Analysis
-
max time kernel
95s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2024 02:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
746c0fe86591053f1ea725fcab7565f35e68a478df0986c90348d6b3b55b378aN.dll
Resource
win7-20241010-en
windows7-x64
17 signatures
120 seconds
General
-
Target
746c0fe86591053f1ea725fcab7565f35e68a478df0986c90348d6b3b55b378aN.dll
-
Size
120KB
-
MD5
e8a27bee4e760df95630308d2a2abac0
-
SHA1
09c3a329b9ebe953204d33789e3720656685a113
-
SHA256
746c0fe86591053f1ea725fcab7565f35e68a478df0986c90348d6b3b55b378a
-
SHA512
2670fa60b05786c13fc65136ec5050b102d48349e10d2c1e92b005e14a6a440f1d38c28bbc9bca79548b2f4d68a9d9b27afc428aadc332c9f4e02d420971bb57
-
SSDEEP
1536:d0XABLeJknstOt4MbTwMCpp/S6dep8CmohOP0R1hYUWU0mgy/eF0PymPXfnlP3ZM:TWMMy4YwMupK6H2W0fejmPXfnlPJM
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57e678.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57e678.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57e678.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57b8d0.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57b8d0.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57b8d0.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57b8d0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57e678.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57b8d0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57b8d0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57e678.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57e678.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57e678.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57b8d0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57b8d0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57b8d0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57b8d0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57e678.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57e678.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57e678.exe -
Executes dropped EXE 3 IoCs
pid Process 4492 e57b8d0.exe 3944 e57b9ab.exe 4064 e57e678.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57b8d0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57b8d0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57b8d0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57b8d0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57e678.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57e678.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57e678.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57b8d0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57b8d0.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57b8d0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57e678.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57e678.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57e678.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57e678.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57b8d0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57e678.exe -
Enumerates connected drives 3 TTPs 13 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: e57b8d0.exe File opened (read-only) \??\G: e57b8d0.exe File opened (read-only) \??\H: e57b8d0.exe File opened (read-only) \??\K: e57b8d0.exe File opened (read-only) \??\M: e57b8d0.exe File opened (read-only) \??\H: e57e678.exe File opened (read-only) \??\I: e57b8d0.exe File opened (read-only) \??\J: e57b8d0.exe File opened (read-only) \??\L: e57b8d0.exe File opened (read-only) \??\E: e57e678.exe File opened (read-only) \??\G: e57e678.exe File opened (read-only) \??\I: e57e678.exe File opened (read-only) \??\J: e57e678.exe -
resource yara_rule behavioral2/memory/4492-8-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4492-9-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4492-10-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4492-22-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4492-34-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4492-35-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4492-12-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4492-20-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4492-21-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4492-11-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4492-6-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4492-36-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4492-37-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4492-38-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4492-43-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4492-44-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4492-53-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4492-54-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4492-57-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4492-58-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4492-59-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4492-61-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4492-64-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4492-67-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4492-68-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/4064-92-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4064-123-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/4064-148-0x00000000007C0000-0x000000000187A000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e57b92e e57b8d0.exe File opened for modification C:\Windows\SYSTEM.INI e57b8d0.exe File created C:\Windows\e580df5 e57e678.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57b8d0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57b9ab.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57e678.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4492 e57b8d0.exe 4492 e57b8d0.exe 4492 e57b8d0.exe 4492 e57b8d0.exe 4064 e57e678.exe 4064 e57e678.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe Token: SeDebugPrivilege 4492 e57b8d0.exe -
Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 212 wrote to memory of 2244 212 rundll32.exe 82 PID 212 wrote to memory of 2244 212 rundll32.exe 82 PID 212 wrote to memory of 2244 212 rundll32.exe 82 PID 2244 wrote to memory of 4492 2244 rundll32.exe 83 PID 2244 wrote to memory of 4492 2244 rundll32.exe 83 PID 2244 wrote to memory of 4492 2244 rundll32.exe 83 PID 4492 wrote to memory of 784 4492 e57b8d0.exe 8 PID 4492 wrote to memory of 788 4492 e57b8d0.exe 9 PID 4492 wrote to memory of 380 4492 e57b8d0.exe 13 PID 4492 wrote to memory of 2896 4492 e57b8d0.exe 50 PID 4492 wrote to memory of 2948 4492 e57b8d0.exe 51 PID 4492 wrote to memory of 3060 4492 e57b8d0.exe 52 PID 4492 wrote to memory of 3500 4492 e57b8d0.exe 56 PID 4492 wrote to memory of 3624 4492 e57b8d0.exe 57 PID 4492 wrote to memory of 3832 4492 e57b8d0.exe 58 PID 4492 wrote to memory of 3920 4492 e57b8d0.exe 59 PID 4492 wrote to memory of 3984 4492 e57b8d0.exe 60 PID 4492 wrote to memory of 4088 4492 e57b8d0.exe 61 PID 4492 wrote to memory of 3864 4492 e57b8d0.exe 62 PID 4492 wrote to memory of 1704 4492 e57b8d0.exe 64 PID 4492 wrote to memory of 1768 4492 e57b8d0.exe 75 PID 4492 wrote to memory of 212 4492 e57b8d0.exe 81 PID 4492 wrote to memory of 2244 4492 e57b8d0.exe 82 PID 4492 wrote to memory of 2244 4492 e57b8d0.exe 82 PID 2244 wrote to memory of 3944 2244 rundll32.exe 84 PID 2244 wrote to memory of 3944 2244 rundll32.exe 84 PID 2244 wrote to memory of 3944 2244 rundll32.exe 84 PID 4492 wrote to memory of 784 4492 e57b8d0.exe 8 PID 4492 wrote to memory of 788 4492 e57b8d0.exe 9 PID 4492 wrote to memory of 380 4492 e57b8d0.exe 13 PID 4492 wrote to memory of 2896 4492 e57b8d0.exe 50 PID 4492 wrote to memory of 2948 4492 e57b8d0.exe 51 PID 4492 wrote to memory of 3060 4492 e57b8d0.exe 52 PID 4492 wrote to memory of 3500 4492 e57b8d0.exe 56 PID 4492 wrote to memory of 3624 4492 e57b8d0.exe 57 PID 4492 wrote to memory of 3832 4492 e57b8d0.exe 58 PID 4492 wrote to memory of 3920 4492 e57b8d0.exe 59 PID 4492 wrote to memory of 3984 4492 e57b8d0.exe 60 PID 4492 wrote to memory of 4088 4492 e57b8d0.exe 61 PID 4492 wrote to memory of 3864 4492 e57b8d0.exe 62 PID 4492 wrote to memory of 1704 4492 e57b8d0.exe 64 PID 4492 wrote to memory of 1768 4492 e57b8d0.exe 75 PID 4492 wrote to memory of 212 4492 e57b8d0.exe 81 PID 4492 wrote to memory of 3944 4492 e57b8d0.exe 84 PID 4492 wrote to memory of 3944 4492 e57b8d0.exe 84 PID 2244 wrote to memory of 4064 2244 rundll32.exe 85 PID 2244 wrote to memory of 4064 2244 rundll32.exe 85 PID 2244 wrote to memory of 4064 2244 rundll32.exe 85 PID 4064 wrote to memory of 784 4064 e57e678.exe 8 PID 4064 wrote to memory of 788 4064 e57e678.exe 9 PID 4064 wrote to memory of 380 4064 e57e678.exe 13 PID 4064 wrote to memory of 2896 4064 e57e678.exe 50 PID 4064 wrote to memory of 2948 4064 e57e678.exe 51 PID 4064 wrote to memory of 3060 4064 e57e678.exe 52 PID 4064 wrote to memory of 3500 4064 e57e678.exe 56 PID 4064 wrote to memory of 3624 4064 e57e678.exe 57 PID 4064 wrote to memory of 3832 4064 e57e678.exe 58 PID 4064 wrote to memory of 3920 4064 e57e678.exe 59 PID 4064 wrote to memory of 3984 4064 e57e678.exe 60 PID 4064 wrote to memory of 4088 4064 e57e678.exe 61 PID 4064 wrote to memory of 3864 4064 e57e678.exe 62 PID 4064 wrote to memory of 1704 4064 e57e678.exe 64 PID 4064 wrote to memory of 1768 4064 e57e678.exe 75 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57b8d0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57e678.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:380
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2896
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2948
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3060
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3500
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\746c0fe86591053f1ea725fcab7565f35e68a478df0986c90348d6b3b55b378aN.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\746c0fe86591053f1ea725fcab7565f35e68a478df0986c90348d6b3b55b378aN.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\e57b8d0.exeC:\Users\Admin\AppData\Local\Temp\e57b8d0.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4492
-
-
C:\Users\Admin\AppData\Local\Temp\e57b9ab.exeC:\Users\Admin\AppData\Local\Temp\e57b9ab.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3944
-
-
C:\Users\Admin\AppData\Local\Temp\e57e678.exeC:\Users\Admin\AppData\Local\Temp\e57e678.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4064
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3624
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3832
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3920
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3984
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4088
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3864
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1704
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:1768
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5a75a1d639b9313538aea2685dd7fd72d
SHA1eec408517006da9f16d5f41d7b327b26c00e57a6
SHA256a06a57e457092a0cbc22cc4778eb8ed4739561f700eecdea7a10432218f6574a
SHA5124f195525198478b0feabb909e1849a671cc993a2b90425aa436e05612130dc8f40869d0d3753771a90a36ab1690ca9230ffe6adb603f04879185f5d4758395e6
-
Filesize
257B
MD5a0cb0b20c58c08d2799c44543086036b
SHA15fe8f78a95c1a3f012be85ec79b5f4c5637b26c2
SHA256ad24af63b2ac9dc917cef609504a58b8bfdccb053d0cd58692745ce0292070d7
SHA5127883cf0cf4e5386b37474189339aef40086b02f8794d51e2f1d16019cc3ad4fc95c1a898a7d3f48c99322f2057bdbbd8d219287c3fe2163183d4035016103521