Analysis
-
max time kernel
96s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 05:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a0aad044624bd7fcf04b980d56e3a760ed5c40def10270eb383bc07899b93230N.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
120 seconds
General
-
Target
a0aad044624bd7fcf04b980d56e3a760ed5c40def10270eb383bc07899b93230N.dll
-
Size
120KB
-
MD5
ba84d20d3ae1aaee8c0056175c687c60
-
SHA1
97cce977ec0fb7ea6d371a0b2626587d53a3d76f
-
SHA256
a0aad044624bd7fcf04b980d56e3a760ed5c40def10270eb383bc07899b93230
-
SHA512
f137c329749cf60ee93258c944fd54055b847123e6787f829566e5ae14e46adc9fa581d9fc5f7c3929f5f7ddb11578ed7a73ab5afa95884c479289352185bc8c
-
SSDEEP
1536:ZIdrNcPnh0c23d7KLzLuvU9nGCfcP5t7rP+LqxhEA6tddQ0aocWsDpO0wdCSG/ub:ZIxN+h0lNRvkmP7DEI8Q0JVi9zE
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57760b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57760b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57760b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e579172.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e579172.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e579172.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57760b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e579172.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57760b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57760b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57760b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57760b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e579172.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e579172.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57760b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57760b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e579172.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e579172.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e579172.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e579172.exe -
Executes dropped EXE 4 IoCs
pid Process 3248 e57760b.exe 1036 e577762.exe 4000 e579172.exe 2140 e579191.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57760b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57760b.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e579172.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e579172.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57760b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57760b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e579172.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57760b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e579172.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e579172.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e579172.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57760b.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57760b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e579172.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57760b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e579172.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: e57760b.exe File opened (read-only) \??\R: e57760b.exe File opened (read-only) \??\K: e57760b.exe File opened (read-only) \??\L: e57760b.exe File opened (read-only) \??\O: e57760b.exe File opened (read-only) \??\G: e57760b.exe File opened (read-only) \??\S: e57760b.exe File opened (read-only) \??\T: e57760b.exe File opened (read-only) \??\P: e57760b.exe File opened (read-only) \??\I: e57760b.exe File opened (read-only) \??\J: e57760b.exe File opened (read-only) \??\N: e57760b.exe File opened (read-only) \??\E: e57760b.exe File opened (read-only) \??\H: e57760b.exe File opened (read-only) \??\M: e57760b.exe -
resource yara_rule behavioral2/memory/3248-10-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/3248-11-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/3248-9-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/3248-8-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/3248-13-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/3248-12-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/3248-18-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/3248-29-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/3248-28-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/3248-6-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/3248-35-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/3248-36-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/3248-37-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/3248-38-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/3248-39-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/3248-41-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/3248-42-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/3248-55-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/3248-57-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/3248-58-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/3248-73-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/3248-75-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/3248-78-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/3248-79-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/3248-81-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/3248-84-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/3248-83-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/3248-86-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/3248-87-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/3248-88-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/3248-95-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/3248-94-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/4000-143-0x0000000000B60000-0x0000000001C1A000-memory.dmp upx -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7zG.exe e57760b.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e57760b.exe File opened for modification C:\Program Files\7-Zip\7z.exe e57760b.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e57760b.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e577688 e57760b.exe File opened for modification C:\Windows\SYSTEM.INI e57760b.exe File created C:\Windows\e57dff0 e579172.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57760b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e577762.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e579172.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e579191.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3248 e57760b.exe 3248 e57760b.exe 3248 e57760b.exe 3248 e57760b.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe Token: SeDebugPrivilege 3248 e57760b.exe -
Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 2324 wrote to memory of 4708 2324 rundll32.exe 82 PID 2324 wrote to memory of 4708 2324 rundll32.exe 82 PID 2324 wrote to memory of 4708 2324 rundll32.exe 82 PID 4708 wrote to memory of 3248 4708 rundll32.exe 83 PID 4708 wrote to memory of 3248 4708 rundll32.exe 83 PID 4708 wrote to memory of 3248 4708 rundll32.exe 83 PID 3248 wrote to memory of 776 3248 e57760b.exe 9 PID 3248 wrote to memory of 780 3248 e57760b.exe 10 PID 3248 wrote to memory of 1020 3248 e57760b.exe 13 PID 3248 wrote to memory of 2944 3248 e57760b.exe 50 PID 3248 wrote to memory of 3000 3248 e57760b.exe 51 PID 3248 wrote to memory of 3060 3248 e57760b.exe 52 PID 3248 wrote to memory of 3428 3248 e57760b.exe 56 PID 3248 wrote to memory of 3544 3248 e57760b.exe 57 PID 3248 wrote to memory of 3732 3248 e57760b.exe 58 PID 3248 wrote to memory of 3844 3248 e57760b.exe 59 PID 3248 wrote to memory of 3912 3248 e57760b.exe 60 PID 3248 wrote to memory of 4028 3248 e57760b.exe 61 PID 3248 wrote to memory of 4124 3248 e57760b.exe 62 PID 3248 wrote to memory of 4596 3248 e57760b.exe 74 PID 3248 wrote to memory of 2792 3248 e57760b.exe 76 PID 3248 wrote to memory of 2324 3248 e57760b.exe 81 PID 3248 wrote to memory of 4708 3248 e57760b.exe 82 PID 3248 wrote to memory of 4708 3248 e57760b.exe 82 PID 4708 wrote to memory of 1036 4708 rundll32.exe 84 PID 4708 wrote to memory of 1036 4708 rundll32.exe 84 PID 4708 wrote to memory of 1036 4708 rundll32.exe 84 PID 4708 wrote to memory of 4000 4708 rundll32.exe 85 PID 4708 wrote to memory of 4000 4708 rundll32.exe 85 PID 4708 wrote to memory of 4000 4708 rundll32.exe 85 PID 4708 wrote to memory of 2140 4708 rundll32.exe 86 PID 4708 wrote to memory of 2140 4708 rundll32.exe 86 PID 4708 wrote to memory of 2140 4708 rundll32.exe 86 PID 3248 wrote to memory of 776 3248 e57760b.exe 9 PID 3248 wrote to memory of 780 3248 e57760b.exe 10 PID 3248 wrote to memory of 1020 3248 e57760b.exe 13 PID 3248 wrote to memory of 2944 3248 e57760b.exe 50 PID 3248 wrote to memory of 3000 3248 e57760b.exe 51 PID 3248 wrote to memory of 3060 3248 e57760b.exe 52 PID 3248 wrote to memory of 3428 3248 e57760b.exe 56 PID 3248 wrote to memory of 3544 3248 e57760b.exe 57 PID 3248 wrote to memory of 3732 3248 e57760b.exe 58 PID 3248 wrote to memory of 3844 3248 e57760b.exe 59 PID 3248 wrote to memory of 3912 3248 e57760b.exe 60 PID 3248 wrote to memory of 4028 3248 e57760b.exe 61 PID 3248 wrote to memory of 4124 3248 e57760b.exe 62 PID 3248 wrote to memory of 4596 3248 e57760b.exe 74 PID 3248 wrote to memory of 2792 3248 e57760b.exe 76 PID 3248 wrote to memory of 1036 3248 e57760b.exe 84 PID 3248 wrote to memory of 1036 3248 e57760b.exe 84 PID 3248 wrote to memory of 4000 3248 e57760b.exe 85 PID 3248 wrote to memory of 4000 3248 e57760b.exe 85 PID 3248 wrote to memory of 2140 3248 e57760b.exe 86 PID 3248 wrote to memory of 2140 3248 e57760b.exe 86 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57760b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e579172.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:776
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1020
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2944
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:3000
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3060
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3428
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a0aad044624bd7fcf04b980d56e3a760ed5c40def10270eb383bc07899b93230N.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a0aad044624bd7fcf04b980d56e3a760ed5c40def10270eb383bc07899b93230N.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\e57760b.exeC:\Users\Admin\AppData\Local\Temp\e57760b.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3248
-
-
C:\Users\Admin\AppData\Local\Temp\e577762.exeC:\Users\Admin\AppData\Local\Temp\e577762.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1036
-
-
C:\Users\Admin\AppData\Local\Temp\e579172.exeC:\Users\Admin\AppData\Local\Temp\e579172.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- System policy modification
PID:4000
-
-
C:\Users\Admin\AppData\Local\Temp\e579191.exeC:\Users\Admin\AppData\Local\Temp\e579191.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2140
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3544
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3732
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3844
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3912
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4028
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4124
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4596
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2792
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD54c0b8029de8f9bad0819c705382c324e
SHA1c6b1d57e9ac51f15a667ad297bd01bf7d2a5421b
SHA256edd0d498cbef9a2ac1f12bdc1fd20df5f8bb0221f93a6348e6f5597d6cf9ee4d
SHA5127cffcd4e79b6471bfa1b76f408082e901f409a74089c6666b7a0b728425433f3b015068abedc271a23f9eaf15784acec5bc02c0afd1e4315d4854d9a7e610314
-
Filesize
257B
MD5b7eecc9ee0f0ac9dc22b9f0b544cc16f
SHA1b7331f2ca145d13cb9980e0e6bb7cb239bde68de
SHA256d9faac0fed288ac43dbc97615fada586c1204080ad0c44f040067065f86dc662
SHA512051ec1ca45598956cc99b32497ce9434a05a98d1eebdf5ada376638ae67b95b611870542ed15f6a013a77824181dd0a2a6659b126763baf785a354de8eb73905