Analysis
-
max time kernel
32s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
31-12-2024 08:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
485509dda9333d0ad16e6c0d1225050b5d0cb0a0679e65fc975a5e112f35f02b.dll
Resource
win7-20241010-en
windows7-x64
17 signatures
120 seconds
General
-
Target
485509dda9333d0ad16e6c0d1225050b5d0cb0a0679e65fc975a5e112f35f02b.dll
-
Size
120KB
-
MD5
838abb24c178957329df463b2d290190
-
SHA1
eaeeb2bb4ace0380f1a52c8a2dc764abda478ba7
-
SHA256
485509dda9333d0ad16e6c0d1225050b5d0cb0a0679e65fc975a5e112f35f02b
-
SHA512
7d72af4a27d2924363114b83b6d4649e4b6a27f2e751224753e5a97d2d74a233fc5e1b3294a89cded2d77172e75a4119ad9e0d7ae29fb89cca467c29a5d5c7c1
-
SSDEEP
3072:q3ffVls4afcD39BvXmECdDH1MM7+uKQnS1:q3f5C+3PpCf+uJS1
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57ca55.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57ca55.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e5798b6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e5798b6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e5798b6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57ca55.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5798b6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57ca55.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5798b6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57ca55.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57ca55.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57ca55.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57ca55.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5798b6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5798b6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5798b6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5798b6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5798b6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57ca55.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57ca55.exe -
Executes dropped EXE 3 IoCs
pid Process 2184 e5798b6.exe 3944 e579a2d.exe 5112 e57ca55.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57ca55.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57ca55.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57ca55.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57ca55.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57ca55.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57ca55.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5798b6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5798b6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5798b6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57ca55.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5798b6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5798b6.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e5798b6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5798b6.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5798b6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57ca55.exe -
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: e5798b6.exe File opened (read-only) \??\H: e57ca55.exe File opened (read-only) \??\E: e5798b6.exe File opened (read-only) \??\J: e5798b6.exe File opened (read-only) \??\J: e57ca55.exe File opened (read-only) \??\G: e5798b6.exe File opened (read-only) \??\L: e5798b6.exe File opened (read-only) \??\K: e5798b6.exe File opened (read-only) \??\M: e5798b6.exe File opened (read-only) \??\E: e57ca55.exe File opened (read-only) \??\G: e57ca55.exe File opened (read-only) \??\I: e57ca55.exe File opened (read-only) \??\H: e5798b6.exe File opened (read-only) \??\I: e5798b6.exe -
resource yara_rule behavioral2/memory/2184-6-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2184-9-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2184-8-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2184-23-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2184-31-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2184-28-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2184-13-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2184-12-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2184-11-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2184-10-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2184-35-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2184-36-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2184-37-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2184-38-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2184-39-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2184-40-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2184-46-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2184-47-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2184-56-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2184-59-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2184-61-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2184-62-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2184-63-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2184-66-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2184-68-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/2184-72-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/5112-106-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/5112-128-0x0000000000800000-0x00000000018BA000-memory.dmp upx behavioral2/memory/5112-152-0x0000000000800000-0x00000000018BA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e57f1a3 e57ca55.exe File created C:\Windows\e579904 e5798b6.exe File opened for modification C:\Windows\SYSTEM.INI e5798b6.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57ca55.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e5798b6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e579a2d.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2184 e5798b6.exe 2184 e5798b6.exe 2184 e5798b6.exe 2184 e5798b6.exe 5112 e57ca55.exe 5112 e57ca55.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe Token: SeDebugPrivilege 2184 e5798b6.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1220 wrote to memory of 4480 1220 rundll32.exe 83 PID 1220 wrote to memory of 4480 1220 rundll32.exe 83 PID 1220 wrote to memory of 4480 1220 rundll32.exe 83 PID 4480 wrote to memory of 2184 4480 rundll32.exe 84 PID 4480 wrote to memory of 2184 4480 rundll32.exe 84 PID 4480 wrote to memory of 2184 4480 rundll32.exe 84 PID 2184 wrote to memory of 776 2184 e5798b6.exe 8 PID 2184 wrote to memory of 780 2184 e5798b6.exe 9 PID 2184 wrote to memory of 64 2184 e5798b6.exe 13 PID 2184 wrote to memory of 2684 2184 e5798b6.exe 44 PID 2184 wrote to memory of 2732 2184 e5798b6.exe 45 PID 2184 wrote to memory of 2980 2184 e5798b6.exe 51 PID 2184 wrote to memory of 3436 2184 e5798b6.exe 56 PID 2184 wrote to memory of 3564 2184 e5798b6.exe 57 PID 2184 wrote to memory of 3764 2184 e5798b6.exe 58 PID 2184 wrote to memory of 3852 2184 e5798b6.exe 59 PID 2184 wrote to memory of 3952 2184 e5798b6.exe 60 PID 2184 wrote to memory of 4036 2184 e5798b6.exe 61 PID 2184 wrote to memory of 4212 2184 e5798b6.exe 62 PID 2184 wrote to memory of 2168 2184 e5798b6.exe 71 PID 2184 wrote to memory of 4460 2184 e5798b6.exe 76 PID 2184 wrote to memory of 5088 2184 e5798b6.exe 77 PID 2184 wrote to memory of 1220 2184 e5798b6.exe 82 PID 2184 wrote to memory of 4480 2184 e5798b6.exe 83 PID 2184 wrote to memory of 4480 2184 e5798b6.exe 83 PID 4480 wrote to memory of 3944 4480 rundll32.exe 85 PID 4480 wrote to memory of 3944 4480 rundll32.exe 85 PID 4480 wrote to memory of 3944 4480 rundll32.exe 85 PID 2184 wrote to memory of 776 2184 e5798b6.exe 8 PID 2184 wrote to memory of 780 2184 e5798b6.exe 9 PID 2184 wrote to memory of 64 2184 e5798b6.exe 13 PID 2184 wrote to memory of 2684 2184 e5798b6.exe 44 PID 2184 wrote to memory of 2732 2184 e5798b6.exe 45 PID 2184 wrote to memory of 2980 2184 e5798b6.exe 51 PID 2184 wrote to memory of 3436 2184 e5798b6.exe 56 PID 2184 wrote to memory of 3564 2184 e5798b6.exe 57 PID 2184 wrote to memory of 3764 2184 e5798b6.exe 58 PID 2184 wrote to memory of 3852 2184 e5798b6.exe 59 PID 2184 wrote to memory of 3952 2184 e5798b6.exe 60 PID 2184 wrote to memory of 4036 2184 e5798b6.exe 61 PID 2184 wrote to memory of 4212 2184 e5798b6.exe 62 PID 2184 wrote to memory of 2168 2184 e5798b6.exe 71 PID 2184 wrote to memory of 4460 2184 e5798b6.exe 76 PID 2184 wrote to memory of 5088 2184 e5798b6.exe 77 PID 2184 wrote to memory of 1220 2184 e5798b6.exe 82 PID 2184 wrote to memory of 3944 2184 e5798b6.exe 85 PID 2184 wrote to memory of 3944 2184 e5798b6.exe 85 PID 4480 wrote to memory of 5112 4480 rundll32.exe 86 PID 4480 wrote to memory of 5112 4480 rundll32.exe 86 PID 4480 wrote to memory of 5112 4480 rundll32.exe 86 PID 5112 wrote to memory of 776 5112 e57ca55.exe 8 PID 5112 wrote to memory of 780 5112 e57ca55.exe 9 PID 5112 wrote to memory of 64 5112 e57ca55.exe 13 PID 5112 wrote to memory of 2684 5112 e57ca55.exe 44 PID 5112 wrote to memory of 2732 5112 e57ca55.exe 45 PID 5112 wrote to memory of 2980 5112 e57ca55.exe 51 PID 5112 wrote to memory of 3436 5112 e57ca55.exe 56 PID 5112 wrote to memory of 3564 5112 e57ca55.exe 57 PID 5112 wrote to memory of 3764 5112 e57ca55.exe 58 PID 5112 wrote to memory of 3852 5112 e57ca55.exe 59 PID 5112 wrote to memory of 3952 5112 e57ca55.exe 60 PID 5112 wrote to memory of 4036 5112 e57ca55.exe 61 PID 5112 wrote to memory of 4212 5112 e57ca55.exe 62 PID 5112 wrote to memory of 2168 5112 e57ca55.exe 71 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5798b6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57ca55.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:776
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:64
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2684
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2732
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2980
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3436
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\485509dda9333d0ad16e6c0d1225050b5d0cb0a0679e65fc975a5e112f35f02b.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\485509dda9333d0ad16e6c0d1225050b5d0cb0a0679e65fc975a5e112f35f02b.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\e5798b6.exeC:\Users\Admin\AppData\Local\Temp\e5798b6.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2184
-
-
C:\Users\Admin\AppData\Local\Temp\e579a2d.exeC:\Users\Admin\AppData\Local\Temp\e579a2d.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3944
-
-
C:\Users\Admin\AppData\Local\Temp\e57ca55.exeC:\Users\Admin\AppData\Local\Temp\e57ca55.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5112
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3564
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3764
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3852
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3952
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4036
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4212
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2168
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4460
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:5088
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5929ebb3b25a3f8c4fcaaff8b6526d048
SHA1b9f94f1b2b13f315cfa02f961131c581ed47df46
SHA256d3414640928e93801c88d93c140a944dcfcf52cbe04a8f0973fa4098c14df3b0
SHA5124865eeafbd21c46604ded8abd6670acad336a476649263d5186f253652bb7d55d3c440a2e890dad15009c9d3ee6daadf2321c2a799b1e94a46a925f922f2a6ea
-
Filesize
257B
MD502a65358a6f3bcfaae43f8617ca241f5
SHA1fa71e1f534ea71103e6db79c92e5e018fcc0cab2
SHA256c1eb90dad567d5417e842c578e5a8cb5c000a6a6d6fdf9c0f5517887c49607ec
SHA5128749c7c2dae89abbf8bcaebcb0fd4b75d15a6cb9a8a69864fa03e3cdc4922dab74ea93af4262aa228fdd535807696df61df46c4e6dd27dc5b6499590681c1984