Analysis
-
max time kernel
33s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-12-2024 07:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0597d3ca2d4b6715d451e3f65c2485f5dbf7f645c54f66136bf75118ca0d334e.dll
Resource
win7-20241023-en
windows7-x64
17 signatures
120 seconds
General
-
Target
0597d3ca2d4b6715d451e3f65c2485f5dbf7f645c54f66136bf75118ca0d334e.dll
-
Size
120KB
-
MD5
b8ce68f8c77f403203d00828a0e1b3fa
-
SHA1
1ddd2617ff4704ad6b071e691b6cbfdae1b755be
-
SHA256
0597d3ca2d4b6715d451e3f65c2485f5dbf7f645c54f66136bf75118ca0d334e
-
SHA512
8dc82eac46f7450b49ebc6b5e59a45662a665429d312bb742809898313aacce04b2730a03a6ca92ade87e45b55924e6ebe73ecb8c91cec0138534bd90f1a368e
-
SSDEEP
3072:zv5nXerm4K0AdlZ9to51pCYaJXlZ5M7XGZlijkiIF:zNXWK0EhorpqhlZi7XG3ijIF
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57955a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57955a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57c9d8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57c9d8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57c9d8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57955a.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57955a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57c9d8.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57955a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57c9d8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57c9d8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57c9d8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57c9d8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57c9d8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57c9d8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57955a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57955a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57955a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57955a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57955a.exe -
Executes dropped EXE 3 IoCs
pid Process 1616 e57955a.exe 1452 e5796a2.exe 3276 e57c9d8.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57955a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57955a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57955a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57c9d8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57c9d8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57c9d8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57955a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57955a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57c9d8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57c9d8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57c9d8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57955a.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57955a.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57c9d8.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57955a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57c9d8.exe -
Enumerates connected drives 3 TTPs 13 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: e57955a.exe File opened (read-only) \??\L: e57955a.exe File opened (read-only) \??\M: e57955a.exe File opened (read-only) \??\I: e57c9d8.exe File opened (read-only) \??\E: e57955a.exe File opened (read-only) \??\G: e57955a.exe File opened (read-only) \??\K: e57955a.exe File opened (read-only) \??\E: e57c9d8.exe File opened (read-only) \??\G: e57c9d8.exe File opened (read-only) \??\H: e57c9d8.exe File opened (read-only) \??\J: e57c9d8.exe File opened (read-only) \??\H: e57955a.exe File opened (read-only) \??\J: e57955a.exe -
resource yara_rule behavioral2/memory/1616-8-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1616-6-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1616-17-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1616-18-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1616-29-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1616-34-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1616-25-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1616-11-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1616-10-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1616-9-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1616-35-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1616-36-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1616-37-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1616-38-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1616-39-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1616-40-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1616-46-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1616-55-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1616-57-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1616-59-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1616-61-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1616-62-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1616-66-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1616-68-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/1616-71-0x00000000007A0000-0x000000000185A000-memory.dmp upx behavioral2/memory/3276-109-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3276-96-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3276-146-0x0000000000790000-0x000000000184A000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e57f126 e57c9d8.exe File created C:\Windows\e5795b8 e57955a.exe File opened for modification C:\Windows\SYSTEM.INI e57955a.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57955a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e5796a2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57c9d8.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1616 e57955a.exe 1616 e57955a.exe 1616 e57955a.exe 1616 e57955a.exe 3276 e57c9d8.exe 3276 e57c9d8.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe Token: SeDebugPrivilege 1616 e57955a.exe -
Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 2108 wrote to memory of 4188 2108 rundll32.exe 82 PID 2108 wrote to memory of 4188 2108 rundll32.exe 82 PID 2108 wrote to memory of 4188 2108 rundll32.exe 82 PID 4188 wrote to memory of 1616 4188 rundll32.exe 83 PID 4188 wrote to memory of 1616 4188 rundll32.exe 83 PID 4188 wrote to memory of 1616 4188 rundll32.exe 83 PID 1616 wrote to memory of 780 1616 e57955a.exe 8 PID 1616 wrote to memory of 784 1616 e57955a.exe 9 PID 1616 wrote to memory of 376 1616 e57955a.exe 13 PID 1616 wrote to memory of 2584 1616 e57955a.exe 42 PID 1616 wrote to memory of 2596 1616 e57955a.exe 43 PID 1616 wrote to memory of 2708 1616 e57955a.exe 45 PID 1616 wrote to memory of 3508 1616 e57955a.exe 56 PID 1616 wrote to memory of 3668 1616 e57955a.exe 57 PID 1616 wrote to memory of 3864 1616 e57955a.exe 58 PID 1616 wrote to memory of 3964 1616 e57955a.exe 59 PID 1616 wrote to memory of 4068 1616 e57955a.exe 60 PID 1616 wrote to memory of 2472 1616 e57955a.exe 61 PID 1616 wrote to memory of 4116 1616 e57955a.exe 62 PID 1616 wrote to memory of 1696 1616 e57955a.exe 75 PID 1616 wrote to memory of 2168 1616 e57955a.exe 76 PID 1616 wrote to memory of 2108 1616 e57955a.exe 81 PID 1616 wrote to memory of 4188 1616 e57955a.exe 82 PID 1616 wrote to memory of 4188 1616 e57955a.exe 82 PID 4188 wrote to memory of 1452 4188 rundll32.exe 84 PID 4188 wrote to memory of 1452 4188 rundll32.exe 84 PID 4188 wrote to memory of 1452 4188 rundll32.exe 84 PID 1616 wrote to memory of 780 1616 e57955a.exe 8 PID 1616 wrote to memory of 784 1616 e57955a.exe 9 PID 1616 wrote to memory of 376 1616 e57955a.exe 13 PID 1616 wrote to memory of 2584 1616 e57955a.exe 42 PID 1616 wrote to memory of 2596 1616 e57955a.exe 43 PID 1616 wrote to memory of 2708 1616 e57955a.exe 45 PID 1616 wrote to memory of 3508 1616 e57955a.exe 56 PID 1616 wrote to memory of 3668 1616 e57955a.exe 57 PID 1616 wrote to memory of 3864 1616 e57955a.exe 58 PID 1616 wrote to memory of 3964 1616 e57955a.exe 59 PID 1616 wrote to memory of 4068 1616 e57955a.exe 60 PID 1616 wrote to memory of 2472 1616 e57955a.exe 61 PID 1616 wrote to memory of 4116 1616 e57955a.exe 62 PID 1616 wrote to memory of 1696 1616 e57955a.exe 75 PID 1616 wrote to memory of 2168 1616 e57955a.exe 76 PID 1616 wrote to memory of 2108 1616 e57955a.exe 81 PID 1616 wrote to memory of 1452 1616 e57955a.exe 84 PID 1616 wrote to memory of 1452 1616 e57955a.exe 84 PID 4188 wrote to memory of 3276 4188 rundll32.exe 85 PID 4188 wrote to memory of 3276 4188 rundll32.exe 85 PID 4188 wrote to memory of 3276 4188 rundll32.exe 85 PID 3276 wrote to memory of 780 3276 e57c9d8.exe 8 PID 3276 wrote to memory of 784 3276 e57c9d8.exe 9 PID 3276 wrote to memory of 376 3276 e57c9d8.exe 13 PID 3276 wrote to memory of 2584 3276 e57c9d8.exe 42 PID 3276 wrote to memory of 2596 3276 e57c9d8.exe 43 PID 3276 wrote to memory of 2708 3276 e57c9d8.exe 45 PID 3276 wrote to memory of 3508 3276 e57c9d8.exe 56 PID 3276 wrote to memory of 3668 3276 e57c9d8.exe 57 PID 3276 wrote to memory of 3864 3276 e57c9d8.exe 58 PID 3276 wrote to memory of 3964 3276 e57c9d8.exe 59 PID 3276 wrote to memory of 4068 3276 e57c9d8.exe 60 PID 3276 wrote to memory of 2472 3276 e57c9d8.exe 61 PID 3276 wrote to memory of 4116 3276 e57c9d8.exe 62 PID 3276 wrote to memory of 1696 3276 e57c9d8.exe 75 PID 3276 wrote to memory of 2168 3276 e57c9d8.exe 76 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57955a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57c9d8.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:376
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2584
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2596
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2708
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3508
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0597d3ca2d4b6715d451e3f65c2485f5dbf7f645c54f66136bf75118ca0d334e.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0597d3ca2d4b6715d451e3f65c2485f5dbf7f645c54f66136bf75118ca0d334e.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\e57955a.exeC:\Users\Admin\AppData\Local\Temp\e57955a.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1616
-
-
C:\Users\Admin\AppData\Local\Temp\e5796a2.exeC:\Users\Admin\AppData\Local\Temp\e5796a2.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1452
-
-
C:\Users\Admin\AppData\Local\Temp\e57c9d8.exeC:\Users\Admin\AppData\Local\Temp\e57c9d8.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3276
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3668
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3864
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3964
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4068
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2472
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4116
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:1696
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2168
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5814ba4d555057ba3a91dfe0b68ddbea3
SHA1155678787d9e995ba051ed37d7453ecbc80829e4
SHA256f28bee002732aafbc1f6226a40b3534995ad0bb1d4e46176009eb1fb41248ebf
SHA512b5bb6290cd6eb3264f0a8f0d100e89271699a625ef17193d6ea9b508c0f57a7a3181919730c8bdaa1ac524dee9b35856e34185852a4fec39e76ee4b69c0d0a34
-
Filesize
256B
MD5b34db68506254573ead8bf37e5cd72b8
SHA16b39f74e56b967c23965f24ae96442cf8b771264
SHA25674a72540b51917868da09570dd86d80150d23d4e463a72758b85a076f864cfef
SHA512675b58ef5b908fa325fcf56d18434f27948da3aaa1aaf71cd473d94554ba88788b579570cb3f1d6bf0709cbd272ed1d62404cbe28b2a38ae86c9174c922a8acc