Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2024 01:26
Static task
static1
Behavioral task
behavioral1
Sample
2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe
Resource
win7-20240903-en
General
-
Target
2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe
-
Size
1.1MB
-
MD5
b14f761584f10b32e67a3cab5862ac20
-
SHA1
5c7b0bf5448c136c8163c5fbc33d9e38e328dda1
-
SHA256
2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fd
-
SHA512
5f2c1e51f4895f51bfb662bf55f8c1a4d9b3ce492c9c73a987554df726baff8a355825f2a6efa6f5b18a592ef141c356ea0b8378791402bfc9650548fe6bd9b6
-
SSDEEP
24576:jIXW/8yw1ez54lIrF5SXYHU1jJ+dJG4qS6dTVZHf/HGY:s9bC4lI+5J+3G3ldTVBHN
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" rundll32.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe -
Blocklisted process makes network request 1 IoCs
flow pid Process 9 3972 Rundll32.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation Rundll32.exe -
Executes dropped EXE 3 IoCs
pid Process 2568 system.exe 2580 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 3792 rundll32.exe -
Loads dropped DLL 3 IoCs
pid Process 220 Rundll32.exe 3972 Rundll32.exe 3972 Rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Windows\\system32\\system.exe" Rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Office\\rundll32.exe" 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe File opened (read-only) \??\X: 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe File opened (read-only) \??\Y: 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe File opened (read-only) \??\M: rundll32.exe File opened (read-only) \??\R: rundll32.exe File opened (read-only) \??\G: 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe File opened (read-only) \??\T: 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe File opened (read-only) \??\L: rundll32.exe File opened (read-only) \??\X: rundll32.exe File opened (read-only) \??\B: rundll32.exe File opened (read-only) \??\G: rundll32.exe File opened (read-only) \??\Q: rundll32.exe File opened (read-only) \??\M: 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe File opened (read-only) \??\W: 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe File opened (read-only) \??\I: 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe File opened (read-only) \??\O: 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe File opened (read-only) \??\S: 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe File opened (read-only) \??\A: rundll32.exe File opened (read-only) \??\H: rundll32.exe File opened (read-only) \??\I: rundll32.exe File opened (read-only) \??\D: Rundll32.exe File opened (read-only) \??\F: Rundll32.exe File opened (read-only) \??\T: rundll32.exe File opened (read-only) \??\Z: rundll32.exe File opened (read-only) \??\P: rundll32.exe File opened (read-only) \??\S: rundll32.exe File opened (read-only) \??\K: 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe File opened (read-only) \??\P: 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe File opened (read-only) \??\Q: 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe File opened (read-only) \??\O: rundll32.exe File opened (read-only) \??\Y: rundll32.exe File opened (read-only) \??\H: 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe File opened (read-only) \??\J: 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe File opened (read-only) \??\Z: 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe File opened (read-only) \??\E: rundll32.exe File opened (read-only) \??\J: rundll32.exe File opened (read-only) \??\V: rundll32.exe File opened (read-only) \??\E: 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe File opened (read-only) \??\R: 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe File opened (read-only) \??\N: rundll32.exe File opened (read-only) \??\W: rundll32.exe File opened (read-only) \??\L: 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe File opened (read-only) \??\U: 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe File opened (read-only) \??\U: rundll32.exe File opened (read-only) \??\N: 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe File opened (read-only) \??\K: rundll32.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe File opened for modification F:\autorun.inf 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\bogmngaa.dll system.exe File opened for modification C:\Windows\SysWOW64\system.exe 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe File created C:\Windows\SysWOW64\system.exe 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe File created C:\Windows\SysWOW64\favlngaa.dll system.exe -
resource yara_rule behavioral2/memory/2052-1-0x0000000003460000-0x000000000451A000-memory.dmp upx behavioral2/memory/2052-4-0x0000000003460000-0x000000000451A000-memory.dmp upx behavioral2/memory/2052-7-0x0000000003460000-0x000000000451A000-memory.dmp upx behavioral2/memory/2052-24-0x0000000003460000-0x000000000451A000-memory.dmp upx behavioral2/memory/2052-21-0x0000000003460000-0x000000000451A000-memory.dmp upx behavioral2/memory/2052-31-0x0000000003460000-0x000000000451A000-memory.dmp upx behavioral2/memory/2052-27-0x0000000003460000-0x000000000451A000-memory.dmp upx behavioral2/memory/2052-14-0x0000000003460000-0x000000000451A000-memory.dmp upx behavioral2/memory/2052-8-0x0000000003460000-0x000000000451A000-memory.dmp upx behavioral2/memory/2052-5-0x0000000003460000-0x000000000451A000-memory.dmp upx behavioral2/memory/2052-15-0x0000000003460000-0x000000000451A000-memory.dmp upx behavioral2/memory/2052-53-0x0000000003460000-0x000000000451A000-memory.dmp upx behavioral2/memory/2052-50-0x0000000003460000-0x000000000451A000-memory.dmp upx behavioral2/memory/2052-51-0x0000000003460000-0x000000000451A000-memory.dmp upx behavioral2/memory/2052-60-0x0000000003460000-0x000000000451A000-memory.dmp upx behavioral2/memory/2052-63-0x0000000003460000-0x000000000451A000-memory.dmp upx behavioral2/memory/2052-64-0x0000000003460000-0x000000000451A000-memory.dmp upx behavioral2/memory/2052-66-0x0000000003460000-0x000000000451A000-memory.dmp upx behavioral2/memory/2052-67-0x0000000003460000-0x000000000451A000-memory.dmp upx behavioral2/memory/2052-68-0x0000000003460000-0x000000000451A000-memory.dmp upx behavioral2/memory/2052-70-0x0000000003460000-0x000000000451A000-memory.dmp upx behavioral2/memory/2052-71-0x0000000003460000-0x000000000451A000-memory.dmp upx behavioral2/memory/2052-76-0x0000000003460000-0x000000000451A000-memory.dmp upx behavioral2/memory/2052-78-0x0000000003460000-0x000000000451A000-memory.dmp upx behavioral2/memory/2052-82-0x0000000003460000-0x000000000451A000-memory.dmp upx behavioral2/memory/2052-83-0x0000000003460000-0x000000000451A000-memory.dmp upx behavioral2/memory/2052-84-0x0000000003460000-0x000000000451A000-memory.dmp upx behavioral2/memory/2052-85-0x0000000003460000-0x000000000451A000-memory.dmp upx behavioral2/memory/2052-86-0x0000000003460000-0x000000000451A000-memory.dmp upx behavioral2/memory/2052-89-0x0000000003460000-0x000000000451A000-memory.dmp upx behavioral2/memory/2052-96-0x0000000003460000-0x000000000451A000-memory.dmp upx behavioral2/memory/2052-97-0x0000000003460000-0x000000000451A000-memory.dmp upx -
Drops file in Program Files directory 12 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe File opened for modification C:\Program Files\AAV\CDriver.sys Rundll32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\e576fd1 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe File opened for modification C:\Windows\SYSTEM.INI 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe -
Launches sc.exe 7 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3888 sc.exe 4488 sc.exe 5004 sc.exe 2952 sc.exe 4228 sc.exe 1328 sc.exe 1644 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 17 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 2568 system.exe 2568 system.exe 220 Rundll32.exe 220 Rundll32.exe 220 Rundll32.exe 220 Rundll32.exe 220 Rundll32.exe 220 Rundll32.exe 220 Rundll32.exe 220 Rundll32.exe 220 Rundll32.exe 220 Rundll32.exe 220 Rundll32.exe 220 Rundll32.exe 220 Rundll32.exe 220 Rundll32.exe 3972 Rundll32.exe 3972 Rundll32.exe 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 2580 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 2580 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 652 Process not Found -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe Token: SeDebugPrivilege 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2580 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 3792 rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2052 wrote to memory of 2568 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 82 PID 2052 wrote to memory of 2568 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 82 PID 2052 wrote to memory of 2568 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 82 PID 2052 wrote to memory of 788 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 8 PID 2052 wrote to memory of 796 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 9 PID 2052 wrote to memory of 332 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 13 PID 2052 wrote to memory of 2616 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 44 PID 2052 wrote to memory of 2652 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 45 PID 2052 wrote to memory of 2824 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 48 PID 2052 wrote to memory of 3596 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 56 PID 2052 wrote to memory of 3732 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 57 PID 2052 wrote to memory of 3920 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 58 PID 2052 wrote to memory of 4012 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 59 PID 2052 wrote to memory of 4076 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 60 PID 2052 wrote to memory of 692 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 61 PID 2052 wrote to memory of 4136 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 62 PID 2052 wrote to memory of 3296 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 74 PID 2052 wrote to memory of 3800 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 76 PID 2052 wrote to memory of 2568 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 82 PID 2052 wrote to memory of 2568 2052 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe 82 PID 2568 wrote to memory of 220 2568 system.exe 83 PID 2568 wrote to memory of 220 2568 system.exe 83 PID 2568 wrote to memory of 220 2568 system.exe 83 PID 220 wrote to memory of 1252 220 Rundll32.exe 84 PID 220 wrote to memory of 1252 220 Rundll32.exe 84 PID 220 wrote to memory of 1252 220 Rundll32.exe 84 PID 220 wrote to memory of 444 220 Rundll32.exe 85 PID 220 wrote to memory of 444 220 Rundll32.exe 85 PID 220 wrote to memory of 444 220 Rundll32.exe 85 PID 220 wrote to memory of 4488 220 Rundll32.exe 86 PID 220 wrote to memory of 4488 220 Rundll32.exe 86 PID 220 wrote to memory of 4488 220 Rundll32.exe 86 PID 220 wrote to memory of 3888 220 Rundll32.exe 87 PID 220 wrote to memory of 3888 220 Rundll32.exe 87 PID 220 wrote to memory of 3888 220 Rundll32.exe 87 PID 220 wrote to memory of 1644 220 Rundll32.exe 88 PID 220 wrote to memory of 1644 220 Rundll32.exe 88 PID 220 wrote to memory of 1644 220 Rundll32.exe 88 PID 220 wrote to memory of 1328 220 Rundll32.exe 92 PID 220 wrote to memory of 1328 220 Rundll32.exe 92 PID 220 wrote to memory of 1328 220 Rundll32.exe 92 PID 220 wrote to memory of 4228 220 Rundll32.exe 93 PID 220 wrote to memory of 4228 220 Rundll32.exe 93 PID 220 wrote to memory of 4228 220 Rundll32.exe 93 PID 220 wrote to memory of 2952 220 Rundll32.exe 94 PID 220 wrote to memory of 2952 220 Rundll32.exe 94 PID 220 wrote to memory of 2952 220 Rundll32.exe 94 PID 220 wrote to memory of 2052 220 Rundll32.exe 81 PID 220 wrote to memory of 2052 220 Rundll32.exe 81 PID 220 wrote to memory of 2568 220 Rundll32.exe 82 PID 220 wrote to memory of 2568 220 Rundll32.exe 82 PID 220 wrote to memory of 1252 220 Rundll32.exe 84 PID 220 wrote to memory of 1252 220 Rundll32.exe 84 PID 220 wrote to memory of 444 220 Rundll32.exe 85 PID 220 wrote to memory of 444 220 Rundll32.exe 85 PID 220 wrote to memory of 4488 220 Rundll32.exe 86 PID 220 wrote to memory of 4488 220 Rundll32.exe 86 PID 220 wrote to memory of 3888 220 Rundll32.exe 87 PID 220 wrote to memory of 3888 220 Rundll32.exe 87 PID 444 wrote to memory of 1432 444 net.exe 100 PID 444 wrote to memory of 1432 444 net.exe 100 PID 444 wrote to memory of 1432 444 net.exe 100 PID 1252 wrote to memory of 2804 1252 net.exe 101 PID 1252 wrote to memory of 2804 1252 net.exe 101 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:796
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:332
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2616
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2652
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2824
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe"C:\Users\Admin\AppData\Local\Temp\2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2052 -
C:\Windows\SysWOW64\system.exeC:\Windows\system32\system.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\Rundll32.exeRundll32 C:\Windows\system32\favlngaa.dll Exxcute4⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Windows\SysWOW64\net.exenet stop WinDefend5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WinDefend6⤵
- System Location Discovery: System Language Discovery
PID:2804
-
-
-
C:\Windows\SysWOW64\net.exenet stop MpsSvc5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:444 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc6⤵
- System Location Discovery: System Language Discovery
PID:1432
-
-
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled5⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4488
-
-
C:\Windows\SysWOW64\sc.exesc config MpsSvc start= disabled5⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3888
-
-
C:\Windows\SysWOW64\sc.exesc stop ZhuDongFangYu5⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1644
-
-
C:\Windows\SysWOW64\sc.exesc delete ZhuDongFangYu5⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1328
-
-
C:\Windows\SysWOW64\sc.exesc stop 360rp5⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4228
-
-
C:\Windows\SysWOW64\sc.exesc delete 360rp5⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2952
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" stop PolicyAgent5⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:5004
-
-
-
C:\Windows\SysWOW64\Rundll32.exeRundll32 C:\Windows\system32\bogmngaa.dll Exucute4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3972
-
-
-
C:\Users\Admin\AppData\Local\Temp\2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exeC:\Users\Admin\AppData\Local\Temp\2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe3⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2580 -
C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exeC:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3792
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3732
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3920
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4012
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4076
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:692
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4136
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:3296
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3800
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
5Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
8Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
664KB
MD52eb5d76180ce7b3241b281fa79ab3483
SHA106293dea80e39c7eb7ee2bdb00d60b58d932fa8a
SHA256e1b9beb4617a720d55afaec364941bb18ea2c456a8b06b30a736f0cbb5c297e8
SHA51235f553c76fc67afb88a6a090fcbad6af3e2faae154c9c84bd869714194012525a2d42b76dad855805f107a37c351f0de08fd9a03d8ddc1dd400d64640d81b90b
-
C:\Users\Admin\AppData\Local\Temp\2c19c62726b33a75df9308a0567005cb8712aa877acb01daddc789fc2ace24fdN.exe
Filesize728KB
MD558c2b81fbd18a43bd4a79c3d7eb10600
SHA1014eee5ccbc16bf353551eccd9f75894f9065447
SHA2565b26f2359577daed9cfb49f4090cc94b8e51a916b1fd327ffbdd9ab57349762e
SHA51254bd8f5363c521f2da319965d785df9f7f738eb95e5c640431aca8c96f7f40614e3eb888e499601bc26cbd050efd163375d54fdd38491e74931d8061864a81fa
-
Filesize
4.3MB
MD56c7cdd25c2cb0073306eb22aebfc663f
SHA1a1eba8ab49272b9852fe6a543677e8af36271248
SHA25658280e3572333f97a7cf9f33e8d31dc26a98b6535965ebd0bde82249fc9bf705
SHA51217344e07b9e9b2cd6ae4237d7f310732462f9cbb8656883607d7a1a4090e869265f92a6da1718dee50b1375b91583de60c6bd9e7e8db6b6e45e33f4b894365d6
-
Filesize
22KB
MD55a8d0e7f4d185892dcb1c2578958823a
SHA1d512d61257db3b3e0e2352166ff36ccbdd30ed2f
SHA256d7a015829ff20cb652b4b68c628a2d86b48891bcc24ece7e5c833cdfde911b13
SHA51232c9181abf7b100930f45d4cfd5900770d5dd8a4852b007f3f72dc0caf5f8ad98315f50af9b006d2b523cf9af733da84d0569eff832c0c86b20ee1d6bf22ad71
-
Filesize
76KB
MD5571b5bf943a03b56627aae4ccb0841d9
SHA1fc0d40a3ed252ab6440466dda2db2967df18e7c6
SHA2564afa0c12a66a020512ea1674be986ea7210f067c38612ac74bc766e86b4283e3
SHA512e43bf28477b2da4d07a7134a9a6c54ad1ec348b6dfe93fdc43370f4afc6cbec2540036e8b38b9a45d1a579292a60fcfab580ac8d1c4ecc7b59df333359edf578
-
Filesize
408KB
MD5c59077448fd59ce09063897b1eb87a3f
SHA115b87c1bf598a0d86e7c0f944d3ce92ca725bc52
SHA2569a09a9c5f00142b896330f28871de647451161bcc3fa38d995f532707818ae37
SHA512c5d5199a63f1371d6a1bd5c229a6a4d4e7b5b1ea6c2d54a033ed1786b9f15df80055c84bd7ed90431657697cba8670d815adb247ecff543109102cc102bcaf94
-
Filesize
97KB
MD5f6359f5d25c9c280198d8b8b9ec193c3
SHA1667316902ae84a81795ecf3a8fab3f9e1b1d5b99
SHA25617d110bb960a583a7e94ee32a1901e6f08769a309637026c0ff91767319b2608
SHA512a2d2d88a7d77743a373d48c5d3457bdcbe14fd4db318968a19e5cb9897a8cb88397d43de3bb9957fe579ff59d0bcd92d021182547adc1d093f9d954740d5f1c9