Analysis
-
max time kernel
30s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 00:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7e72095dc929622d7806f4a6a1abc628f54605f47f9c29e1535bf31ca174fee1.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
120 seconds
General
-
Target
7e72095dc929622d7806f4a6a1abc628f54605f47f9c29e1535bf31ca174fee1.dll
-
Size
120KB
-
MD5
7f1fa28da60fbbc5141dd2cbf7acb0d4
-
SHA1
fbc5bfd1e59f0656d8faa4428992ba35f70c0111
-
SHA256
7e72095dc929622d7806f4a6a1abc628f54605f47f9c29e1535bf31ca174fee1
-
SHA512
ba80e9c36759155bca40f394a1df5163a14560e4642f59ed48fba0a2227239fbdf5eddeab8e291e874d37f3ec993def15a19be61edda874212abf5254e63abf6
-
SSDEEP
3072:6MZLCImgW99TlBMDWxmOYRJZS5TEYbVqNZ:1BCqmdQB3IRJqNZ
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76cd0f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76cd0f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76b136.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76b2bc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76b2bc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76cd0f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76b136.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76b136.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76b2bc.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b136.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b2bc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76cd0f.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b136.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76cd0f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b136.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b136.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b2bc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b2bc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76cd0f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76cd0f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b136.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b136.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b2bc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76cd0f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76cd0f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76cd0f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b136.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b2bc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b2bc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b2bc.exe -
Executes dropped EXE 3 IoCs
pid Process 2468 f76b136.exe 2664 f76b2bc.exe 1864 f76cd0f.exe -
Loads dropped DLL 6 IoCs
pid Process 1768 rundll32.exe 1768 rundll32.exe 1768 rundll32.exe 1768 rundll32.exe 1768 rundll32.exe 1768 rundll32.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76b2bc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76cd0f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76cd0f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76cd0f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b136.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b2bc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b2bc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b2bc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76cd0f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76cd0f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b136.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b2bc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b136.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b2bc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b136.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76b136.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b2bc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76cd0f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76cd0f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b136.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b136.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b2bc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76cd0f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b136.exe -
Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: f76b136.exe File opened (read-only) \??\H: f76b136.exe File opened (read-only) \??\S: f76b136.exe File opened (read-only) \??\T: f76b136.exe File opened (read-only) \??\G: f76cd0f.exe File opened (read-only) \??\E: f76b136.exe File opened (read-only) \??\N: f76b136.exe File opened (read-only) \??\P: f76b136.exe File opened (read-only) \??\Q: f76b136.exe File opened (read-only) \??\I: f76b136.exe File opened (read-only) \??\K: f76b136.exe File opened (read-only) \??\L: f76b136.exe File opened (read-only) \??\M: f76b136.exe File opened (read-only) \??\E: f76cd0f.exe File opened (read-only) \??\J: f76b136.exe File opened (read-only) \??\R: f76b136.exe File opened (read-only) \??\O: f76b136.exe -
resource yara_rule behavioral1/memory/2468-11-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2468-17-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2468-22-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2468-13-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2468-16-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2468-18-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2468-14-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2468-21-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2468-20-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2468-15-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2468-19-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2468-62-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2468-61-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2468-63-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2468-65-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2468-64-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2468-67-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2468-68-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2468-84-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2468-85-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2468-87-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2468-106-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2468-156-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2664-165-0x0000000000930000-0x00000000019EA000-memory.dmp upx behavioral1/memory/1864-189-0x0000000000920000-0x00000000019DA000-memory.dmp upx behavioral1/memory/1864-217-0x0000000000920000-0x00000000019DA000-memory.dmp upx -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\f76b184 f76b136.exe File opened for modification C:\Windows\SYSTEM.INI f76b136.exe File created C:\Windows\f770129 f76b2bc.exe File created C:\Windows\f7701a6 f76cd0f.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76b136.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76cd0f.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2468 f76b136.exe 2468 f76b136.exe 1864 f76cd0f.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 2468 f76b136.exe Token: SeDebugPrivilege 2468 f76b136.exe Token: SeDebugPrivilege 2468 f76b136.exe Token: SeDebugPrivilege 2468 f76b136.exe Token: SeDebugPrivilege 2468 f76b136.exe Token: SeDebugPrivilege 2468 f76b136.exe Token: SeDebugPrivilege 2468 f76b136.exe Token: SeDebugPrivilege 2468 f76b136.exe Token: SeDebugPrivilege 2468 f76b136.exe Token: SeDebugPrivilege 2468 f76b136.exe Token: SeDebugPrivilege 2468 f76b136.exe Token: SeDebugPrivilege 2468 f76b136.exe Token: SeDebugPrivilege 2468 f76b136.exe Token: SeDebugPrivilege 2468 f76b136.exe Token: SeDebugPrivilege 2468 f76b136.exe Token: SeDebugPrivilege 2468 f76b136.exe Token: SeDebugPrivilege 2468 f76b136.exe Token: SeDebugPrivilege 2468 f76b136.exe Token: SeDebugPrivilege 2468 f76b136.exe Token: SeDebugPrivilege 2468 f76b136.exe Token: SeDebugPrivilege 2468 f76b136.exe Token: SeDebugPrivilege 2468 f76b136.exe Token: SeDebugPrivilege 2468 f76b136.exe Token: SeDebugPrivilege 2468 f76b136.exe Token: SeDebugPrivilege 1864 f76cd0f.exe Token: SeDebugPrivilege 1864 f76cd0f.exe Token: SeDebugPrivilege 1864 f76cd0f.exe Token: SeDebugPrivilege 1864 f76cd0f.exe Token: SeDebugPrivilege 1864 f76cd0f.exe Token: SeDebugPrivilege 1864 f76cd0f.exe Token: SeDebugPrivilege 1864 f76cd0f.exe Token: SeDebugPrivilege 1864 f76cd0f.exe Token: SeDebugPrivilege 1864 f76cd0f.exe Token: SeDebugPrivilege 1864 f76cd0f.exe Token: SeDebugPrivilege 1864 f76cd0f.exe Token: SeDebugPrivilege 1864 f76cd0f.exe Token: SeDebugPrivilege 1864 f76cd0f.exe Token: SeDebugPrivilege 1864 f76cd0f.exe Token: SeDebugPrivilege 1864 f76cd0f.exe Token: SeDebugPrivilege 1864 f76cd0f.exe Token: SeDebugPrivilege 1864 f76cd0f.exe Token: SeDebugPrivilege 1864 f76cd0f.exe Token: SeDebugPrivilege 1864 f76cd0f.exe Token: SeDebugPrivilege 1864 f76cd0f.exe Token: SeDebugPrivilege 1864 f76cd0f.exe Token: SeDebugPrivilege 1864 f76cd0f.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2348 wrote to memory of 1768 2348 rundll32.exe 30 PID 2348 wrote to memory of 1768 2348 rundll32.exe 30 PID 2348 wrote to memory of 1768 2348 rundll32.exe 30 PID 2348 wrote to memory of 1768 2348 rundll32.exe 30 PID 2348 wrote to memory of 1768 2348 rundll32.exe 30 PID 2348 wrote to memory of 1768 2348 rundll32.exe 30 PID 2348 wrote to memory of 1768 2348 rundll32.exe 30 PID 1768 wrote to memory of 2468 1768 rundll32.exe 31 PID 1768 wrote to memory of 2468 1768 rundll32.exe 31 PID 1768 wrote to memory of 2468 1768 rundll32.exe 31 PID 1768 wrote to memory of 2468 1768 rundll32.exe 31 PID 2468 wrote to memory of 1108 2468 f76b136.exe 19 PID 2468 wrote to memory of 1172 2468 f76b136.exe 20 PID 2468 wrote to memory of 1196 2468 f76b136.exe 21 PID 2468 wrote to memory of 2028 2468 f76b136.exe 23 PID 2468 wrote to memory of 2348 2468 f76b136.exe 29 PID 2468 wrote to memory of 1768 2468 f76b136.exe 30 PID 2468 wrote to memory of 1768 2468 f76b136.exe 30 PID 1768 wrote to memory of 2664 1768 rundll32.exe 32 PID 1768 wrote to memory of 2664 1768 rundll32.exe 32 PID 1768 wrote to memory of 2664 1768 rundll32.exe 32 PID 1768 wrote to memory of 2664 1768 rundll32.exe 32 PID 1768 wrote to memory of 1864 1768 rundll32.exe 34 PID 1768 wrote to memory of 1864 1768 rundll32.exe 34 PID 1768 wrote to memory of 1864 1768 rundll32.exe 34 PID 1768 wrote to memory of 1864 1768 rundll32.exe 34 PID 2468 wrote to memory of 1108 2468 f76b136.exe 19 PID 2468 wrote to memory of 1172 2468 f76b136.exe 20 PID 2468 wrote to memory of 1196 2468 f76b136.exe 21 PID 2468 wrote to memory of 2028 2468 f76b136.exe 23 PID 2468 wrote to memory of 2664 2468 f76b136.exe 32 PID 2468 wrote to memory of 2664 2468 f76b136.exe 32 PID 2468 wrote to memory of 1864 2468 f76b136.exe 34 PID 2468 wrote to memory of 1864 2468 f76b136.exe 34 PID 1864 wrote to memory of 1108 1864 f76cd0f.exe 19 PID 1864 wrote to memory of 1172 1864 f76cd0f.exe 20 PID 1864 wrote to memory of 1196 1864 f76cd0f.exe 21 PID 1864 wrote to memory of 2028 1864 f76cd0f.exe 23 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76cd0f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b136.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b2bc.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1108
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1172
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1196
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7e72095dc929622d7806f4a6a1abc628f54605f47f9c29e1535bf31ca174fee1.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7e72095dc929622d7806f4a6a1abc628f54605f47f9c29e1535bf31ca174fee1.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\f76b136.exeC:\Users\Admin\AppData\Local\Temp\f76b136.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2468
-
-
C:\Users\Admin\AppData\Local\Temp\f76b2bc.exeC:\Users\Admin\AppData\Local\Temp\f76b2bc.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System policy modification
PID:2664
-
-
C:\Users\Admin\AppData\Local\Temp\f76cd0f.exeC:\Users\Admin\AppData\Local\Temp\f76cd0f.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1864
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:2028
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD54bd5d8ac3b9415241806adcb9016c105
SHA1940ad8badb2cadd2bbcc4edcdd84c457defa1595
SHA2565bd1735b87bc4e7e9bb4485dee5ded2daccfb4c7c943571166ae65c7398e16f9
SHA512214926a2d00a7e9c712ab130c8e71b5f9735276e910c2620769d995f7370cd456a2bb4a3b41c3ce9f83e57a9b4bc833e681542879a86815df10d7c22476c8722
-
Filesize
97KB
MD561256d5a731e0b42aab3cc3c8e2d1e2e
SHA1a6507b09d7fa2c478b22fa0d4b3f22ff492f2250
SHA2562206b728cd5d5c40609789d2a96de396c6ad2158a6c4f927b9ffd1407000faca
SHA512a5c7e01175705279bc93a1766dfad47726a9055dc3dc3838ff7e392c895751373b36db98d8880109070cab2b0d8b227c270290e2171f224dc3c855ca2e490ac6