Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18/12/2024, 02:09
Static task
static1
Behavioral task
behavioral1
Sample
212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe
Resource
win7-20241023-en
General
-
Target
212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe
-
Size
731KB
-
MD5
b5f0fe6474a3c76a48fe5f88a60dddfd
-
SHA1
cf8d5838c0d13fee1e353802760baa5bcd702afc
-
SHA256
212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f
-
SHA512
b941976ff443d4bd6795b8f098c76f323942259b65b491a6376b4897f6c1a2cdd35b880dd32d13ef908cb62e0113898e7b60868db93cf79e1ca8d34cd67284fb
-
SSDEEP
12288:jQD0guZ6F+dOSHJSKlskGb5+Iq5Ho0l1wFpZS9PmdVLAS8J+cSOcBu0J+4DDDDDk:Dgj1SHYaYlgBoGwFpAmVL8SO6+6aqfy1
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe -
Executes dropped EXE 1 IoCs
pid Process 4892 update.exe -
Loads dropped DLL 3 IoCs
pid Process 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 4892 update.exe 4892 update.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe File opened (read-only) \??\G: 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe -
resource yara_rule behavioral2/memory/628-3-0x00000000024E0000-0x000000000359A000-memory.dmp upx behavioral2/memory/628-4-0x00000000024E0000-0x000000000359A000-memory.dmp upx behavioral2/memory/628-17-0x00000000024E0000-0x000000000359A000-memory.dmp upx behavioral2/memory/628-23-0x00000000024E0000-0x000000000359A000-memory.dmp upx behavioral2/memory/628-18-0x00000000024E0000-0x000000000359A000-memory.dmp upx behavioral2/memory/628-24-0x00000000024E0000-0x000000000359A000-memory.dmp upx behavioral2/memory/628-19-0x00000000024E0000-0x000000000359A000-memory.dmp upx behavioral2/memory/628-6-0x00000000024E0000-0x000000000359A000-memory.dmp upx behavioral2/memory/628-5-0x00000000024E0000-0x000000000359A000-memory.dmp upx behavioral2/memory/628-1-0x00000000024E0000-0x000000000359A000-memory.dmp upx behavioral2/memory/628-78-0x00000000024E0000-0x000000000359A000-memory.dmp upx behavioral2/memory/628-79-0x00000000024E0000-0x000000000359A000-memory.dmp upx behavioral2/memory/628-80-0x00000000024E0000-0x000000000359A000-memory.dmp upx behavioral2/memory/628-81-0x00000000024E0000-0x000000000359A000-memory.dmp upx behavioral2/memory/628-82-0x00000000024E0000-0x000000000359A000-memory.dmp upx behavioral2/memory/628-84-0x00000000024E0000-0x000000000359A000-memory.dmp upx behavioral2/memory/628-85-0x00000000024E0000-0x000000000359A000-memory.dmp upx behavioral2/memory/628-93-0x00000000024E0000-0x000000000359A000-memory.dmp upx -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\e578f4f 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe File opened for modification C:\Windows\SYSTEM.INI 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe File opened for modification C:\Windows\setupapi.log update.exe File opened for modification \??\c:\windows\KB4018466.log update.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language update.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe Token: SeDebugPrivilege 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 628 wrote to memory of 772 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 8 PID 628 wrote to memory of 780 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 9 PID 628 wrote to memory of 376 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 13 PID 628 wrote to memory of 2896 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 50 PID 628 wrote to memory of 2960 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 51 PID 628 wrote to memory of 2376 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 52 PID 628 wrote to memory of 3376 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 56 PID 628 wrote to memory of 3560 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 57 PID 628 wrote to memory of 3756 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 58 PID 628 wrote to memory of 3856 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 59 PID 628 wrote to memory of 3920 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 60 PID 628 wrote to memory of 4016 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 61 PID 628 wrote to memory of 4136 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 62 PID 628 wrote to memory of 1604 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 74 PID 628 wrote to memory of 2160 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 76 PID 628 wrote to memory of 752 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 77 PID 628 wrote to memory of 2140 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 78 PID 628 wrote to memory of 4892 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 84 PID 628 wrote to memory of 4892 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 84 PID 628 wrote to memory of 4892 628 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe 84 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:772
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:376
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2896
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2960
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2376
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe"C:\Users\Admin\AppData\Local\Temp\212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:628 -
\??\c:\d5a04854c4f7f8731018455557b4\update\update.exec:\d5a04854c4f7f8731018455557b4\update\update.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4892
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3560
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3756
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3856
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3920
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4016
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4136
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:1604
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2160
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:752
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2140
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\0E5790F5_Rar\212cae74b9537115b97b12a4047971cbea14fff63f66196bbb67e612bd17d80f.exe
Filesize667KB
MD5095b4c4ef08daef3f6060e7966522dee
SHA1144b7a0f42e7aaa8fa753d96235906f8a883a984
SHA256dcee5ca3863aa268f300d84b34cb2f316315fae27c58705486de4fbfb963dd4b
SHA5126f9ff5837d28aa54825e764451596a0a4ba5d8dcb55268809c10799f504e5f4cb9024c2cf70b72f6d880204ec452196557cc74984f90a262e2d972d8e0fa95a4
-
Filesize
25KB
MD5ee207e35aea4d5df41d90221e1b66efa
SHA1757469cf9ad2f21f267bbe730560114fdf8a89a5
SHA256cf64c95e9a2d02967efc22b00efb3736156b913a95231eb63c1df45d43475e64
SHA51243e9f75725daa4f3428b2d9cee2c2cc8b2f2e991b8e58d72d2f429fbdfb614c86d172f03d3f9da98756bd4e245643d9a57c6efa422d6c60ad364a2322245542d
-
Filesize
712KB
MD59570121468658dcc6972f1dfa624a223
SHA161716952df7a03fc01ac919f44f07e9588840b8c
SHA256bc2cde5db3027a726c81df78bdef10b5ec9a7b4a5ba297911c7b999638f76b33
SHA5127c2168a6db5bf7dd7c09682983e9059524621834d0d9ae250382c74d714b0e99b625f5ee9a648e18de9fa25b580bac5ab770ad63c406a9f88c87ade1a372429c
-
Filesize
331KB
MD5eb5c64286d987337f702813e73fcf615
SHA177c393b4cf5b61c29afa408ec1ebd93b22271e3f
SHA25644062d8525a1de307491a46376d1831e23c27c18edb3de8f142d83eb7a21fc52
SHA5120c71779a7b5a3507b5d0ccc0f9ff785032e1d8c32e76a0c0acadfd531d9ca87b61fd9742d69c610823a4315e181ad41f561811badbc262052d0f3ba86b9237a6