Analysis
-
max time kernel
30s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 13:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
678aa3def89313b2cc54db583fbc3e78f8defde20fea7a1f819ed8d54be5d992.dll
Resource
win7-20241010-en
windows7-x64
17 signatures
120 seconds
General
-
Target
678aa3def89313b2cc54db583fbc3e78f8defde20fea7a1f819ed8d54be5d992.dll
-
Size
120KB
-
MD5
8110b6d591402fbd4a3db406b67d6a92
-
SHA1
b283410dad0aa1724261b6d6e68ffab0d264fc92
-
SHA256
678aa3def89313b2cc54db583fbc3e78f8defde20fea7a1f819ed8d54be5d992
-
SHA512
121665158f89fbda9b421275720f647cf85da34d81c6ec17d2730bf32c231046f51b2137a7ea8bb5608c145e06780b8b59a01bba2d1146aebb39f658056855dc
-
SSDEEP
1536:48mBsobH7Py8kFWQPbg09WkAniKUqJUnmcfEv/yh17qV+pIQcl0VmZPSVp:4XsZNFW+gcWqqJ4sCn7qsIZ/ZqX
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57a7aa.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57a7aa.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57a7aa.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e577d4e.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e577d4e.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e577d4e.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e577d4e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57a7aa.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e577d4e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57a7aa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57a7aa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e577d4e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e577d4e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e577d4e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57a7aa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57a7aa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57a7aa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e577d4e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e577d4e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57a7aa.exe -
Executes dropped EXE 4 IoCs
pid Process 4500 e577d4e.exe 876 e577e77.exe 2188 e57a7aa.exe 3204 e57a7b9.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57a7aa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e577d4e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e577d4e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e577d4e.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57a7aa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57a7aa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e577d4e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e577d4e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e577d4e.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e577d4e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57a7aa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57a7aa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57a7aa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57a7aa.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e577d4e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57a7aa.exe -
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: e577d4e.exe File opened (read-only) \??\H: e577d4e.exe File opened (read-only) \??\J: e577d4e.exe File opened (read-only) \??\L: e577d4e.exe File opened (read-only) \??\E: e57a7aa.exe File opened (read-only) \??\E: e577d4e.exe File opened (read-only) \??\I: e577d4e.exe File opened (read-only) \??\M: e577d4e.exe File opened (read-only) \??\H: e57a7aa.exe File opened (read-only) \??\K: e577d4e.exe File opened (read-only) \??\I: e57a7aa.exe File opened (read-only) \??\J: e57a7aa.exe File opened (read-only) \??\N: e577d4e.exe File opened (read-only) \??\G: e57a7aa.exe -
resource yara_rule behavioral2/memory/4500-8-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4500-6-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4500-32-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4500-17-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4500-34-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4500-12-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4500-11-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4500-10-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4500-21-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4500-9-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4500-35-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4500-37-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4500-36-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4500-38-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4500-39-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4500-40-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4500-61-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4500-62-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4500-64-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4500-65-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4500-68-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4500-69-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4500-71-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4500-74-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/4500-75-0x0000000000760000-0x000000000181A000-memory.dmp upx behavioral2/memory/2188-111-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/2188-159-0x0000000000860000-0x000000000191A000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI e577d4e.exe File created C:\Windows\e57cef8 e57a7aa.exe File created C:\Windows\e577d9c e577d4e.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57a7aa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57a7b9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e577d4e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e577e77.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4500 e577d4e.exe 4500 e577d4e.exe 4500 e577d4e.exe 4500 e577d4e.exe 2188 e57a7aa.exe 2188 e57a7aa.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe Token: SeDebugPrivilege 4500 e577d4e.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1724 wrote to memory of 4804 1724 rundll32.exe 82 PID 1724 wrote to memory of 4804 1724 rundll32.exe 82 PID 1724 wrote to memory of 4804 1724 rundll32.exe 82 PID 4804 wrote to memory of 4500 4804 rundll32.exe 83 PID 4804 wrote to memory of 4500 4804 rundll32.exe 83 PID 4804 wrote to memory of 4500 4804 rundll32.exe 83 PID 4500 wrote to memory of 768 4500 e577d4e.exe 8 PID 4500 wrote to memory of 772 4500 e577d4e.exe 9 PID 4500 wrote to memory of 384 4500 e577d4e.exe 13 PID 4500 wrote to memory of 2992 4500 e577d4e.exe 51 PID 4500 wrote to memory of 3040 4500 e577d4e.exe 52 PID 4500 wrote to memory of 684 4500 e577d4e.exe 53 PID 4500 wrote to memory of 3424 4500 e577d4e.exe 56 PID 4500 wrote to memory of 3532 4500 e577d4e.exe 57 PID 4500 wrote to memory of 3720 4500 e577d4e.exe 58 PID 4500 wrote to memory of 3808 4500 e577d4e.exe 59 PID 4500 wrote to memory of 3872 4500 e577d4e.exe 60 PID 4500 wrote to memory of 3948 4500 e577d4e.exe 61 PID 4500 wrote to memory of 3444 4500 e577d4e.exe 62 PID 4500 wrote to memory of 2604 4500 e577d4e.exe 75 PID 4500 wrote to memory of 1580 4500 e577d4e.exe 76 PID 4500 wrote to memory of 1724 4500 e577d4e.exe 81 PID 4500 wrote to memory of 4804 4500 e577d4e.exe 82 PID 4500 wrote to memory of 4804 4500 e577d4e.exe 82 PID 4804 wrote to memory of 876 4804 rundll32.exe 84 PID 4804 wrote to memory of 876 4804 rundll32.exe 84 PID 4804 wrote to memory of 876 4804 rundll32.exe 84 PID 4500 wrote to memory of 768 4500 e577d4e.exe 8 PID 4500 wrote to memory of 772 4500 e577d4e.exe 9 PID 4500 wrote to memory of 384 4500 e577d4e.exe 13 PID 4500 wrote to memory of 2992 4500 e577d4e.exe 51 PID 4500 wrote to memory of 3040 4500 e577d4e.exe 52 PID 4500 wrote to memory of 684 4500 e577d4e.exe 53 PID 4500 wrote to memory of 3424 4500 e577d4e.exe 56 PID 4500 wrote to memory of 3532 4500 e577d4e.exe 57 PID 4500 wrote to memory of 3720 4500 e577d4e.exe 58 PID 4500 wrote to memory of 3808 4500 e577d4e.exe 59 PID 4500 wrote to memory of 3872 4500 e577d4e.exe 60 PID 4500 wrote to memory of 3948 4500 e577d4e.exe 61 PID 4500 wrote to memory of 3444 4500 e577d4e.exe 62 PID 4500 wrote to memory of 2604 4500 e577d4e.exe 75 PID 4500 wrote to memory of 1580 4500 e577d4e.exe 76 PID 4500 wrote to memory of 1724 4500 e577d4e.exe 81 PID 4500 wrote to memory of 876 4500 e577d4e.exe 84 PID 4500 wrote to memory of 876 4500 e577d4e.exe 84 PID 4804 wrote to memory of 2188 4804 rundll32.exe 85 PID 4804 wrote to memory of 2188 4804 rundll32.exe 85 PID 4804 wrote to memory of 2188 4804 rundll32.exe 85 PID 4804 wrote to memory of 3204 4804 rundll32.exe 86 PID 4804 wrote to memory of 3204 4804 rundll32.exe 86 PID 4804 wrote to memory of 3204 4804 rundll32.exe 86 PID 2188 wrote to memory of 768 2188 e57a7aa.exe 8 PID 2188 wrote to memory of 772 2188 e57a7aa.exe 9 PID 2188 wrote to memory of 384 2188 e57a7aa.exe 13 PID 2188 wrote to memory of 2992 2188 e57a7aa.exe 51 PID 2188 wrote to memory of 3040 2188 e57a7aa.exe 52 PID 2188 wrote to memory of 684 2188 e57a7aa.exe 53 PID 2188 wrote to memory of 3424 2188 e57a7aa.exe 56 PID 2188 wrote to memory of 3532 2188 e57a7aa.exe 57 PID 2188 wrote to memory of 3720 2188 e57a7aa.exe 58 PID 2188 wrote to memory of 3808 2188 e57a7aa.exe 59 PID 2188 wrote to memory of 3872 2188 e57a7aa.exe 60 PID 2188 wrote to memory of 3948 2188 e57a7aa.exe 61 PID 2188 wrote to memory of 3444 2188 e57a7aa.exe 62 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e577d4e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57a7aa.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:768
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:772
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:384
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2992
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:3040
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:684
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3424
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\678aa3def89313b2cc54db583fbc3e78f8defde20fea7a1f819ed8d54be5d992.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\678aa3def89313b2cc54db583fbc3e78f8defde20fea7a1f819ed8d54be5d992.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\e577d4e.exeC:\Users\Admin\AppData\Local\Temp\e577d4e.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4500
-
-
C:\Users\Admin\AppData\Local\Temp\e577e77.exeC:\Users\Admin\AppData\Local\Temp\e577e77.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:876
-
-
C:\Users\Admin\AppData\Local\Temp\e57a7aa.exeC:\Users\Admin\AppData\Local\Temp\e57a7aa.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2188
-
-
C:\Users\Admin\AppData\Local\Temp\e57a7b9.exeC:\Users\Admin\AppData\Local\Temp\e57a7b9.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3204
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3532
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3720
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3808
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3872
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3948
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3444
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:2604
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1580
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5f1b9ad7b3d076e04c2d9873e38d49fad
SHA18f50ed098ef2acb52d4464ca5992fae00c5e006b
SHA256b7c7a289ae5f5d6d2de70019caf81290178023d97d23b75eee8994b47ef42f58
SHA5121f0de85cdc7f7c5774d0103d4517df293bb1e83becae7b45cb122412b2c168fc37d535dc8e01ef372e481d990f6c679d48a36a29a0f4d320b1fc62546a3220d6
-
Filesize
257B
MD5b91ac43227be38924e7cd1c616fcc827
SHA19939aae735c14b529e038ea8440aa1d8e5bcafe3
SHA2561b00075ac96eead46b1874679523bc2fa3a5510ad4e42dd4765b39da4c09eae0
SHA512e85c32a4ec048daa42a2051c7b66d25202ef9c64dd612ada13d504a731a97b1faa9df1d911c7edc9aed601d0eedad1f9421e1d8c985939f8b717a054a1828ff9