000B50000-0x0000000001C0A000-memory.dmp upx behavioral2/memory/5052-74-0x0000000000B50000-0x0000000001C0A000-memory.dmp upx behavioral2/memory/5052-78-0x0000000000B50000-0x0000000001C0A000-memory.dmp upx behavioral2/memory/5052-82-0x0000000000B50000-0x0000000001C0A000-memory.dmp upx behavioral2/memory/5052-80-0x0000000000B50000-0x0000000001C0A000-memory.dmp upx behavioral2/memory/5052-81-0x0000000000B50000-0x0000000001C0A000-memory.dmp upx behavioral2/memory/5052-89-0x0000000000B50000-0x0000000001C0A000-memory.dmp upx behavioral2/memory/5052-88-0x0000000000B50000-0x0000000001C0A000-memory.dmp upx behavioral2/memory/5052-92-0x0000000000B50000-0x0000000001C0A000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e57c256 e57c208.exe File opened for modification C:\Windows\SYSTEM.INI e57c208.exe File created C:\Windows\e581345 e57dec7.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57c208.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57c41b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57dec7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 5096 e57c208.exe 5096 e57c208.exe 5096 e57c208.exe 5096 e57c208.exe 5052 e57dec7.exe 5052 e57dec7.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe Token: SeDebugPrivilege 5096 e57c208.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1756 wrote to memory of 3592 1756 rundll32.exe 82 PID 1756 wrote to memory of 3592 1756 rundll32.exe 82 PID 1756 wrote to memory of 3592 1756 rundll32.exe 82 PID 3592 wrote to memory of 5096 3592 rundll32.exe 83 PID 3592 wrote to memory of 5096 3592 rundll32.exe 83 PID 3592 wrote to memory of 5096 3592 rundll32.exe 83 PID 5096 wrote to memory of 780 5096 e57c208.exe 9 PID 5096 wrote to memory of 788 5096 e57c208.exe 10 PID 5096 wrote to memory of 388 5096 e57c208.exe 13 PID 5096 wrote to memory of 2488 5096 e57c208.exe 42 PID 5096 wrote to memory of 2524 5096 e57c208.exe 43 PID 5096 wrote to memory of 2672 5096 e57c208.exe 46 PID 5096 wrote to memory of 3388 5096 e57c208.exe 56 PID 5096 wrote to memory of 3552 5096 e57c208.exe 57 PID 5096 wrote to memory of 3756 5096 e57c208.exe 58 PID 5096 wrote to memory of 3924 5096 e57c208.exe 59 PID 5096 wrote to memory of 3992 5096 e57c208.exe 60 PID 5096 wrote to memory of 4072 5096 e57c208.exe 61 PID 5096 wrote to memory of 4116 5096 e57c208.exe 62 PID 5096 wrote to memory of 2220 5096 e57c208.exe 64 PID 5096 wrote to memory of 3376 5096 e57c208.exe 75 PID 5096 wrote to memory of 1756 5096 e57c208.exe 81 PID 5096 wrote to memory of 3592 5096 e57c208.exe 82 PID 5096 wrote to memory of 3592 5096 e57c208.exe 82 PID 3592 wrote to memory of 4428 3592 rundll32.exe 84 PID 3592 wrote to memory of 4428 3592 rundll32.exe 84 PID 3592 wrote to memory of 4428 3592 rundll32.exe 84 PID 3592 wrote to memory of 5052 3592 rundll32.exe 85 PID 3592 wrote to memory of 5052 3592 rundll32.exe 85 PID 3592 wrote to memory of 5052 3592 rundll32.exe 85 PID 5096 wrote to memory of 780 5096 e57c208.exe 9 PID 5096 wrote to memory of 788 5096 e57c208.exe 10 PID 5096 wrote to memory of 388 5096 e57c208.exe 13 PID 5096 wrote to memory of 2488 5096 e57c208.exe 42 PID 5096 wrote to memory of 2524 5096 e57c208.exe 43 PID 5096 wrote to memory of 2672 5096 e57c208.exe 46 PID 5096 wrote to memory of 3388 5096 e57c208.exe 56 PID 5096 wrote to memory of 3552 5096 e57c208.exe 57 PID 5096 wrote to memory of 3756 5096 e57c208.exe 58 PID 5096 wrote to memory of 3924 5096 e57c208.exe 59 PID 5096 wrote to memory of 3992 5096 e57c208.exe 60 PID 5096 wrote to memory of 4072 5096 e57c208.exe 61 PID 5096 wrote to memory of 4116 5096 e57c208.exe 62 PID 5096 wrote to memory of 2220 5096 e57c208.exe 64 PID 5096 wrote to memory of 3376 5096 e57c208.exe 75 PID 5096 wrote to memory of 4428 5096 e57c208.exe 84 PID 5096 wrote to memory of 4428 5096 e57c208.exe 84 PID 5096 wrote to memory of 5052 5096 e57c208.exe 85 PID 5096 wrote to memory of 5052 5096 e57c208.exe 85 PID 5052 wrote to memory of 780 5052 e57dec7.exe 9 PID 5052 wrote to memory of 788 5052 e57dec7.exe 10 PID 5052 wrote to memory of 388 5052 e57dec7.exe 13 PID 5052 wrote to memory of 2488 5052 e57dec7.exe 42 PID 5052 wrote to memory of 2524 5052 e57dec7.exe 43 PID 5052 wrote to memory of 2672 5052 e57dec7.exe 46 PID 5052 wrote to memory of 3388 5052 e57dec7.exe 56 PID 5052 wrote to memory of 3552 5052 e57dec7.exe 57 PID 5052 wrote to memory of 3756 5052 e57dec7.exe 58 PID 5052 wrote to memory of 3924 5052 e57dec7.exe 59 PID 5052 wrote to memory of 3992 5052 e57dec7.exe 60 PID 5052 wrote to memory of 4072 5052 e57dec7.exe 61 PID 5052 wrote to memory of 4116 5052 e57dec7.exe 62 PID 5052 wrote to memory of 2220 5052 e57dec7.exe 64 PID 5052 wrote to memory of 3376 5052 e57dec7.exe 75 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57c208.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57dec7.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:388
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2488
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2524
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2672
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3388
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\16df53c28b78a20c87485f9796cb63fb8e849704afebdcb128574f311a039f2b.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\16df53c28b78a20c87485f9796cb63fb8e849704afebdcb128574f311a039f2b.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\e57c208.exeC:\Users\Admin\AppData\Local\Temp\e57c208.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5096
-
-
C:\Users\Admin\AppData\Local\Temp\e57c41b.exeC:\Users\Admin\AppData\Local\Temp\e57c41b.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4428
-
-
C:\Users\Admin\AppData\Local\Temp\e57dec7.exeC:\Users\Admin\AppData\Local\Temp\e57dec7.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5052
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3552
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3756
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3924
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3992
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4072
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4116
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2220
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:3376
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD585aa00d62f9c2a341fab876f7ef877a4
SHA1e8419e48f3c8da91550967285f6be13b67f30f68
SHA2565ca6c252a4eea84682423a51ae4f0878b884f0f6c86dc72ca244b1277e7e9e06
SHA5121fcfca3edcc6a9f9fed1ab592e03ccff006f9f838a2fa523a7b6d1230ecc035f36c75b31c53d25ceee43dfe80497f4cb92d22d6bfda1cb10b1cece2891eb350e
-
Filesize
256B
MD55e82b5a47a721f112bba5cac1dd471ac
SHA1d66f0d1cf2f512246ec4c02d6521c88ccf0adb55
SHA256ad5bde90439f2751a84dcfc49f0c14687f55ded32d8dffed5ccf5a4b5612ce93
SHA512722d21562ed227d8f6437c8cb41516426e0c51e5048bab518e4ccd58bfd8f84ecc9e7645c9167f176f305e94e026fcae58cbe629d963714ee0cad2fdd23542b3