Analysis
-
max time kernel
31s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
31-12-2024 08:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e9401bef8b4b0d7d84fb9644a98ca60a4cd66e0e333ace788a96abcd1f99558e.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
120 seconds
General
-
Target
e9401bef8b4b0d7d84fb9644a98ca60a4cd66e0e333ace788a96abcd1f99558e.dll
-
Size
120KB
-
MD5
ee6173a5d2e7ac5b3f814a4455399c8f
-
SHA1
bad155a4d529c06928e5efa05d3b736ce17591a0
-
SHA256
e9401bef8b4b0d7d84fb9644a98ca60a4cd66e0e333ace788a96abcd1f99558e
-
SHA512
827aa306e3297d78c7b722804085a1dce3a30f3443a256e452d7181b3ee6a288573720c6c07856c355c1c38f3932b17d9b9ad8745fe00e9505961eeb01d2a547
-
SSDEEP
3072:vP41hbB4djmnVP6yPSkKLnctimeGTpR9nX+Y:ihbWIV1KzcUmeGTpPuY
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57951c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57951c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57951c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57c13d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57c13d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57c13d.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57951c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57c13d.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57951c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57c13d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57c13d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57c13d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57c13d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57951c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57951c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57951c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57c13d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57c13d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57951c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57951c.exe -
Executes dropped EXE 4 IoCs
pid Process 3712 e57951c.exe 1796 e579635.exe 5080 e57c13d.exe 3528 e57c15c.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57951c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57951c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57c13d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57951c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57c13d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57c13d.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57c13d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57951c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57951c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57c13d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57951c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57c13d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57c13d.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57951c.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57951c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57c13d.exe -
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: e57951c.exe File opened (read-only) \??\J: e57951c.exe File opened (read-only) \??\L: e57951c.exe File opened (read-only) \??\E: e57951c.exe File opened (read-only) \??\M: e57951c.exe File opened (read-only) \??\G: e57c13d.exe File opened (read-only) \??\J: e57c13d.exe File opened (read-only) \??\N: e57951c.exe File opened (read-only) \??\E: e57c13d.exe File opened (read-only) \??\G: e57951c.exe File opened (read-only) \??\H: e57951c.exe File opened (read-only) \??\K: e57951c.exe File opened (read-only) \??\H: e57c13d.exe File opened (read-only) \??\I: e57c13d.exe -
resource yara_rule behavioral2/memory/3712-6-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3712-9-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3712-8-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3712-11-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3712-19-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3712-31-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3712-29-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3712-32-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3712-10-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3712-34-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3712-35-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3712-33-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3712-36-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3712-37-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3712-38-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3712-44-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3712-59-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3712-60-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3712-61-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3712-64-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3712-65-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3712-68-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3712-69-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3712-71-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/3712-74-0x0000000000850000-0x000000000190A000-memory.dmp upx behavioral2/memory/5080-117-0x0000000000750000-0x000000000180A000-memory.dmp upx behavioral2/memory/5080-156-0x0000000000750000-0x000000000180A000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e5795a8 e57951c.exe File opened for modification C:\Windows\SYSTEM.INI e57951c.exe File created C:\Windows\e57e88b e57c13d.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57c13d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57c15c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57951c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e579635.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3712 e57951c.exe 3712 e57951c.exe 3712 e57951c.exe 3712 e57951c.exe 5080 e57c13d.exe 5080 e57c13d.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe Token: SeDebugPrivilege 3712 e57951c.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4584 wrote to memory of 448 4584 rundll32.exe 83 PID 4584 wrote to memory of 448 4584 rundll32.exe 83 PID 4584 wrote to memory of 448 4584 rundll32.exe 83 PID 448 wrote to memory of 3712 448 rundll32.exe 84 PID 448 wrote to memory of 3712 448 rundll32.exe 84 PID 448 wrote to memory of 3712 448 rundll32.exe 84 PID 3712 wrote to memory of 788 3712 e57951c.exe 9 PID 3712 wrote to memory of 780 3712 e57951c.exe 10 PID 3712 wrote to memory of 64 3712 e57951c.exe 13 PID 3712 wrote to memory of 2652 3712 e57951c.exe 44 PID 3712 wrote to memory of 2724 3712 e57951c.exe 47 PID 3712 wrote to memory of 3040 3712 e57951c.exe 51 PID 3712 wrote to memory of 3432 3712 e57951c.exe 56 PID 3712 wrote to memory of 3544 3712 e57951c.exe 57 PID 3712 wrote to memory of 3748 3712 e57951c.exe 58 PID 3712 wrote to memory of 3844 3712 e57951c.exe 59 PID 3712 wrote to memory of 3908 3712 e57951c.exe 60 PID 3712 wrote to memory of 3992 3712 e57951c.exe 61 PID 3712 wrote to memory of 3112 3712 e57951c.exe 62 PID 3712 wrote to memory of 2096 3712 e57951c.exe 75 PID 3712 wrote to memory of 4088 3712 e57951c.exe 76 PID 3712 wrote to memory of 3608 3712 e57951c.exe 81 PID 3712 wrote to memory of 4584 3712 e57951c.exe 82 PID 3712 wrote to memory of 448 3712 e57951c.exe 83 PID 3712 wrote to memory of 448 3712 e57951c.exe 83 PID 448 wrote to memory of 1796 448 rundll32.exe 85 PID 448 wrote to memory of 1796 448 rundll32.exe 85 PID 448 wrote to memory of 1796 448 rundll32.exe 85 PID 3712 wrote to memory of 788 3712 e57951c.exe 9 PID 3712 wrote to memory of 780 3712 e57951c.exe 10 PID 3712 wrote to memory of 64 3712 e57951c.exe 13 PID 3712 wrote to memory of 2652 3712 e57951c.exe 44 PID 3712 wrote to memory of 2724 3712 e57951c.exe 47 PID 3712 wrote to memory of 3040 3712 e57951c.exe 51 PID 3712 wrote to memory of 3432 3712 e57951c.exe 56 PID 3712 wrote to memory of 3544 3712 e57951c.exe 57 PID 3712 wrote to memory of 3748 3712 e57951c.exe 58 PID 3712 wrote to memory of 3844 3712 e57951c.exe 59 PID 3712 wrote to memory of 3908 3712 e57951c.exe 60 PID 3712 wrote to memory of 3992 3712 e57951c.exe 61 PID 3712 wrote to memory of 3112 3712 e57951c.exe 62 PID 3712 wrote to memory of 2096 3712 e57951c.exe 75 PID 3712 wrote to memory of 4088 3712 e57951c.exe 76 PID 3712 wrote to memory of 3608 3712 e57951c.exe 81 PID 3712 wrote to memory of 4584 3712 e57951c.exe 82 PID 3712 wrote to memory of 1796 3712 e57951c.exe 85 PID 3712 wrote to memory of 1796 3712 e57951c.exe 85 PID 448 wrote to memory of 5080 448 rundll32.exe 86 PID 448 wrote to memory of 5080 448 rundll32.exe 86 PID 448 wrote to memory of 5080 448 rundll32.exe 86 PID 448 wrote to memory of 3528 448 rundll32.exe 87 PID 448 wrote to memory of 3528 448 rundll32.exe 87 PID 448 wrote to memory of 3528 448 rundll32.exe 87 PID 5080 wrote to memory of 788 5080 e57c13d.exe 9 PID 5080 wrote to memory of 780 5080 e57c13d.exe 10 PID 5080 wrote to memory of 64 5080 e57c13d.exe 13 PID 5080 wrote to memory of 2652 5080 e57c13d.exe 44 PID 5080 wrote to memory of 2724 5080 e57c13d.exe 47 PID 5080 wrote to memory of 3040 5080 e57c13d.exe 51 PID 5080 wrote to memory of 3432 5080 e57c13d.exe 56 PID 5080 wrote to memory of 3544 5080 e57c13d.exe 57 PID 5080 wrote to memory of 3748 5080 e57c13d.exe 58 PID 5080 wrote to memory of 3844 5080 e57c13d.exe 59 PID 5080 wrote to memory of 3908 5080 e57c13d.exe 60 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57951c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57c13d.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:64
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2652
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2724
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3040
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3432
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e9401bef8b4b0d7d84fb9644a98ca60a4cd66e0e333ace788a96abcd1f99558e.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e9401bef8b4b0d7d84fb9644a98ca60a4cd66e0e333ace788a96abcd1f99558e.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Users\Admin\AppData\Local\Temp\e57951c.exeC:\Users\Admin\AppData\Local\Temp\e57951c.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3712
-
-
C:\Users\Admin\AppData\Local\Temp\e579635.exeC:\Users\Admin\AppData\Local\Temp\e579635.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1796
-
-
C:\Users\Admin\AppData\Local\Temp\e57c13d.exeC:\Users\Admin\AppData\Local\Temp\e57c13d.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5080
-
-
C:\Users\Admin\AppData\Local\Temp\e57c15c.exeC:\Users\Admin\AppData\Local\Temp\e57c15c.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3528
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3544
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3748
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3844
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3908
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3992
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3112
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:2096
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4088
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:3608
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5f25f9d75f4811851264b20a49351be77
SHA10147d153f130a986e906bf82be0c5794080947ed
SHA2560014c63250a80d9961124aba979a9473d90bd1ad2182a734ae34b140078ab642
SHA512042603d0567d0637e77f333e131b91078297ba20747f236db44def48471896eea68b55f20a4da46b68dc844af84a887e2b34762af5a10a1b81c937cef1454dc0
-
Filesize
256B
MD58751a50638544f2b8e2473ffcd62e955
SHA13ec35ee015fed168a00c4a49b436633c8f04f058
SHA2568c4f81e36183592fd383b9bdd898846024886a4b4ee66381d1d7554f49a3cc83
SHA51229b012d076e265065456fb36ab7e23830403585cde63aca055aba51091b77171f938ee68bce89ccf5cfc5dce28f51a9ce2f1fb27dbd03aa382a6c40c7965ff7f