Analysis
-
max time kernel
123s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 00:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe
Resource
win7-20240903-en
windows7-x64
14 signatures
150 seconds
General
-
Target
96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe
-
Size
198KB
-
MD5
c1c3ce2a3a279c936a5ca5a220c95014
-
SHA1
5b07dcaf48c5281e35df355683bc50171ab2d3d0
-
SHA256
96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b
-
SHA512
3291d93c94b889149c2d0a17c4838161edb54d08028089694c0bfebe71c630f7fac02357d25a41ecdd21efc0af335dba221f375dd2b348ce15dd14f7fb67dd54
-
SSDEEP
3072:YXLVpImRqLOUph/gDk8VUuXuWKZK36K7dQNq/oxnwX5c6LsXS5QRNd6/:MLVpOj4Dk8+cu9Kq65HISoNk
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe -
resource yara_rule behavioral1/memory/2420-8-0x0000000001D40000-0x0000000002DFA000-memory.dmp upx behavioral1/memory/2420-3-0x0000000001D40000-0x0000000002DFA000-memory.dmp upx behavioral1/memory/2420-1-0x0000000001D40000-0x0000000002DFA000-memory.dmp upx behavioral1/memory/2420-4-0x0000000001D40000-0x0000000002DFA000-memory.dmp upx behavioral1/memory/2420-22-0x0000000001D40000-0x0000000002DFA000-memory.dmp upx behavioral1/memory/2420-9-0x0000000001D40000-0x0000000002DFA000-memory.dmp upx behavioral1/memory/2420-7-0x0000000001D40000-0x0000000002DFA000-memory.dmp upx behavioral1/memory/2420-25-0x0000000001D40000-0x0000000002DFA000-memory.dmp upx behavioral1/memory/2420-5-0x0000000001D40000-0x0000000002DFA000-memory.dmp upx behavioral1/memory/2420-23-0x0000000001D40000-0x0000000002DFA000-memory.dmp upx behavioral1/memory/2420-47-0x0000000001D40000-0x0000000002DFA000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\f76ef10 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe File opened for modification C:\Windows\SYSTEM.INI 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeDebugPrivilege 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe Token: SeDebugPrivilege 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe Token: SeDebugPrivilege 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe Token: SeDebugPrivilege 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe Token: SeDebugPrivilege 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe Token: SeDebugPrivilege 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe Token: SeDebugPrivilege 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe Token: SeDebugPrivilege 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe Token: SeDebugPrivilege 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe Token: SeDebugPrivilege 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe Token: SeDebugPrivilege 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe Token: SeDebugPrivilege 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe Token: SeDebugPrivilege 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe Token: SeDebugPrivilege 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe Token: SeDebugPrivilege 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe Token: SeDebugPrivilege 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe Token: SeDebugPrivilege 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe Token: SeDebugPrivilege 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe Token: SeDebugPrivilege 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe Token: SeDebugPrivilege 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe Token: SeDebugPrivilege 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe Token: SeDebugPrivilege 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe Token: SeDebugPrivilege 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe Token: SeDebugPrivilege 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe Token: SeDebugPrivilege 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe Token: SeDebugPrivilege 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe Token: SeDebugPrivilege 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe Token: SeDebugPrivilege 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe -
Suspicious use of WriteProcessMemory 58 IoCs
description pid Process procid_target PID 2420 wrote to memory of 1108 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 19 PID 2420 wrote to memory of 1168 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 20 PID 2420 wrote to memory of 1200 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 21 PID 2420 wrote to memory of 1864 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 25 PID 2420 wrote to memory of 1108 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 19 PID 2420 wrote to memory of 1168 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 20 PID 2420 wrote to memory of 1200 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 21 PID 2420 wrote to memory of 1864 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 25 PID 2420 wrote to memory of 2556 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 30 PID 2420 wrote to memory of 1108 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 19 PID 2420 wrote to memory of 1168 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 20 PID 2420 wrote to memory of 1200 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 21 PID 2420 wrote to memory of 1864 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 25 PID 2420 wrote to memory of 2592 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 31 PID 2420 wrote to memory of 1108 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 19 PID 2420 wrote to memory of 1168 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 20 PID 2420 wrote to memory of 1200 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 21 PID 2420 wrote to memory of 1864 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 25 PID 2420 wrote to memory of 1108 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 19 PID 2420 wrote to memory of 1168 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 20 PID 2420 wrote to memory of 1200 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 21 PID 2420 wrote to memory of 1864 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 25 PID 2420 wrote to memory of 1108 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 19 PID 2420 wrote to memory of 1168 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 20 PID 2420 wrote to memory of 1200 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 21 PID 2420 wrote to memory of 1864 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 25 PID 2420 wrote to memory of 532 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 33 PID 2420 wrote to memory of 1108 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 19 PID 2420 wrote to memory of 1168 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 20 PID 2420 wrote to memory of 1200 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 21 PID 2420 wrote to memory of 1864 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 25 PID 2420 wrote to memory of 2144 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 34 PID 2420 wrote to memory of 1108 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 19 PID 2420 wrote to memory of 1168 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 20 PID 2420 wrote to memory of 1200 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 21 PID 2420 wrote to memory of 1864 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 25 PID 2420 wrote to memory of 1108 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 19 PID 2420 wrote to memory of 1168 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 20 PID 2420 wrote to memory of 1200 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 21 PID 2420 wrote to memory of 1864 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 25 PID 2420 wrote to memory of 1108 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 19 PID 2420 wrote to memory of 1168 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 20 PID 2420 wrote to memory of 1200 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 21 PID 2420 wrote to memory of 1864 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 25 PID 2420 wrote to memory of 2308 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 37 PID 2420 wrote to memory of 1108 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 19 PID 2420 wrote to memory of 1168 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 20 PID 2420 wrote to memory of 1200 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 21 PID 2420 wrote to memory of 1864 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 25 PID 2420 wrote to memory of 1108 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 19 PID 2420 wrote to memory of 1168 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 20 PID 2420 wrote to memory of 1200 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 21 PID 2420 wrote to memory of 1864 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 25 PID 2420 wrote to memory of 1108 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 19 PID 2420 wrote to memory of 1168 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 20 PID 2420 wrote to memory of 1200 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 21 PID 2420 wrote to memory of 1864 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 25 PID 2420 wrote to memory of 1720 2420 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe 39 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1108
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1168
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe"C:\Users\Admin\AppData\Local\Temp\96c81b5d4d89769dce3c7affd5ce246b16d8990086b7a0c3e979c806993c8b0b.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2420
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1864
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵PID:2556
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵PID:2592
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵PID:532
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵PID:2144
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵PID:2308
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵PID:1720
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5