Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 03:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2e0f18f4abe1e563ca5f48fa71ac3636d6c4964ee8f41932c1e15f3b03d559a3.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
150 seconds
General
-
Target
2e0f18f4abe1e563ca5f48fa71ac3636d6c4964ee8f41932c1e15f3b03d559a3.dll
-
Size
120KB
-
MD5
4f84da1735f64fdfa4c85ab5a088bedc
-
SHA1
95ecf60e0ee5d73a67dce7b694a4354239e3265d
-
SHA256
2e0f18f4abe1e563ca5f48fa71ac3636d6c4964ee8f41932c1e15f3b03d559a3
-
SHA512
af845dbbe18854219e356f77bda5962840df6235fa449d96eed1be3965b36f3ac3696ec4158bdb6de288434c1b38f9945a0be7dc5562e39088ac7fd139342c85
-
SSDEEP
3072:CjC8+52JfyUtXx/DlJ6hDLCnzTr667fDd72BSI:ClLZ7ZJ6hDunnrr7fDB2d
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76b9cd.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76b9cd.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76d411.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76b9cd.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76d411.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76d411.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76b867.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76b867.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76b867.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b867.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b9cd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76d411.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b867.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b9cd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b9cd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76d411.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b867.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b867.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b9cd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b9cd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b9cd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76d411.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b867.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b867.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b867.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b9cd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76d411.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76d411.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76d411.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76d411.exe -
Executes dropped EXE 3 IoCs
pid Process 2388 f76b867.exe 3044 f76b9cd.exe 2740 f76d411.exe -
Loads dropped DLL 6 IoCs
pid Process 1724 rundll32.exe 1724 rundll32.exe 1724 rundll32.exe 1724 rundll32.exe 1724 rundll32.exe 1724 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b867.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b9cd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76d411.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76b867.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b9cd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b9cd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76d411.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76b9cd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76d411.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76d411.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76d411.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b867.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b867.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b867.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b9cd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76d411.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76d411.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b867.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b867.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b9cd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b9cd.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b867.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b9cd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76d411.exe -
Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: f76b867.exe File opened (read-only) \??\H: f76b867.exe File opened (read-only) \??\L: f76b867.exe File opened (read-only) \??\S: f76b867.exe File opened (read-only) \??\E: f76d411.exe File opened (read-only) \??\E: f76b867.exe File opened (read-only) \??\N: f76b867.exe File opened (read-only) \??\M: f76b867.exe File opened (read-only) \??\Q: f76b867.exe File opened (read-only) \??\R: f76b867.exe File opened (read-only) \??\I: f76b867.exe File opened (read-only) \??\K: f76b867.exe File opened (read-only) \??\O: f76b867.exe File opened (read-only) \??\P: f76b867.exe File opened (read-only) \??\G: f76d411.exe File opened (read-only) \??\G: f76b867.exe File opened (read-only) \??\J: f76b867.exe -
resource yara_rule behavioral1/memory/2388-18-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2388-22-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2388-24-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2388-23-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2388-21-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2388-19-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2388-17-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2388-25-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2388-16-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2388-20-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2388-65-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2388-66-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2388-67-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2388-68-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2388-69-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2388-71-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2388-72-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2388-87-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2388-89-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2388-90-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/2388-158-0x00000000005B0000-0x000000000166A000-memory.dmp upx behavioral1/memory/3044-210-0x0000000000910000-0x00000000019CA000-memory.dmp upx -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\f77083b f76b9cd.exe File created C:\Windows\f7709d0 f76d411.exe File created C:\Windows\f76b8a5 f76b867.exe File opened for modification C:\Windows\SYSTEM.INI f76b867.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76b867.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76b9cd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76d411.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2388 f76b867.exe 2388 f76b867.exe 3044 f76b9cd.exe 2740 f76d411.exe -
Suspicious use of AdjustPrivilegeToken 47 IoCs
description pid Process Token: SeDebugPrivilege 2388 f76b867.exe Token: SeDebugPrivilege 2388 f76b867.exe Token: SeDebugPrivilege 2388 f76b867.exe Token: SeDebugPrivilege 2388 f76b867.exe Token: SeDebugPrivilege 2388 f76b867.exe Token: SeDebugPrivilege 2388 f76b867.exe Token: SeDebugPrivilege 2388 f76b867.exe Token: SeDebugPrivilege 2388 f76b867.exe Token: SeDebugPrivilege 2388 f76b867.exe Token: SeDebugPrivilege 2388 f76b867.exe Token: SeDebugPrivilege 2388 f76b867.exe Token: SeDebugPrivilege 2388 f76b867.exe Token: SeDebugPrivilege 2388 f76b867.exe Token: SeDebugPrivilege 2388 f76b867.exe Token: SeDebugPrivilege 2388 f76b867.exe Token: SeDebugPrivilege 2388 f76b867.exe Token: SeDebugPrivilege 2388 f76b867.exe Token: SeDebugPrivilege 2388 f76b867.exe Token: SeDebugPrivilege 2388 f76b867.exe Token: SeDebugPrivilege 2388 f76b867.exe Token: SeDebugPrivilege 2388 f76b867.exe Token: SeDebugPrivilege 2388 f76b867.exe Token: SeDebugPrivilege 2388 f76b867.exe Token: SeDebugPrivilege 2388 f76b867.exe Token: SeDebugPrivilege 3044 f76b9cd.exe Token: SeDebugPrivilege 2740 f76d411.exe Token: SeDebugPrivilege 2740 f76d411.exe Token: SeDebugPrivilege 2740 f76d411.exe Token: SeDebugPrivilege 2740 f76d411.exe Token: SeDebugPrivilege 2740 f76d411.exe Token: SeDebugPrivilege 2740 f76d411.exe Token: SeDebugPrivilege 2740 f76d411.exe Token: SeDebugPrivilege 2740 f76d411.exe Token: SeDebugPrivilege 2740 f76d411.exe Token: SeDebugPrivilege 2740 f76d411.exe Token: SeDebugPrivilege 2740 f76d411.exe Token: SeDebugPrivilege 2740 f76d411.exe Token: SeDebugPrivilege 2740 f76d411.exe Token: SeDebugPrivilege 2740 f76d411.exe Token: SeDebugPrivilege 2740 f76d411.exe Token: SeDebugPrivilege 2740 f76d411.exe Token: SeDebugPrivilege 2740 f76d411.exe Token: SeDebugPrivilege 2740 f76d411.exe Token: SeDebugPrivilege 2740 f76d411.exe Token: SeDebugPrivilege 2740 f76d411.exe Token: SeDebugPrivilege 2740 f76d411.exe Token: SeDebugPrivilege 2740 f76d411.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2008 wrote to memory of 1724 2008 rundll32.exe 30 PID 2008 wrote to memory of 1724 2008 rundll32.exe 30 PID 2008 wrote to memory of 1724 2008 rundll32.exe 30 PID 2008 wrote to memory of 1724 2008 rundll32.exe 30 PID 2008 wrote to memory of 1724 2008 rundll32.exe 30 PID 2008 wrote to memory of 1724 2008 rundll32.exe 30 PID 2008 wrote to memory of 1724 2008 rundll32.exe 30 PID 1724 wrote to memory of 2388 1724 rundll32.exe 31 PID 1724 wrote to memory of 2388 1724 rundll32.exe 31 PID 1724 wrote to memory of 2388 1724 rundll32.exe 31 PID 1724 wrote to memory of 2388 1724 rundll32.exe 31 PID 2388 wrote to memory of 1120 2388 f76b867.exe 19 PID 2388 wrote to memory of 1168 2388 f76b867.exe 20 PID 2388 wrote to memory of 1200 2388 f76b867.exe 21 PID 2388 wrote to memory of 2040 2388 f76b867.exe 23 PID 2388 wrote to memory of 2008 2388 f76b867.exe 29 PID 2388 wrote to memory of 1724 2388 f76b867.exe 30 PID 2388 wrote to memory of 1724 2388 f76b867.exe 30 PID 1724 wrote to memory of 3044 1724 rundll32.exe 32 PID 1724 wrote to memory of 3044 1724 rundll32.exe 32 PID 1724 wrote to memory of 3044 1724 rundll32.exe 32 PID 1724 wrote to memory of 3044 1724 rundll32.exe 32 PID 1724 wrote to memory of 2740 1724 rundll32.exe 34 PID 1724 wrote to memory of 2740 1724 rundll32.exe 34 PID 1724 wrote to memory of 2740 1724 rundll32.exe 34 PID 1724 wrote to memory of 2740 1724 rundll32.exe 34 PID 2388 wrote to memory of 1120 2388 f76b867.exe 19 PID 2388 wrote to memory of 1168 2388 f76b867.exe 20 PID 2388 wrote to memory of 1200 2388 f76b867.exe 21 PID 2388 wrote to memory of 2040 2388 f76b867.exe 23 PID 2388 wrote to memory of 3044 2388 f76b867.exe 32 PID 2388 wrote to memory of 3044 2388 f76b867.exe 32 PID 2388 wrote to memory of 2740 2388 f76b867.exe 34 PID 2388 wrote to memory of 2740 2388 f76b867.exe 34 PID 2740 wrote to memory of 1120 2740 f76d411.exe 19 PID 2740 wrote to memory of 1168 2740 f76d411.exe 20 PID 2740 wrote to memory of 1200 2740 f76d411.exe 21 PID 2740 wrote to memory of 2040 2740 f76d411.exe 23 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b9cd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76d411.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b867.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1120
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1168
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1200
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2e0f18f4abe1e563ca5f48fa71ac3636d6c4964ee8f41932c1e15f3b03d559a3.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2e0f18f4abe1e563ca5f48fa71ac3636d6c4964ee8f41932c1e15f3b03d559a3.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\f76b867.exeC:\Users\Admin\AppData\Local\Temp\f76b867.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2388
-
-
C:\Users\Admin\AppData\Local\Temp\f76b9cd.exeC:\Users\Admin\AppData\Local\Temp\f76b9cd.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:3044
-
-
C:\Users\Admin\AppData\Local\Temp\f76d411.exeC:\Users\Admin\AppData\Local\Temp\f76d411.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2740
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:2040
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD5c597b27b0cc022c3e237972a7d693fe2
SHA113981a39a000efe4ecfc57c96f07ece1135948ec
SHA2567be4d8e0ec7533cb214a1d276715d9f450c58cfbbdef96d887f17d9aae521d5c
SHA512c0906ebc27872ab0628e863d426f17d665bfdefd4f13c2ebdeb83c07896f76a1c7ddca80ca52cfc6ff393baa70821d5fea74e6c491c1569b6fb3022c4c92961b
-
Filesize
97KB
MD530cd8bd3b20d109bd6392e13892591c5
SHA1c6a79c2d60ceb979f825d44c1b0c3b8b819a3fa2
SHA2563ca6b21cd3ceb61bac6d47bb6760c9b327fa1eaf7bbe30dce0960508857a34be
SHA5129b36db6fe29ea79c507aec10537b0f34d079508cd356cd82b515c173a6665bbbff64921d596d12891d49a3ce00781a7d69d2bd351844ea92c8d4da9844bbb5b9