Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28-12-2024 20:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
22417be149a55fcde224794d577b8b647148ba7ae89760fe539fa9e0392ccde6.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
150 seconds
General
-
Target
22417be149a55fcde224794d577b8b647148ba7ae89760fe539fa9e0392ccde6.dll
-
Size
120KB
-
MD5
7f8fd1071e6c1af6cf86a2156a5314c2
-
SHA1
56122bc9d8a1f7f2d8d303f634674d43bc61e8ba
-
SHA256
22417be149a55fcde224794d577b8b647148ba7ae89760fe539fa9e0392ccde6
-
SHA512
a75b29656361a1497591a8e723159c7d3e116a33165c5ce312f34e36884fecee66b88ebbe6baca13c04d81c38d18ce894cad16867814f7cf5fbf4f4d5e2bcced
-
SSDEEP
3072:E/f+UVOm82Z6MvQA7tlk7Aw5F9jxQeHy:UZRdnQQyAgHS
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57b8c1.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e578973.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e578973.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e578973.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57b8c1.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57b8c1.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57b8c1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578973.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57b8c1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57b8c1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e578973.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e578973.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e578973.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57b8c1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57b8c1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57b8c1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57b8c1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e578973.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e578973.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e578973.exe -
Executes dropped EXE 4 IoCs
pid Process 736 e578973.exe 2892 e578a6d.exe 708 e57b8c1.exe 112 e57b8e0.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e578973.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e578973.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e578973.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57b8c1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57b8c1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e578973.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57b8c1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57b8c1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e578973.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e578973.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e578973.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57b8c1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57b8c1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57b8c1.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578973.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57b8c1.exe -
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: e57b8c1.exe File opened (read-only) \??\H: e578973.exe File opened (read-only) \??\J: e578973.exe File opened (read-only) \??\M: e578973.exe File opened (read-only) \??\I: e578973.exe File opened (read-only) \??\N: e578973.exe File opened (read-only) \??\G: e57b8c1.exe File opened (read-only) \??\H: e57b8c1.exe File opened (read-only) \??\I: e57b8c1.exe File opened (read-only) \??\E: e578973.exe File opened (read-only) \??\K: e578973.exe File opened (read-only) \??\L: e578973.exe File opened (read-only) \??\G: e578973.exe File opened (read-only) \??\J: e57b8c1.exe -
resource yara_rule behavioral2/memory/736-6-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/736-8-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/736-9-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/736-10-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/736-12-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/736-30-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/736-11-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/736-33-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/736-34-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/736-35-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/736-36-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/736-37-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/736-38-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/736-39-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/736-40-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/736-46-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/736-47-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/736-62-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/736-64-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/736-65-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/736-67-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/736-68-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/736-71-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/736-73-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/736-76-0x0000000000830000-0x00000000018EA000-memory.dmp upx behavioral2/memory/708-110-0x0000000000810000-0x00000000018CA000-memory.dmp upx behavioral2/memory/708-159-0x0000000000810000-0x00000000018CA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e578a00 e578973.exe File opened for modification C:\Windows\SYSTEM.INI e578973.exe File created C:\Windows\e57e000 e57b8c1.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e578973.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e578a6d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57b8c1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57b8e0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 736 e578973.exe 736 e578973.exe 736 e578973.exe 736 e578973.exe 708 e57b8c1.exe 708 e57b8c1.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe Token: SeDebugPrivilege 736 e578973.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2784 wrote to memory of 4560 2784 rundll32.exe 82 PID 2784 wrote to memory of 4560 2784 rundll32.exe 82 PID 2784 wrote to memory of 4560 2784 rundll32.exe 82 PID 4560 wrote to memory of 736 4560 rundll32.exe 83 PID 4560 wrote to memory of 736 4560 rundll32.exe 83 PID 4560 wrote to memory of 736 4560 rundll32.exe 83 PID 736 wrote to memory of 772 736 e578973.exe 8 PID 736 wrote to memory of 780 736 e578973.exe 9 PID 736 wrote to memory of 64 736 e578973.exe 13 PID 736 wrote to memory of 680 736 e578973.exe 50 PID 736 wrote to memory of 2512 736 e578973.exe 52 PID 736 wrote to memory of 3136 736 e578973.exe 53 PID 736 wrote to memory of 3440 736 e578973.exe 56 PID 736 wrote to memory of 3532 736 e578973.exe 57 PID 736 wrote to memory of 3736 736 e578973.exe 58 PID 736 wrote to memory of 3836 736 e578973.exe 59 PID 736 wrote to memory of 3904 736 e578973.exe 60 PID 736 wrote to memory of 3992 736 e578973.exe 61 PID 736 wrote to memory of 3872 736 e578973.exe 62 PID 736 wrote to memory of 5108 736 e578973.exe 64 PID 736 wrote to memory of 1904 736 e578973.exe 76 PID 736 wrote to memory of 2784 736 e578973.exe 81 PID 736 wrote to memory of 4560 736 e578973.exe 82 PID 736 wrote to memory of 4560 736 e578973.exe 82 PID 4560 wrote to memory of 2892 4560 rundll32.exe 84 PID 4560 wrote to memory of 2892 4560 rundll32.exe 84 PID 4560 wrote to memory of 2892 4560 rundll32.exe 84 PID 736 wrote to memory of 772 736 e578973.exe 8 PID 736 wrote to memory of 780 736 e578973.exe 9 PID 736 wrote to memory of 64 736 e578973.exe 13 PID 736 wrote to memory of 680 736 e578973.exe 50 PID 736 wrote to memory of 2512 736 e578973.exe 52 PID 736 wrote to memory of 3136 736 e578973.exe 53 PID 736 wrote to memory of 3440 736 e578973.exe 56 PID 736 wrote to memory of 3532 736 e578973.exe 57 PID 736 wrote to memory of 3736 736 e578973.exe 58 PID 736 wrote to memory of 3836 736 e578973.exe 59 PID 736 wrote to memory of 3904 736 e578973.exe 60 PID 736 wrote to memory of 3992 736 e578973.exe 61 PID 736 wrote to memory of 3872 736 e578973.exe 62 PID 736 wrote to memory of 5108 736 e578973.exe 64 PID 736 wrote to memory of 1904 736 e578973.exe 76 PID 736 wrote to memory of 2784 736 e578973.exe 81 PID 736 wrote to memory of 2892 736 e578973.exe 84 PID 736 wrote to memory of 2892 736 e578973.exe 84 PID 4560 wrote to memory of 708 4560 rundll32.exe 85 PID 4560 wrote to memory of 708 4560 rundll32.exe 85 PID 4560 wrote to memory of 708 4560 rundll32.exe 85 PID 4560 wrote to memory of 112 4560 rundll32.exe 86 PID 4560 wrote to memory of 112 4560 rundll32.exe 86 PID 4560 wrote to memory of 112 4560 rundll32.exe 86 PID 708 wrote to memory of 772 708 e57b8c1.exe 8 PID 708 wrote to memory of 780 708 e57b8c1.exe 9 PID 708 wrote to memory of 64 708 e57b8c1.exe 13 PID 708 wrote to memory of 680 708 e57b8c1.exe 50 PID 708 wrote to memory of 2512 708 e57b8c1.exe 52 PID 708 wrote to memory of 3136 708 e57b8c1.exe 53 PID 708 wrote to memory of 3440 708 e57b8c1.exe 56 PID 708 wrote to memory of 3532 708 e57b8c1.exe 57 PID 708 wrote to memory of 3736 708 e57b8c1.exe 58 PID 708 wrote to memory of 3836 708 e57b8c1.exe 59 PID 708 wrote to memory of 3904 708 e57b8c1.exe 60 PID 708 wrote to memory of 3992 708 e57b8c1.exe 61 PID 708 wrote to memory of 3872 708 e57b8c1.exe 62 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578973.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57b8c1.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:772
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:64
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:680
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2512
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3136
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3440
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\22417be149a55fcde224794d577b8b647148ba7ae89760fe539fa9e0392ccde6.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\22417be149a55fcde224794d577b8b647148ba7ae89760fe539fa9e0392ccde6.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\e578973.exeC:\Users\Admin\AppData\Local\Temp\e578973.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:736
-
-
C:\Users\Admin\AppData\Local\Temp\e578a6d.exeC:\Users\Admin\AppData\Local\Temp\e578a6d.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2892
-
-
C:\Users\Admin\AppData\Local\Temp\e57b8c1.exeC:\Users\Admin\AppData\Local\Temp\e57b8c1.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:708
-
-
C:\Users\Admin\AppData\Local\Temp\e57b8e0.exeC:\Users\Admin\AppData\Local\Temp\e57b8e0.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:112
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3532
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3736
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3836
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3904
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3992
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3872
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:5108
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:1904
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5c2a2668170f72ae07b5d59ace958bb7c
SHA1f61eb7cf3509bb300c1702ec1399729c3e9cddda
SHA256e0b5114caa52c53985121b70a5c3683a67d818bc5c1f0d9866fe28b38e60fa0e
SHA512f817369e504795b9d9e3a1d9e91fd81c6c2aed66271bba3d1c75007af6280228e75270713974cf695544df922b1b1a9b8a32044460db2f2e7f97ee4fe6f49b32
-
Filesize
256B
MD5938435767fa934f6939b66b7303b7583
SHA170794f1fdd4b7264bbc4d85eb91825400b1d97b0
SHA256d2273420eb38c5f24e0b8e473e8e408999ad6196210da4906b4d87b2a60acec7
SHA5121b927acce735c6eb69a5ebe480d7e92d6ac55d05bbb6c3f4260bc03fe92ec404ae1de9c63214e54c466e5cb99a0505ab45af05c54473a05fb19d1b1f78770eec