Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 10:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4584aad81665846a436ed8f3bddab7f32221191c806d2c00fd425da7c9cd2e86.dll
Resource
win7-20241010-en
windows7-x64
17 signatures
150 seconds
General
-
Target
4584aad81665846a436ed8f3bddab7f32221191c806d2c00fd425da7c9cd2e86.dll
-
Size
120KB
-
MD5
0821ff500c73e6f59ca593cad897a16d
-
SHA1
32dcfd58213b81e7411121c1b82f3d6584fcbab2
-
SHA256
4584aad81665846a436ed8f3bddab7f32221191c806d2c00fd425da7c9cd2e86
-
SHA512
eaf33582eb17a92dfbf8959bdc78232c7aced7a66fd49758dbbe7e4da4da0ed381e0c4b9583496694edceb155aa68930a5d01929a71212fc1467af8314d0804e
-
SSDEEP
3072:1kOJG3QLzHogFkNvIH2j/qOqE3Lf2bfteG:UUzHJkNl77f2bt
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57a587.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57def6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57def6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57def6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57a587.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57a587.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57a587.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57def6.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57def6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57def6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57a587.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57a587.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57def6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57a587.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57def6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57def6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57def6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57a587.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57a587.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57a587.exe -
Executes dropped EXE 4 IoCs
pid Process 852 e57a587.exe 1236 e57a75c.exe 5084 e57def6.exe 432 e57df15.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57a587.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57def6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57def6.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57def6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57a587.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57a587.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57a587.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57def6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57def6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57a587.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57def6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57a587.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57a587.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57def6.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57a587.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57def6.exe -
Enumerates connected drives 3 TTPs 12 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: e57def6.exe File opened (read-only) \??\H: e57a587.exe File opened (read-only) \??\L: e57a587.exe File opened (read-only) \??\E: e57def6.exe File opened (read-only) \??\J: e57a587.exe File opened (read-only) \??\K: e57a587.exe File opened (read-only) \??\G: e57def6.exe File opened (read-only) \??\H: e57def6.exe File opened (read-only) \??\I: e57def6.exe File opened (read-only) \??\E: e57a587.exe File opened (read-only) \??\G: e57a587.exe File opened (read-only) \??\I: e57a587.exe -
resource yara_rule behavioral2/memory/852-8-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/852-6-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/852-10-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/852-9-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/852-11-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/852-17-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/852-18-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/852-30-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/852-32-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/852-33-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/852-34-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/852-35-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/852-36-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/852-41-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/852-42-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/852-44-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/852-59-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/852-60-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/852-62-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/852-63-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/852-65-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/852-66-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/852-69-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/5084-95-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/5084-104-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/5084-152-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/5084-154-0x0000000000780000-0x000000000183A000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e57a604 e57a587.exe File opened for modification C:\Windows\SYSTEM.INI e57a587.exe File created C:\Windows\e580664 e57def6.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57a587.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57a75c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57def6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57df15.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 852 e57a587.exe 852 e57a587.exe 852 e57a587.exe 852 e57a587.exe 5084 e57def6.exe 5084 e57def6.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe Token: SeDebugPrivilege 852 e57a587.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2008 wrote to memory of 3824 2008 rundll32.exe 83 PID 2008 wrote to memory of 3824 2008 rundll32.exe 83 PID 2008 wrote to memory of 3824 2008 rundll32.exe 83 PID 3824 wrote to memory of 852 3824 rundll32.exe 84 PID 3824 wrote to memory of 852 3824 rundll32.exe 84 PID 3824 wrote to memory of 852 3824 rundll32.exe 84 PID 852 wrote to memory of 792 852 e57a587.exe 8 PID 852 wrote to memory of 796 852 e57a587.exe 9 PID 852 wrote to memory of 376 852 e57a587.exe 13 PID 852 wrote to memory of 2704 852 e57a587.exe 45 PID 852 wrote to memory of 2796 852 e57a587.exe 50 PID 852 wrote to memory of 3128 852 e57a587.exe 53 PID 852 wrote to memory of 3568 852 e57a587.exe 56 PID 852 wrote to memory of 3700 852 e57a587.exe 57 PID 852 wrote to memory of 3872 852 e57a587.exe 58 PID 852 wrote to memory of 3960 852 e57a587.exe 59 PID 852 wrote to memory of 4024 852 e57a587.exe 60 PID 852 wrote to memory of 776 852 e57a587.exe 61 PID 852 wrote to memory of 4144 852 e57a587.exe 62 PID 852 wrote to memory of 4520 852 e57a587.exe 75 PID 852 wrote to memory of 1300 852 e57a587.exe 76 PID 852 wrote to memory of 2900 852 e57a587.exe 81 PID 852 wrote to memory of 2008 852 e57a587.exe 82 PID 852 wrote to memory of 3824 852 e57a587.exe 83 PID 852 wrote to memory of 3824 852 e57a587.exe 83 PID 3824 wrote to memory of 1236 3824 rundll32.exe 85 PID 3824 wrote to memory of 1236 3824 rundll32.exe 85 PID 3824 wrote to memory of 1236 3824 rundll32.exe 85 PID 852 wrote to memory of 792 852 e57a587.exe 8 PID 852 wrote to memory of 796 852 e57a587.exe 9 PID 852 wrote to memory of 376 852 e57a587.exe 13 PID 852 wrote to memory of 2704 852 e57a587.exe 45 PID 852 wrote to memory of 2796 852 e57a587.exe 50 PID 852 wrote to memory of 3128 852 e57a587.exe 53 PID 852 wrote to memory of 3568 852 e57a587.exe 56 PID 852 wrote to memory of 3700 852 e57a587.exe 57 PID 852 wrote to memory of 3872 852 e57a587.exe 58 PID 852 wrote to memory of 3960 852 e57a587.exe 59 PID 852 wrote to memory of 4024 852 e57a587.exe 60 PID 852 wrote to memory of 776 852 e57a587.exe 61 PID 852 wrote to memory of 4144 852 e57a587.exe 62 PID 852 wrote to memory of 4520 852 e57a587.exe 75 PID 852 wrote to memory of 1300 852 e57a587.exe 76 PID 852 wrote to memory of 2900 852 e57a587.exe 81 PID 852 wrote to memory of 2008 852 e57a587.exe 82 PID 852 wrote to memory of 1236 852 e57a587.exe 85 PID 852 wrote to memory of 1236 852 e57a587.exe 85 PID 3824 wrote to memory of 5084 3824 rundll32.exe 87 PID 3824 wrote to memory of 5084 3824 rundll32.exe 87 PID 3824 wrote to memory of 5084 3824 rundll32.exe 87 PID 3824 wrote to memory of 432 3824 rundll32.exe 88 PID 3824 wrote to memory of 432 3824 rundll32.exe 88 PID 3824 wrote to memory of 432 3824 rundll32.exe 88 PID 5084 wrote to memory of 792 5084 e57def6.exe 8 PID 5084 wrote to memory of 796 5084 e57def6.exe 9 PID 5084 wrote to memory of 376 5084 e57def6.exe 13 PID 5084 wrote to memory of 2704 5084 e57def6.exe 45 PID 5084 wrote to memory of 2796 5084 e57def6.exe 50 PID 5084 wrote to memory of 3128 5084 e57def6.exe 53 PID 5084 wrote to memory of 3568 5084 e57def6.exe 56 PID 5084 wrote to memory of 3700 5084 e57def6.exe 57 PID 5084 wrote to memory of 3872 5084 e57def6.exe 58 PID 5084 wrote to memory of 3960 5084 e57def6.exe 59 PID 5084 wrote to memory of 4024 5084 e57def6.exe 60 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57a587.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57def6.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:796
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:376
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2704
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2796
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3128
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3568
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4584aad81665846a436ed8f3bddab7f32221191c806d2c00fd425da7c9cd2e86.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4584aad81665846a436ed8f3bddab7f32221191c806d2c00fd425da7c9cd2e86.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\e57a587.exeC:\Users\Admin\AppData\Local\Temp\e57a587.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:852
-
-
C:\Users\Admin\AppData\Local\Temp\e57a75c.exeC:\Users\Admin\AppData\Local\Temp\e57a75c.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1236
-
-
C:\Users\Admin\AppData\Local\Temp\e57def6.exeC:\Users\Admin\AppData\Local\Temp\e57def6.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5084
-
-
C:\Users\Admin\AppData\Local\Temp\e57df15.exeC:\Users\Admin\AppData\Local\Temp\e57df15.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:432
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3700
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3872
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3960
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4024
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:776
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4144
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4520
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1300
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:2900
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD503c23d8729858a25f586e80e63f70e3b
SHA13cf7a5faa8c5c3b4a5b584f6329412bf1a6f364e
SHA25604a4c9b770f2db3c798fe537bef3195e8d35639811e790940d53450cd9ebcf24
SHA5124d387bf17e7703c56b4e2e35c0688c92137750868b41a69a13c9c339c696ce2e85a3ecb2603203a2dcd6c1648fa5ec1bd63e75b12d43d85ddc8b314960e5bb9b
-
Filesize
257B
MD58c14d79735a3590c84ba2d6673be8abb
SHA19659f00f6bfeae9cf734d3d4961fe78c1956040c
SHA256f3148fdcc002baaa66762ddd4891808519dcde24c4236b51549d26cd0690bb6e
SHA512894ee41a957960a3ea7b7362220594a68a6c4e0a05ca677302ba1785d69ae69513a26570ec10b3ee5400e2bcec5e6d166386e47b1a1d9c189740fb39586f6bd1