Analysis
-
max time kernel
30s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 18:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8e80bb11df53637b07329de511c9dd72527af7993fff4d9aaa5a42dd480e011cN.dll
Resource
win7-20240729-en
windows7-x64
17 signatures
120 seconds
General
-
Target
8e80bb11df53637b07329de511c9dd72527af7993fff4d9aaa5a42dd480e011cN.dll
-
Size
120KB
-
MD5
228e12d233cc773fb509ac9a9d58c9a0
-
SHA1
022875c8a951d5d686d61d58de1f11ad79cc62c9
-
SHA256
8e80bb11df53637b07329de511c9dd72527af7993fff4d9aaa5a42dd480e011c
-
SHA512
42dbf2714464dc30de95fe7138f788e1a236613b92727a30f988c9c90319674110016b9a2eb525ea741486bc34b9d279be87befb504108eaa0a36703022691d8
-
SSDEEP
3072:dCdRMWG/xIvmTtFZXXLFRaoJNAIfoZQwAalNTaqn49k:ORRG/GvO3LSovjalNTzni
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76c1d9.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76e6d6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76e6d6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76c37e.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76c37e.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76e6d6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76c1d9.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76c1d9.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76c37e.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76c1d9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76c37e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76e6d6.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76c1d9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76c37e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76c37e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76c37e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76e6d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76e6d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76c1d9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76c1d9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76c37e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76c37e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76c37e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76e6d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76c1d9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76e6d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76c1d9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76c1d9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76e6d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76e6d6.exe -
Executes dropped EXE 3 IoCs
pid Process 2436 f76c1d9.exe 2764 f76c37e.exe 2664 f76e6d6.exe -
Loads dropped DLL 6 IoCs
pid Process 2568 rundll32.exe 2568 rundll32.exe 2568 rundll32.exe 2568 rundll32.exe 2568 rundll32.exe 2568 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76c1d9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76c1d9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76c1d9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76c37e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76e6d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76c1d9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76c1d9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76c37e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76c37e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76e6d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76c1d9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76e6d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76e6d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76e6d6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76c37e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76e6d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76e6d6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76c1d9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76c37e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76c37e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76c37e.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76c1d9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76c37e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76e6d6.exe -
Enumerates connected drives 3 TTPs 11 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: f76c1d9.exe File opened (read-only) \??\I: f76c1d9.exe File opened (read-only) \??\K: f76c1d9.exe File opened (read-only) \??\H: f76c1d9.exe File opened (read-only) \??\J: f76c1d9.exe File opened (read-only) \??\M: f76c1d9.exe File opened (read-only) \??\N: f76c1d9.exe File opened (read-only) \??\O: f76c1d9.exe File opened (read-only) \??\P: f76c1d9.exe File opened (read-only) \??\E: f76c1d9.exe File opened (read-only) \??\G: f76c1d9.exe -
resource yara_rule behavioral1/memory/2436-13-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2436-19-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2436-22-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2436-15-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2436-14-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2436-16-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2436-20-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2436-18-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2436-21-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2436-17-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2436-63-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2436-64-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2436-65-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2436-66-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2436-67-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2436-68-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2436-72-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2436-85-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2436-107-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2436-108-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2764-166-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2436-155-0x00000000006A0000-0x000000000175A000-memory.dmp upx behavioral1/memory/2664-191-0x0000000000930000-0x00000000019EA000-memory.dmp upx behavioral1/memory/2664-205-0x0000000000930000-0x00000000019EA000-memory.dmp upx -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI f76c1d9.exe File created C:\Windows\f7711dc f76c37e.exe File created C:\Windows\f7712c6 f76e6d6.exe File created C:\Windows\f76c246 f76c1d9.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76c1d9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76e6d6.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2436 f76c1d9.exe 2436 f76c1d9.exe 2664 f76e6d6.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 2436 f76c1d9.exe Token: SeDebugPrivilege 2436 f76c1d9.exe Token: SeDebugPrivilege 2436 f76c1d9.exe Token: SeDebugPrivilege 2436 f76c1d9.exe Token: SeDebugPrivilege 2436 f76c1d9.exe Token: SeDebugPrivilege 2436 f76c1d9.exe Token: SeDebugPrivilege 2436 f76c1d9.exe Token: SeDebugPrivilege 2436 f76c1d9.exe Token: SeDebugPrivilege 2436 f76c1d9.exe Token: SeDebugPrivilege 2436 f76c1d9.exe Token: SeDebugPrivilege 2436 f76c1d9.exe Token: SeDebugPrivilege 2436 f76c1d9.exe Token: SeDebugPrivilege 2436 f76c1d9.exe Token: SeDebugPrivilege 2436 f76c1d9.exe Token: SeDebugPrivilege 2436 f76c1d9.exe Token: SeDebugPrivilege 2436 f76c1d9.exe Token: SeDebugPrivilege 2436 f76c1d9.exe Token: SeDebugPrivilege 2436 f76c1d9.exe Token: SeDebugPrivilege 2436 f76c1d9.exe Token: SeDebugPrivilege 2436 f76c1d9.exe Token: SeDebugPrivilege 2436 f76c1d9.exe Token: SeDebugPrivilege 2436 f76c1d9.exe Token: SeDebugPrivilege 2436 f76c1d9.exe Token: SeDebugPrivilege 2436 f76c1d9.exe Token: SeDebugPrivilege 2664 f76e6d6.exe Token: SeDebugPrivilege 2664 f76e6d6.exe Token: SeDebugPrivilege 2664 f76e6d6.exe Token: SeDebugPrivilege 2664 f76e6d6.exe Token: SeDebugPrivilege 2664 f76e6d6.exe Token: SeDebugPrivilege 2664 f76e6d6.exe Token: SeDebugPrivilege 2664 f76e6d6.exe Token: SeDebugPrivilege 2664 f76e6d6.exe Token: SeDebugPrivilege 2664 f76e6d6.exe Token: SeDebugPrivilege 2664 f76e6d6.exe Token: SeDebugPrivilege 2664 f76e6d6.exe Token: SeDebugPrivilege 2664 f76e6d6.exe Token: SeDebugPrivilege 2664 f76e6d6.exe Token: SeDebugPrivilege 2664 f76e6d6.exe Token: SeDebugPrivilege 2664 f76e6d6.exe Token: SeDebugPrivilege 2664 f76e6d6.exe Token: SeDebugPrivilege 2664 f76e6d6.exe Token: SeDebugPrivilege 2664 f76e6d6.exe Token: SeDebugPrivilege 2664 f76e6d6.exe Token: SeDebugPrivilege 2664 f76e6d6.exe Token: SeDebugPrivilege 2664 f76e6d6.exe Token: SeDebugPrivilege 2664 f76e6d6.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 1976 wrote to memory of 2568 1976 rundll32.exe 30 PID 1976 wrote to memory of 2568 1976 rundll32.exe 30 PID 1976 wrote to memory of 2568 1976 rundll32.exe 30 PID 1976 wrote to memory of 2568 1976 rundll32.exe 30 PID 1976 wrote to memory of 2568 1976 rundll32.exe 30 PID 1976 wrote to memory of 2568 1976 rundll32.exe 30 PID 1976 wrote to memory of 2568 1976 rundll32.exe 30 PID 2568 wrote to memory of 2436 2568 rundll32.exe 31 PID 2568 wrote to memory of 2436 2568 rundll32.exe 31 PID 2568 wrote to memory of 2436 2568 rundll32.exe 31 PID 2568 wrote to memory of 2436 2568 rundll32.exe 31 PID 2436 wrote to memory of 1112 2436 f76c1d9.exe 19 PID 2436 wrote to memory of 1204 2436 f76c1d9.exe 20 PID 2436 wrote to memory of 1288 2436 f76c1d9.exe 21 PID 2436 wrote to memory of 1616 2436 f76c1d9.exe 25 PID 2436 wrote to memory of 1976 2436 f76c1d9.exe 29 PID 2436 wrote to memory of 2568 2436 f76c1d9.exe 30 PID 2436 wrote to memory of 2568 2436 f76c1d9.exe 30 PID 2568 wrote to memory of 2764 2568 rundll32.exe 32 PID 2568 wrote to memory of 2764 2568 rundll32.exe 32 PID 2568 wrote to memory of 2764 2568 rundll32.exe 32 PID 2568 wrote to memory of 2764 2568 rundll32.exe 32 PID 2568 wrote to memory of 2664 2568 rundll32.exe 34 PID 2568 wrote to memory of 2664 2568 rundll32.exe 34 PID 2568 wrote to memory of 2664 2568 rundll32.exe 34 PID 2568 wrote to memory of 2664 2568 rundll32.exe 34 PID 2436 wrote to memory of 1112 2436 f76c1d9.exe 19 PID 2436 wrote to memory of 1204 2436 f76c1d9.exe 20 PID 2436 wrote to memory of 1288 2436 f76c1d9.exe 21 PID 2436 wrote to memory of 1616 2436 f76c1d9.exe 25 PID 2436 wrote to memory of 2764 2436 f76c1d9.exe 32 PID 2436 wrote to memory of 2764 2436 f76c1d9.exe 32 PID 2436 wrote to memory of 2664 2436 f76c1d9.exe 34 PID 2436 wrote to memory of 2664 2436 f76c1d9.exe 34 PID 2664 wrote to memory of 1112 2664 f76e6d6.exe 19 PID 2664 wrote to memory of 1204 2664 f76e6d6.exe 20 PID 2664 wrote to memory of 1288 2664 f76e6d6.exe 21 PID 2664 wrote to memory of 1616 2664 f76e6d6.exe 25 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76c1d9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76c37e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76e6d6.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1112
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1204
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1288
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8e80bb11df53637b07329de511c9dd72527af7993fff4d9aaa5a42dd480e011cN.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8e80bb11df53637b07329de511c9dd72527af7993fff4d9aaa5a42dd480e011cN.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\f76c1d9.exeC:\Users\Admin\AppData\Local\Temp\f76c1d9.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2436
-
-
C:\Users\Admin\AppData\Local\Temp\f76c37e.exeC:\Users\Admin\AppData\Local\Temp\f76c37e.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System policy modification
PID:2764
-
-
C:\Users\Admin\AppData\Local\Temp\f76e6d6.exeC:\Users\Admin\AppData\Local\Temp\f76e6d6.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2664
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1616
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b360fa63134a63f9acfe046d2dfe10d9
SHA1b47a7f2ad61c79e454b55e39b0d7500aca753a17
SHA25603e0c6c4ca8a24f961477887763397045e67862e059f7494014aefc21891d40e
SHA512575673255d389fc6667f46931301925bf4bb3030d7a3f6da3d3e7d878f86bb496ad6706e20191a1daa2e177cacda9b677424327bd9d438c1ad109c4222064102
-
Filesize
257B
MD55baa2ed7f6843cf813c976f152a0f5c3
SHA1e3a68d5738f9e6a74ae8410f64d112fcf988a781
SHA2567196fbe53c33a5a36c5a3ce1d1bd83dde3659707053049e3f231a5c78a1fc370
SHA512c6072d00921cdd3f154bd7132e06889df814cccfde85ca8eb5237d370e815458a9a5d54c55ad54fb2e836713b182ff80ca43b23c64dbe77c4d26046909c79f9c
-
Filesize
97KB
MD5d310d670117b51dd88fa957438faba77
SHA132e3f2b78eb31e7b1c0bed1ae6e3392fa00213fa
SHA2562a5d2886ec8dcacce20372d11104681967f073f5caba68f940e6a538c9fb5adb
SHA51251e4b55e57fc3e420489273f9414deeeeb23159978b1348fa18a39cb13ca401e5b60445d9c7551158af6c70ba8502d2ebc7b828697058a91028fb85a50ae427d