Analysis
-
max time kernel
93s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
01-01-2025 01:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a6f8fcdf08d47637cc2151fc5888d9c5643ff6ffda647d7559c5d37e1aacccb5.dll
Resource
win7-20240708-en
windows7-x64
17 signatures
150 seconds
General
-
Target
a6f8fcdf08d47637cc2151fc5888d9c5643ff6ffda647d7559c5d37e1aacccb5.dll
-
Size
120KB
-
MD5
eb613ca57258709512eb1b147f253047
-
SHA1
edf7e064c1f753a4913f2ef3622f4fb8b4aceb80
-
SHA256
a6f8fcdf08d47637cc2151fc5888d9c5643ff6ffda647d7559c5d37e1aacccb5
-
SHA512
344f030b582f111f3b060eff86e15beffcf5c60b766ef3653c1cea9f3e3e28cfdc96aade73fb9f0fcd58a35af7d09911f89d53064ee57a4bd7690c66a0e0d31f
-
SSDEEP
3072:Ak2LhALW38jLP/SlieYjXN+BlQIadxUNT:p2FAB2l0h+oR
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e578194.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e578194.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e578194.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e578368.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e578368.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e578368.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578194.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578368.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e578194.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e578194.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e578194.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e578194.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e578368.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e578194.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e578194.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e578368.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e578368.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e578368.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e578368.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e578368.exe -
Executes dropped EXE 4 IoCs
pid Process 2292 e578194.exe 4700 e578368.exe 3896 e579d1b.exe 3632 e579d2a.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e578368.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e578368.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e578194.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e578194.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e578368.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e578368.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e578194.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e578194.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e578368.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e578194.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e578194.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e578368.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e578194.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e578368.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578194.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578368.exe -
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: e578194.exe File opened (read-only) \??\I: e578194.exe File opened (read-only) \??\P: e578194.exe File opened (read-only) \??\S: e578194.exe File opened (read-only) \??\J: e578194.exe File opened (read-only) \??\O: e578194.exe File opened (read-only) \??\Q: e578194.exe File opened (read-only) \??\L: e578194.exe File opened (read-only) \??\M: e578194.exe File opened (read-only) \??\E: e578194.exe File opened (read-only) \??\H: e578194.exe File opened (read-only) \??\K: e578194.exe File opened (read-only) \??\N: e578194.exe File opened (read-only) \??\R: e578194.exe -
resource yara_rule behavioral2/memory/2292-6-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/2292-9-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/2292-8-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/2292-12-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/2292-13-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/2292-14-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/2292-21-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/2292-15-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/2292-11-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/2292-10-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/2292-37-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/2292-36-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/2292-38-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/2292-39-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/2292-40-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/2292-42-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/2292-44-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/2292-57-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/2292-60-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/2292-61-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/2292-75-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/2292-77-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/2292-80-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/2292-82-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/2292-84-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/2292-86-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/2292-88-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/2292-96-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/2292-98-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/2292-103-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/4700-132-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx behavioral2/memory/4700-150-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7zFM.exe e578194.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e578194.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e578194.exe File opened for modification C:\Program Files\7-Zip\7z.exe e578194.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e5781e2 e578194.exe File opened for modification C:\Windows\SYSTEM.INI e578194.exe File created C:\Windows\e57d2a2 e578368.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e578194.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e578368.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e579d1b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e579d2a.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2292 e578194.exe 2292 e578194.exe 2292 e578194.exe 2292 e578194.exe 4700 e578368.exe 4700 e578368.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe Token: SeDebugPrivilege 2292 e578194.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1800 wrote to memory of 1612 1800 rundll32.exe 83 PID 1800 wrote to memory of 1612 1800 rundll32.exe 83 PID 1800 wrote to memory of 1612 1800 rundll32.exe 83 PID 1612 wrote to memory of 2292 1612 rundll32.exe 84 PID 1612 wrote to memory of 2292 1612 rundll32.exe 84 PID 1612 wrote to memory of 2292 1612 rundll32.exe 84 PID 2292 wrote to memory of 796 2292 e578194.exe 8 PID 2292 wrote to memory of 800 2292 e578194.exe 9 PID 2292 wrote to memory of 388 2292 e578194.exe 13 PID 2292 wrote to memory of 2420 2292 e578194.exe 42 PID 2292 wrote to memory of 2436 2292 e578194.exe 43 PID 2292 wrote to memory of 2684 2292 e578194.exe 47 PID 2292 wrote to memory of 3412 2292 e578194.exe 56 PID 2292 wrote to memory of 3536 2292 e578194.exe 57 PID 2292 wrote to memory of 3724 2292 e578194.exe 58 PID 2292 wrote to memory of 3812 2292 e578194.exe 59 PID 2292 wrote to memory of 3880 2292 e578194.exe 60 PID 2292 wrote to memory of 3972 2292 e578194.exe 61 PID 2292 wrote to memory of 4100 2292 e578194.exe 62 PID 2292 wrote to memory of 3732 2292 e578194.exe 74 PID 2292 wrote to memory of 4452 2292 e578194.exe 76 PID 2292 wrote to memory of 1236 2292 e578194.exe 81 PID 2292 wrote to memory of 1800 2292 e578194.exe 82 PID 2292 wrote to memory of 1612 2292 e578194.exe 83 PID 2292 wrote to memory of 1612 2292 e578194.exe 83 PID 1612 wrote to memory of 4700 1612 rundll32.exe 85 PID 1612 wrote to memory of 4700 1612 rundll32.exe 85 PID 1612 wrote to memory of 4700 1612 rundll32.exe 85 PID 1612 wrote to memory of 3896 1612 rundll32.exe 87 PID 1612 wrote to memory of 3896 1612 rundll32.exe 87 PID 1612 wrote to memory of 3896 1612 rundll32.exe 87 PID 1612 wrote to memory of 3632 1612 rundll32.exe 88 PID 1612 wrote to memory of 3632 1612 rundll32.exe 88 PID 1612 wrote to memory of 3632 1612 rundll32.exe 88 PID 2292 wrote to memory of 796 2292 e578194.exe 8 PID 2292 wrote to memory of 800 2292 e578194.exe 9 PID 2292 wrote to memory of 388 2292 e578194.exe 13 PID 2292 wrote to memory of 2420 2292 e578194.exe 42 PID 2292 wrote to memory of 2436 2292 e578194.exe 43 PID 2292 wrote to memory of 2684 2292 e578194.exe 47 PID 2292 wrote to memory of 3412 2292 e578194.exe 56 PID 2292 wrote to memory of 3536 2292 e578194.exe 57 PID 2292 wrote to memory of 3724 2292 e578194.exe 58 PID 2292 wrote to memory of 3812 2292 e578194.exe 59 PID 2292 wrote to memory of 3880 2292 e578194.exe 60 PID 2292 wrote to memory of 3972 2292 e578194.exe 61 PID 2292 wrote to memory of 4100 2292 e578194.exe 62 PID 2292 wrote to memory of 3732 2292 e578194.exe 74 PID 2292 wrote to memory of 4452 2292 e578194.exe 76 PID 2292 wrote to memory of 4700 2292 e578194.exe 85 PID 2292 wrote to memory of 4700 2292 e578194.exe 85 PID 2292 wrote to memory of 3896 2292 e578194.exe 87 PID 2292 wrote to memory of 3896 2292 e578194.exe 87 PID 2292 wrote to memory of 3632 2292 e578194.exe 88 PID 2292 wrote to memory of 3632 2292 e578194.exe 88 PID 4700 wrote to memory of 796 4700 e578368.exe 8 PID 4700 wrote to memory of 800 4700 e578368.exe 9 PID 4700 wrote to memory of 388 4700 e578368.exe 13 PID 4700 wrote to memory of 2420 4700 e578368.exe 42 PID 4700 wrote to memory of 2436 4700 e578368.exe 43 PID 4700 wrote to memory of 2684 4700 e578368.exe 47 PID 4700 wrote to memory of 3412 4700 e578368.exe 56 PID 4700 wrote to memory of 3536 4700 e578368.exe 57 PID 4700 wrote to memory of 3724 4700 e578368.exe 58 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578194.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578368.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:796
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:800
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:388
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2420
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2436
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2684
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3412
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a6f8fcdf08d47637cc2151fc5888d9c5643ff6ffda647d7559c5d37e1aacccb5.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a6f8fcdf08d47637cc2151fc5888d9c5643ff6ffda647d7559c5d37e1aacccb5.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\e578194.exeC:\Users\Admin\AppData\Local\Temp\e578194.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2292
-
-
C:\Users\Admin\AppData\Local\Temp\e578368.exeC:\Users\Admin\AppData\Local\Temp\e578368.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4700
-
-
C:\Users\Admin\AppData\Local\Temp\e579d1b.exeC:\Users\Admin\AppData\Local\Temp\e579d1b.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3896
-
-
C:\Users\Admin\AppData\Local\Temp\e579d2a.exeC:\Users\Admin\AppData\Local\Temp\e579d2a.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3632
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3536
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3724
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3812
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3880
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3972
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4100
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:3732
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4452
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:1236
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:2104
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5504d909572517e618a335383b779968a
SHA17098d960bd5b5b3667ff2f598f73e2f4c64a827e
SHA256266245cee398a8ec878decbc67a30db205ae26712e188db8abbecae30b49e82d
SHA512122b9e1ca9dc7d8a934571113757179fa4bf84e4f2d576fd54de0d1e4643e94aa28f97b44dc938821b628fda869e21b462e07f201901e52ac3fa3bccc8394ea9
-
Filesize
257B
MD5238a01136d9cd6b48b1abad800f67355
SHA1e0d0ebbe07580b456c8edb326aba0b1357013ba9
SHA2567cd48fd8c970556c2f6895b4efd604bd4c32baba56a418a44604ca3dd16b862c
SHA5121c839b22951a8b18cce17f0187cc284d00bf1e5515360fe6e4bb576a2edb6ac6addee8b2f833aedcc430aed94e46da6fc5e9e31fca74957fbc096dfd201b252c