Analysis
-
max time kernel
32s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 14:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2c263b035d18636956f740fe25de86bc6331977c53b61ee28556d8827ddbaf75N.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
120 seconds
General
-
Target
2c263b035d18636956f740fe25de86bc6331977c53b61ee28556d8827ddbaf75N.dll
-
Size
120KB
-
MD5
e37edcb2c274b321e64f0127a6e75aa0
-
SHA1
31eaeb55a14bece3ad560d1615da1eac35f2b62d
-
SHA256
2c263b035d18636956f740fe25de86bc6331977c53b61ee28556d8827ddbaf75
-
SHA512
bf02e1dba18e5b1a5780d940e52be5ba51983e93a416fab60744dc39b64a356b9e479334aee75e4c167af50779bb8c8375759e25c999aefcfbade229f41c34b9
-
SSDEEP
1536:XNYSYJUNy39lDxuTHV8mJAUQCMicMT6RKQXces5RpMcRzM7OZAU:XN2my7S8SzLMZMH4cXR6ezb
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57c582.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57c582.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57f414.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57f414.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57f414.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57c582.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57c582.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57f414.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57c582.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57c582.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57c582.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57c582.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57f414.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57f414.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57f414.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57f414.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57c582.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57c582.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57f414.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57f414.exe -
Executes dropped EXE 3 IoCs
pid Process 2152 e57c582.exe 2232 e57c6bb.exe 3156 e57f414.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57c582.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57c582.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57c582.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57c582.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57f414.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57c582.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57f414.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57f414.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57c582.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57c582.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57f414.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57f414.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57f414.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57f414.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57c582.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57f414.exe -
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: e57f414.exe File opened (read-only) \??\H: e57c582.exe File opened (read-only) \??\I: e57c582.exe File opened (read-only) \??\K: e57c582.exe File opened (read-only) \??\E: e57f414.exe File opened (read-only) \??\L: e57c582.exe File opened (read-only) \??\M: e57c582.exe File opened (read-only) \??\G: e57f414.exe File opened (read-only) \??\H: e57f414.exe File opened (read-only) \??\J: e57f414.exe File opened (read-only) \??\E: e57c582.exe File opened (read-only) \??\G: e57c582.exe File opened (read-only) \??\J: e57c582.exe File opened (read-only) \??\N: e57c582.exe -
resource yara_rule behavioral2/memory/2152-8-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2152-11-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2152-22-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2152-12-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2152-10-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2152-9-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2152-24-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2152-23-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2152-29-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2152-30-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2152-36-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2152-37-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2152-38-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2152-39-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2152-40-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2152-47-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2152-57-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2152-59-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2152-61-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2152-63-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2152-65-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2152-66-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2152-72-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2152-73-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/2152-77-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/3156-110-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/3156-132-0x00000000007F0000-0x00000000018AA000-memory.dmp upx behavioral2/memory/3156-156-0x00000000007F0000-0x00000000018AA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e57c5c1 e57c582.exe File opened for modification C:\Windows\SYSTEM.INI e57c582.exe File created C:\Windows\e581b63 e57f414.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57c582.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57c6bb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57f414.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2152 e57c582.exe 2152 e57c582.exe 2152 e57c582.exe 2152 e57c582.exe 3156 e57f414.exe 3156 e57f414.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe Token: SeDebugPrivilege 2152 e57c582.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4716 wrote to memory of 416 4716 rundll32.exe 83 PID 4716 wrote to memory of 416 4716 rundll32.exe 83 PID 4716 wrote to memory of 416 4716 rundll32.exe 83 PID 416 wrote to memory of 2152 416 rundll32.exe 84 PID 416 wrote to memory of 2152 416 rundll32.exe 84 PID 416 wrote to memory of 2152 416 rundll32.exe 84 PID 2152 wrote to memory of 772 2152 e57c582.exe 8 PID 2152 wrote to memory of 780 2152 e57c582.exe 9 PID 2152 wrote to memory of 1020 2152 e57c582.exe 13 PID 2152 wrote to memory of 2672 2152 e57c582.exe 44 PID 2152 wrote to memory of 2684 2152 e57c582.exe 45 PID 2152 wrote to memory of 2912 2152 e57c582.exe 51 PID 2152 wrote to memory of 3444 2152 e57c582.exe 56 PID 2152 wrote to memory of 3560 2152 e57c582.exe 57 PID 2152 wrote to memory of 3756 2152 e57c582.exe 58 PID 2152 wrote to memory of 3852 2152 e57c582.exe 59 PID 2152 wrote to memory of 3916 2152 e57c582.exe 60 PID 2152 wrote to memory of 4004 2152 e57c582.exe 61 PID 2152 wrote to memory of 3552 2152 e57c582.exe 62 PID 2152 wrote to memory of 1456 2152 e57c582.exe 75 PID 2152 wrote to memory of 4488 2152 e57c582.exe 76 PID 2152 wrote to memory of 400 2152 e57c582.exe 81 PID 2152 wrote to memory of 4716 2152 e57c582.exe 82 PID 2152 wrote to memory of 416 2152 e57c582.exe 83 PID 2152 wrote to memory of 416 2152 e57c582.exe 83 PID 416 wrote to memory of 2232 416 rundll32.exe 85 PID 416 wrote to memory of 2232 416 rundll32.exe 85 PID 416 wrote to memory of 2232 416 rundll32.exe 85 PID 2152 wrote to memory of 772 2152 e57c582.exe 8 PID 2152 wrote to memory of 780 2152 e57c582.exe 9 PID 2152 wrote to memory of 1020 2152 e57c582.exe 13 PID 2152 wrote to memory of 2672 2152 e57c582.exe 44 PID 2152 wrote to memory of 2684 2152 e57c582.exe 45 PID 2152 wrote to memory of 2912 2152 e57c582.exe 51 PID 2152 wrote to memory of 3444 2152 e57c582.exe 56 PID 2152 wrote to memory of 3560 2152 e57c582.exe 57 PID 2152 wrote to memory of 3756 2152 e57c582.exe 58 PID 2152 wrote to memory of 3852 2152 e57c582.exe 59 PID 2152 wrote to memory of 3916 2152 e57c582.exe 60 PID 2152 wrote to memory of 4004 2152 e57c582.exe 61 PID 2152 wrote to memory of 3552 2152 e57c582.exe 62 PID 2152 wrote to memory of 1456 2152 e57c582.exe 75 PID 2152 wrote to memory of 4488 2152 e57c582.exe 76 PID 2152 wrote to memory of 400 2152 e57c582.exe 81 PID 2152 wrote to memory of 4716 2152 e57c582.exe 82 PID 2152 wrote to memory of 2232 2152 e57c582.exe 85 PID 2152 wrote to memory of 2232 2152 e57c582.exe 85 PID 416 wrote to memory of 3156 416 rundll32.exe 87 PID 416 wrote to memory of 3156 416 rundll32.exe 87 PID 416 wrote to memory of 3156 416 rundll32.exe 87 PID 3156 wrote to memory of 772 3156 e57f414.exe 8 PID 3156 wrote to memory of 780 3156 e57f414.exe 9 PID 3156 wrote to memory of 1020 3156 e57f414.exe 13 PID 3156 wrote to memory of 2672 3156 e57f414.exe 44 PID 3156 wrote to memory of 2684 3156 e57f414.exe 45 PID 3156 wrote to memory of 2912 3156 e57f414.exe 51 PID 3156 wrote to memory of 3444 3156 e57f414.exe 56 PID 3156 wrote to memory of 3560 3156 e57f414.exe 57 PID 3156 wrote to memory of 3756 3156 e57f414.exe 58 PID 3156 wrote to memory of 3852 3156 e57f414.exe 59 PID 3156 wrote to memory of 3916 3156 e57f414.exe 60 PID 3156 wrote to memory of 4004 3156 e57f414.exe 61 PID 3156 wrote to memory of 3552 3156 e57f414.exe 62 PID 3156 wrote to memory of 1456 3156 e57f414.exe 75 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57c582.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57f414.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:772
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1020
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2672
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2684
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2912
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3444
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2c263b035d18636956f740fe25de86bc6331977c53b61ee28556d8827ddbaf75N.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2c263b035d18636956f740fe25de86bc6331977c53b61ee28556d8827ddbaf75N.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Users\Admin\AppData\Local\Temp\e57c582.exeC:\Users\Admin\AppData\Local\Temp\e57c582.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2152
-
-
C:\Users\Admin\AppData\Local\Temp\e57c6bb.exeC:\Users\Admin\AppData\Local\Temp\e57c6bb.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2232
-
-
C:\Users\Admin\AppData\Local\Temp\e57f414.exeC:\Users\Admin\AppData\Local\Temp\e57f414.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3156
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3560
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3756
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3852
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3916
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4004
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3552
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:1456
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4488
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:400
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD54621e41ecbdab2a61a72c4348a02c7f6
SHA1baf2279a44931787a883a65322c8fa4ee7bd94e9
SHA25630e6879af3842d410e4b119d340f7987d4e3a8b214a2777ebd068afd29fa62e8
SHA5125ebc6cd3e00b6e9c0a9863a08c85a955f28508092db6d88184e00d69d32dfb866474046054910eab268df2719eb74f98981ba961a1b870bf1a23e61116b1578a
-
Filesize
257B
MD5a1d3d40be0699c23e02be52283269175
SHA11efe7ed3dc2a92955428a24d060ccf8f494d0dc1
SHA25631ca950440425e9c2a57d2bb4fd891c8715c9720a6d7e9f4914ce8f438af436d
SHA512c4fd57f4afe5edba00f4b54e31ad83770cfa502cef334464a748ff324a0dde73c0f01bd155119e50961f276dd5c17bc21f8bc03cd2dba1e02fcebfd1413f2a93