Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28-01-2025 01:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
968aa938caae2c160f3dcb4ace9c423eb0fd4ef1c7973b1911d7cac53a45a616.dll
Resource
win7-20241010-en
windows7-x64
17 signatures
150 seconds
General
-
Target
968aa938caae2c160f3dcb4ace9c423eb0fd4ef1c7973b1911d7cac53a45a616.dll
-
Size
120KB
-
MD5
f5381b0f3419ef0c1e7cd9c84045a44b
-
SHA1
0ee3e51b728576a21c15890e9b585c5d1bbfe743
-
SHA256
968aa938caae2c160f3dcb4ace9c423eb0fd4ef1c7973b1911d7cac53a45a616
-
SHA512
bc6d46cea4751f9172d1faf3a3795146931eeee70b8939757bbd52d7c859891b47a0571d056aa12a0aea92bc7ef78b7c38f0de4e1bdaaeaa12d28328ec03e273
-
SSDEEP
3072:6Uv3LRjO4b2QMJKRMhEKhCV5H8LM9SKiA7:6qA4SdK4xhQ5H8LA
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57a25a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e578712.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e578712.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e578712.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57a25a.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57a25a.exe -
Sality family
-
UAC bypass 3 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578712.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57a25a.exe -
Windows security bypass 2 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57a25a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e578712.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e578712.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e578712.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57a25a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57a25a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57a25a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57a25a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e578712.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e578712.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e578712.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57a25a.exe -
Executes dropped EXE 3 IoCs
pid Process 3572 e578712.exe 2576 e578983.exe 2200 e57a25a.exe -
Windows security modification 2 TTPs 14 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57a25a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57a25a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57a25a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e578712.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e578712.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57a25a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e578712.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57a25a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e578712.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e578712.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e578712.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e578712.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57a25a.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57a25a.exe -
Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578712.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57a25a.exe -
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: e578712.exe File opened (read-only) \??\P: e578712.exe File opened (read-only) \??\Q: e578712.exe File opened (read-only) \??\L: e578712.exe File opened (read-only) \??\H: e578712.exe File opened (read-only) \??\J: e578712.exe File opened (read-only) \??\K: e578712.exe File opened (read-only) \??\O: e578712.exe File opened (read-only) \??\E: e578712.exe File opened (read-only) \??\I: e578712.exe File opened (read-only) \??\M: e578712.exe File opened (read-only) \??\G: e578712.exe File opened (read-only) \??\S: e578712.exe File opened (read-only) \??\R: e578712.exe -
resource yara_rule behavioral2/memory/3572-9-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3572-10-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3572-11-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3572-13-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3572-21-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3572-14-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3572-15-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3572-12-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3572-8-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3572-22-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3572-38-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3572-37-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3572-39-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3572-40-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3572-41-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3572-43-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3572-52-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3572-53-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3572-56-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3572-57-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3572-68-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3572-69-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3572-72-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3572-74-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3572-76-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3572-77-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3572-79-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3572-81-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3572-89-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3572-90-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/3572-94-0x00000000007B0000-0x000000000186A000-memory.dmp upx behavioral2/memory/2200-140-0x0000000000B60000-0x0000000001C1A000-memory.dmp upx behavioral2/memory/2200-141-0x0000000000B60000-0x0000000001C1A000-memory.dmp upx -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe e578712.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e578712.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e578712.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e578712.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e57f0e8 e57a25a.exe File created C:\Windows\e57877f e578712.exe File opened for modification C:\Windows\SYSTEM.INI e578712.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e578712.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e578983.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57a25a.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3572 e578712.exe 3572 e578712.exe 3572 e578712.exe 3572 e578712.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe Token: SeDebugPrivilege 3572 e578712.exe -
Suspicious use of WriteProcessMemory 50 IoCs
description pid Process procid_target PID 3708 wrote to memory of 2720 3708 rundll32.exe 83 PID 3708 wrote to memory of 2720 3708 rundll32.exe 83 PID 3708 wrote to memory of 2720 3708 rundll32.exe 83 PID 2720 wrote to memory of 3572 2720 rundll32.exe 84 PID 2720 wrote to memory of 3572 2720 rundll32.exe 84 PID 2720 wrote to memory of 3572 2720 rundll32.exe 84 PID 3572 wrote to memory of 788 3572 e578712.exe 8 PID 3572 wrote to memory of 796 3572 e578712.exe 9 PID 3572 wrote to memory of 336 3572 e578712.exe 13 PID 3572 wrote to memory of 2588 3572 e578712.exe 44 PID 3572 wrote to memory of 2632 3572 e578712.exe 45 PID 3572 wrote to memory of 2800 3572 e578712.exe 48 PID 3572 wrote to memory of 3544 3572 e578712.exe 56 PID 3572 wrote to memory of 3648 3572 e578712.exe 57 PID 3572 wrote to memory of 3824 3572 e578712.exe 58 PID 3572 wrote to memory of 3912 3572 e578712.exe 59 PID 3572 wrote to memory of 3972 3572 e578712.exe 60 PID 3572 wrote to memory of 4056 3572 e578712.exe 61 PID 3572 wrote to memory of 4112 3572 e578712.exe 62 PID 3572 wrote to memory of 1624 3572 e578712.exe 75 PID 3572 wrote to memory of 1772 3572 e578712.exe 76 PID 3572 wrote to memory of 2404 3572 e578712.exe 81 PID 3572 wrote to memory of 3708 3572 e578712.exe 82 PID 3572 wrote to memory of 2720 3572 e578712.exe 83 PID 3572 wrote to memory of 2720 3572 e578712.exe 83 PID 2720 wrote to memory of 2576 2720 rundll32.exe 85 PID 2720 wrote to memory of 2576 2720 rundll32.exe 85 PID 2720 wrote to memory of 2576 2720 rundll32.exe 85 PID 2720 wrote to memory of 2200 2720 rundll32.exe 87 PID 2720 wrote to memory of 2200 2720 rundll32.exe 87 PID 2720 wrote to memory of 2200 2720 rundll32.exe 87 PID 3572 wrote to memory of 788 3572 e578712.exe 8 PID 3572 wrote to memory of 796 3572 e578712.exe 9 PID 3572 wrote to memory of 336 3572 e578712.exe 13 PID 3572 wrote to memory of 2588 3572 e578712.exe 44 PID 3572 wrote to memory of 2632 3572 e578712.exe 45 PID 3572 wrote to memory of 2800 3572 e578712.exe 48 PID 3572 wrote to memory of 3544 3572 e578712.exe 56 PID 3572 wrote to memory of 3648 3572 e578712.exe 57 PID 3572 wrote to memory of 3824 3572 e578712.exe 58 PID 3572 wrote to memory of 3912 3572 e578712.exe 59 PID 3572 wrote to memory of 3972 3572 e578712.exe 60 PID 3572 wrote to memory of 4056 3572 e578712.exe 61 PID 3572 wrote to memory of 4112 3572 e578712.exe 62 PID 3572 wrote to memory of 1624 3572 e578712.exe 75 PID 3572 wrote to memory of 1772 3572 e578712.exe 76 PID 3572 wrote to memory of 2576 3572 e578712.exe 85 PID 3572 wrote to memory of 2576 3572 e578712.exe 85 PID 3572 wrote to memory of 2200 3572 e578712.exe 87 PID 3572 wrote to memory of 2200 3572 e578712.exe 87 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e578712.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57a25a.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:796
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:336
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2588
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2632
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2800
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3544
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\968aa938caae2c160f3dcb4ace9c423eb0fd4ef1c7973b1911d7cac53a45a616.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\968aa938caae2c160f3dcb4ace9c423eb0fd4ef1c7973b1911d7cac53a45a616.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\e578712.exeC:\Users\Admin\AppData\Local\Temp\e578712.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3572
-
-
C:\Users\Admin\AppData\Local\Temp\e578983.exeC:\Users\Admin\AppData\Local\Temp\e578983.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2576
-
-
C:\Users\Admin\AppData\Local\Temp\e57a25a.exeC:\Users\Admin\AppData\Local\Temp\e57a25a.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- System policy modification
PID:2200
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3648
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3824
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3912
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3972
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4056
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4112
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:1624
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1772
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:2404
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5e9a5c6cbbb59807c56321cb6b6a3115b
SHA1397e6a0e7d137bd59f5a94808d2a2830f2fd9737
SHA256f12f37f3b61c2cd784237c6d95e2f225f5357efd2f45d9746127ecda72f086f5
SHA51273b611c10695038724519b6c6bb4298e899e9469103d01911af0d79e64815b3350042c7eb2d157fc803ddaac1716d760205f115e6a44b339e769ea755b30245a
-
Filesize
256B
MD5a005959f57846906dfffccc45154dcf8
SHA1bc1eb3dc41cb3f464e349c5e866eae3dae123244
SHA25615781d13df9a060abfc4f85fdee810f7867794e5958883e5e6498254ba0c6920
SHA5127e8dd33a5f82c4edec728dde0ed08b62a8f15ac874f277e70eeb200c425d7d15c5cbc1a83982e51ae6add6e11677a54ad9fd4112b8836a0aec92b688669ef549