Analysis
-
max time kernel
32s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 14:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cab904b703100f96d4b4fe6e32e7a392e4a69dee3c9d4c0fe440d737aa44be2fN.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
120 seconds
General
-
Target
cab904b703100f96d4b4fe6e32e7a392e4a69dee3c9d4c0fe440d737aa44be2fN.dll
-
Size
120KB
-
MD5
a00809ab93a1d5c249df250cfb57bd20
-
SHA1
79b1508b35d7de48ff64476d7bf7d4e4ca66cdb6
-
SHA256
cab904b703100f96d4b4fe6e32e7a392e4a69dee3c9d4c0fe440d737aa44be2f
-
SHA512
231fc1f12cbc8cfca2cc74f972576a77c3c8d6b546c9560ae3e0625e3a70a235bb4cc45b35cb1c97b05fe53ab18e6210271ecaa737acf3c638d7010560c16ceb
-
SSDEEP
3072:CjC8+52JfyUtXx/DlJ6hDLCnzTr667fDd72BS:ClLZ7ZJ6hDunnrr7fDB2
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e5758de.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e5758de.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e5758de.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e578722.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e578722.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e578722.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5758de.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578722.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5758de.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e578722.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5758de.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5758de.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5758de.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e578722.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e578722.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e578722.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e578722.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e578722.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5758de.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5758de.exe -
Executes dropped EXE 3 IoCs
pid Process 2268 e5758de.exe 4764 e575a26.exe 3408 e578722.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5758de.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e578722.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5758de.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5758de.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5758de.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e578722.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e578722.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5758de.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e578722.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5758de.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e5758de.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e578722.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e578722.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e578722.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5758de.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578722.exe -
Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: e5758de.exe File opened (read-only) \??\I: e578722.exe File opened (read-only) \??\E: e578722.exe File opened (read-only) \??\G: e578722.exe File opened (read-only) \??\H: e578722.exe File opened (read-only) \??\E: e5758de.exe File opened (read-only) \??\H: e5758de.exe File opened (read-only) \??\I: e5758de.exe File opened (read-only) \??\J: e5758de.exe File opened (read-only) \??\K: e5758de.exe -
resource yara_rule behavioral2/memory/2268-6-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2268-10-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2268-11-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2268-27-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2268-36-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2268-33-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2268-25-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2268-12-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2268-26-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2268-8-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2268-9-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2268-38-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2268-37-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2268-39-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2268-45-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2268-44-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2268-55-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2268-56-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2268-58-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2268-59-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2268-61-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2268-63-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2268-66-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/3408-89-0x0000000000880000-0x000000000193A000-memory.dmp upx behavioral2/memory/3408-97-0x0000000000880000-0x000000000193A000-memory.dmp upx behavioral2/memory/3408-94-0x0000000000880000-0x000000000193A000-memory.dmp upx behavioral2/memory/3408-91-0x0000000000880000-0x000000000193A000-memory.dmp upx behavioral2/memory/3408-95-0x0000000000880000-0x000000000193A000-memory.dmp upx behavioral2/memory/3408-120-0x0000000000880000-0x000000000193A000-memory.dmp upx behavioral2/memory/3408-145-0x0000000000880000-0x000000000193A000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI e5758de.exe File created C:\Windows\e57aeaf e578722.exe File created C:\Windows\e57594b e5758de.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e578722.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e5758de.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e575a26.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2268 e5758de.exe 2268 e5758de.exe 2268 e5758de.exe 2268 e5758de.exe 3408 e578722.exe 3408 e578722.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe Token: SeDebugPrivilege 2268 e5758de.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2752 wrote to memory of 3828 2752 rundll32.exe 83 PID 2752 wrote to memory of 3828 2752 rundll32.exe 83 PID 2752 wrote to memory of 3828 2752 rundll32.exe 83 PID 3828 wrote to memory of 2268 3828 rundll32.exe 84 PID 3828 wrote to memory of 2268 3828 rundll32.exe 84 PID 3828 wrote to memory of 2268 3828 rundll32.exe 84 PID 2268 wrote to memory of 764 2268 e5758de.exe 8 PID 2268 wrote to memory of 772 2268 e5758de.exe 9 PID 2268 wrote to memory of 316 2268 e5758de.exe 13 PID 2268 wrote to memory of 2504 2268 e5758de.exe 42 PID 2268 wrote to memory of 2524 2268 e5758de.exe 43 PID 2268 wrote to memory of 2632 2268 e5758de.exe 45 PID 2268 wrote to memory of 3388 2268 e5758de.exe 56 PID 2268 wrote to memory of 3508 2268 e5758de.exe 57 PID 2268 wrote to memory of 3708 2268 e5758de.exe 58 PID 2268 wrote to memory of 3804 2268 e5758de.exe 59 PID 2268 wrote to memory of 3864 2268 e5758de.exe 60 PID 2268 wrote to memory of 3952 2268 e5758de.exe 61 PID 2268 wrote to memory of 3552 2268 e5758de.exe 62 PID 2268 wrote to memory of 1772 2268 e5758de.exe 74 PID 2268 wrote to memory of 2940 2268 e5758de.exe 76 PID 2268 wrote to memory of 5032 2268 e5758de.exe 81 PID 2268 wrote to memory of 2752 2268 e5758de.exe 82 PID 2268 wrote to memory of 3828 2268 e5758de.exe 83 PID 2268 wrote to memory of 3828 2268 e5758de.exe 83 PID 3828 wrote to memory of 4764 3828 rundll32.exe 85 PID 3828 wrote to memory of 4764 3828 rundll32.exe 85 PID 3828 wrote to memory of 4764 3828 rundll32.exe 85 PID 2268 wrote to memory of 764 2268 e5758de.exe 8 PID 2268 wrote to memory of 772 2268 e5758de.exe 9 PID 2268 wrote to memory of 316 2268 e5758de.exe 13 PID 2268 wrote to memory of 2504 2268 e5758de.exe 42 PID 2268 wrote to memory of 2524 2268 e5758de.exe 43 PID 2268 wrote to memory of 2632 2268 e5758de.exe 45 PID 2268 wrote to memory of 3388 2268 e5758de.exe 56 PID 2268 wrote to memory of 3508 2268 e5758de.exe 57 PID 2268 wrote to memory of 3708 2268 e5758de.exe 58 PID 2268 wrote to memory of 3804 2268 e5758de.exe 59 PID 2268 wrote to memory of 3864 2268 e5758de.exe 60 PID 2268 wrote to memory of 3952 2268 e5758de.exe 61 PID 2268 wrote to memory of 3552 2268 e5758de.exe 62 PID 2268 wrote to memory of 1772 2268 e5758de.exe 74 PID 2268 wrote to memory of 2940 2268 e5758de.exe 76 PID 2268 wrote to memory of 5032 2268 e5758de.exe 81 PID 2268 wrote to memory of 2752 2268 e5758de.exe 82 PID 2268 wrote to memory of 4764 2268 e5758de.exe 85 PID 2268 wrote to memory of 4764 2268 e5758de.exe 85 PID 3828 wrote to memory of 3408 3828 rundll32.exe 86 PID 3828 wrote to memory of 3408 3828 rundll32.exe 86 PID 3828 wrote to memory of 3408 3828 rundll32.exe 86 PID 3408 wrote to memory of 764 3408 e578722.exe 8 PID 3408 wrote to memory of 772 3408 e578722.exe 9 PID 3408 wrote to memory of 316 3408 e578722.exe 13 PID 3408 wrote to memory of 2504 3408 e578722.exe 42 PID 3408 wrote to memory of 2524 3408 e578722.exe 43 PID 3408 wrote to memory of 2632 3408 e578722.exe 45 PID 3408 wrote to memory of 3388 3408 e578722.exe 56 PID 3408 wrote to memory of 3508 3408 e578722.exe 57 PID 3408 wrote to memory of 3708 3408 e578722.exe 58 PID 3408 wrote to memory of 3804 3408 e578722.exe 59 PID 3408 wrote to memory of 3864 3408 e578722.exe 60 PID 3408 wrote to memory of 3952 3408 e578722.exe 61 PID 3408 wrote to memory of 3552 3408 e578722.exe 62 PID 3408 wrote to memory of 1772 3408 e578722.exe 74 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5758de.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578722.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:764
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:772
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:316
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2504
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2524
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2632
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3388
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cab904b703100f96d4b4fe6e32e7a392e4a69dee3c9d4c0fe440d737aa44be2fN.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cab904b703100f96d4b4fe6e32e7a392e4a69dee3c9d4c0fe440d737aa44be2fN.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\e5758de.exeC:\Users\Admin\AppData\Local\Temp\e5758de.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2268
-
-
C:\Users\Admin\AppData\Local\Temp\e575a26.exeC:\Users\Admin\AppData\Local\Temp\e575a26.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4764
-
-
C:\Users\Admin\AppData\Local\Temp\e578722.exeC:\Users\Admin\AppData\Local\Temp\e578722.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3408
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3508
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3708
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3804
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3864
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3952
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3552
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:1772
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2940
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:5032
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD530cd8bd3b20d109bd6392e13892591c5
SHA1c6a79c2d60ceb979f825d44c1b0c3b8b819a3fa2
SHA2563ca6b21cd3ceb61bac6d47bb6760c9b327fa1eaf7bbe30dce0960508857a34be
SHA5129b36db6fe29ea79c507aec10537b0f34d079508cd356cd82b515c173a6665bbbff64921d596d12891d49a3ce00781a7d69d2bd351844ea92c8d4da9844bbb5b9
-
Filesize
257B
MD51fe1f0fd0cecc99daf76a055be46005f
SHA16c9d15303b15f27f95e5d2dce1c44e729b49b8e7
SHA2561e1cebedabf002abc2063d8b017000a6a50fc70d406ada26af3ef75777af28b6
SHA512862d0a6f1a6130f7cf77b354aa19e5f136e94453060ecaade4f0d31576a38a4a4c0d6ba88f543f8f29ab9112fd8917e79375aab8505bcb0dd8a0572ec9deb090