Analysis
-
max time kernel
94s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28-01-2025 04:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dbb05aa00b27bf2f5931a4cf898a4532f91c9b55a94906c5a92abae93b4174f9.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
150 seconds
General
-
Target
dbb05aa00b27bf2f5931a4cf898a4532f91c9b55a94906c5a92abae93b4174f9.dll
-
Size
120KB
-
MD5
aefc83f151afb680020c81a876d142c4
-
SHA1
2a01783c73827870b67130567bc6748b6034b46a
-
SHA256
dbb05aa00b27bf2f5931a4cf898a4532f91c9b55a94906c5a92abae93b4174f9
-
SHA512
4c1865437d286efcb76d4082d3be7a49b57a92fb5e63cfd1d9ce9f4b48c7dfd0f7e3aa0372fde3f20757b6d624a41f2f324aeaf56144c30b06c17476d10977b8
-
SSDEEP
1536:yASoUSgQA7BiTMecrp5lG5PC1xYpEwa7pcHP1hLR+eLnvt+CHWycf3P/rRkxeENy:x0F7AYpeCdf7pcH9+8n4CHRc/3eKB
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57bce7.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57bce7.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57a180.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57a180.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57a180.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57bce7.exe -
Sality family
-
UAC bypass 3 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57a180.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57bce7.exe -
Windows security bypass 2 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57a180.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57bce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57bce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57bce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57a180.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57bce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57bce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57bce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57a180.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57a180.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57a180.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57a180.exe -
Executes dropped EXE 4 IoCs
pid Process 4260 e57a180.exe 2192 e57a2c8.exe 1052 e57bce7.exe 3244 e57bd06.exe -
Windows security modification 2 TTPs 14 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57bce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57bce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57a180.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57a180.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57bce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57a180.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57a180.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57a180.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57bce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57a180.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57a180.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57bce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57bce7.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57bce7.exe -
Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57a180.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57bce7.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: e57bce7.exe -
resource yara_rule behavioral2/memory/4260-8-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/4260-10-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/4260-17-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/4260-19-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/4260-11-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/4260-9-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/4260-27-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/4260-34-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/4260-18-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/4260-28-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/4260-48-0x0000000000870000-0x000000000192A000-memory.dmp upx behavioral2/memory/1052-83-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx behavioral2/memory/1052-91-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx behavioral2/memory/1052-89-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx behavioral2/memory/1052-92-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx behavioral2/memory/1052-93-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx behavioral2/memory/1052-86-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx behavioral2/memory/1052-87-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx behavioral2/memory/1052-90-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx behavioral2/memory/1052-88-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx behavioral2/memory/1052-85-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx behavioral2/memory/1052-100-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx behavioral2/memory/1052-99-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx behavioral2/memory/1052-101-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx behavioral2/memory/1052-102-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx behavioral2/memory/1052-103-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx behavioral2/memory/1052-105-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx behavioral2/memory/1052-107-0x0000000000B20000-0x0000000001BDA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI e57a180.exe File created C:\Windows\e57f201 e57bce7.exe File created C:\Windows\e57a20c e57a180.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57a180.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57a2c8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57bce7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57bd06.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4260 e57a180.exe 4260 e57a180.exe 4260 e57a180.exe 4260 e57a180.exe 1052 e57bce7.exe 1052 e57bce7.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe Token: SeDebugPrivilege 4260 e57a180.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2872 wrote to memory of 3188 2872 rundll32.exe 83 PID 2872 wrote to memory of 3188 2872 rundll32.exe 83 PID 2872 wrote to memory of 3188 2872 rundll32.exe 83 PID 3188 wrote to memory of 4260 3188 rundll32.exe 84 PID 3188 wrote to memory of 4260 3188 rundll32.exe 84 PID 3188 wrote to memory of 4260 3188 rundll32.exe 84 PID 4260 wrote to memory of 780 4260 e57a180.exe 8 PID 4260 wrote to memory of 788 4260 e57a180.exe 9 PID 4260 wrote to memory of 384 4260 e57a180.exe 13 PID 4260 wrote to memory of 2884 4260 e57a180.exe 49 PID 4260 wrote to memory of 2912 4260 e57a180.exe 50 PID 4260 wrote to memory of 3020 4260 e57a180.exe 52 PID 4260 wrote to memory of 3432 4260 e57a180.exe 56 PID 4260 wrote to memory of 3540 4260 e57a180.exe 57 PID 4260 wrote to memory of 3724 4260 e57a180.exe 58 PID 4260 wrote to memory of 3832 4260 e57a180.exe 59 PID 4260 wrote to memory of 3912 4260 e57a180.exe 60 PID 4260 wrote to memory of 3992 4260 e57a180.exe 61 PID 4260 wrote to memory of 4100 4260 e57a180.exe 62 PID 4260 wrote to memory of 2864 4260 e57a180.exe 74 PID 4260 wrote to memory of 1812 4260 e57a180.exe 76 PID 4260 wrote to memory of 2872 4260 e57a180.exe 82 PID 4260 wrote to memory of 3188 4260 e57a180.exe 83 PID 4260 wrote to memory of 3188 4260 e57a180.exe 83 PID 3188 wrote to memory of 2192 3188 rundll32.exe 85 PID 3188 wrote to memory of 2192 3188 rundll32.exe 85 PID 3188 wrote to memory of 2192 3188 rundll32.exe 85 PID 3188 wrote to memory of 1052 3188 rundll32.exe 87 PID 3188 wrote to memory of 1052 3188 rundll32.exe 87 PID 3188 wrote to memory of 1052 3188 rundll32.exe 87 PID 3188 wrote to memory of 3244 3188 rundll32.exe 88 PID 3188 wrote to memory of 3244 3188 rundll32.exe 88 PID 3188 wrote to memory of 3244 3188 rundll32.exe 88 PID 4260 wrote to memory of 780 4260 e57a180.exe 8 PID 4260 wrote to memory of 788 4260 e57a180.exe 9 PID 4260 wrote to memory of 384 4260 e57a180.exe 13 PID 4260 wrote to memory of 2884 4260 e57a180.exe 49 PID 4260 wrote to memory of 2912 4260 e57a180.exe 50 PID 4260 wrote to memory of 3020 4260 e57a180.exe 52 PID 4260 wrote to memory of 3432 4260 e57a180.exe 56 PID 4260 wrote to memory of 3540 4260 e57a180.exe 57 PID 4260 wrote to memory of 3724 4260 e57a180.exe 58 PID 4260 wrote to memory of 3832 4260 e57a180.exe 59 PID 4260 wrote to memory of 3912 4260 e57a180.exe 60 PID 4260 wrote to memory of 3992 4260 e57a180.exe 61 PID 4260 wrote to memory of 4100 4260 e57a180.exe 62 PID 4260 wrote to memory of 2864 4260 e57a180.exe 74 PID 4260 wrote to memory of 1812 4260 e57a180.exe 76 PID 4260 wrote to memory of 2192 4260 e57a180.exe 85 PID 4260 wrote to memory of 2192 4260 e57a180.exe 85 PID 4260 wrote to memory of 1052 4260 e57a180.exe 87 PID 4260 wrote to memory of 1052 4260 e57a180.exe 87 PID 4260 wrote to memory of 3244 4260 e57a180.exe 88 PID 4260 wrote to memory of 3244 4260 e57a180.exe 88 PID 1052 wrote to memory of 780 1052 e57bce7.exe 8 PID 1052 wrote to memory of 788 1052 e57bce7.exe 9 PID 1052 wrote to memory of 384 1052 e57bce7.exe 13 PID 1052 wrote to memory of 2884 1052 e57bce7.exe 49 PID 1052 wrote to memory of 2912 1052 e57bce7.exe 50 PID 1052 wrote to memory of 3020 1052 e57bce7.exe 52 PID 1052 wrote to memory of 3432 1052 e57bce7.exe 56 PID 1052 wrote to memory of 3540 1052 e57bce7.exe 57 PID 1052 wrote to memory of 3724 1052 e57bce7.exe 58 PID 1052 wrote to memory of 3832 1052 e57bce7.exe 59 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57a180.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57bce7.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:384
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2884
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2912
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3020
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3432
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dbb05aa00b27bf2f5931a4cf898a4532f91c9b55a94906c5a92abae93b4174f9.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dbb05aa00b27bf2f5931a4cf898a4532f91c9b55a94906c5a92abae93b4174f9.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\e57a180.exeC:\Users\Admin\AppData\Local\Temp\e57a180.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4260
-
-
C:\Users\Admin\AppData\Local\Temp\e57a2c8.exeC:\Users\Admin\AppData\Local\Temp\e57a2c8.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2192
-
-
C:\Users\Admin\AppData\Local\Temp\e57bce7.exeC:\Users\Admin\AppData\Local\Temp\e57bce7.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1052
-
-
C:\Users\Admin\AppData\Local\Temp\e57bd06.exeC:\Users\Admin\AppData\Local\Temp\e57bd06.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3244
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3540
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3724
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3832
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3912
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3992
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4100
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:2864
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1812
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD59300915c1b242c58c1f32b9f25bf6a40
SHA13cc25f1fa31c2ea2c3d02ae92f994b1cb4d22f6c
SHA2562240aba1aaad86dae2ff53da38679707131de5fb79247acbf6da86ea3d72e33d
SHA5123e594b7e054174a351e0662b2c578984cbc8d86b8b16638fccd9a14b605b5a208cb549b2dbaec74194ba9d496ad5f354ae1c2d7bb0e96085781fe321712765fa
-
Filesize
257B
MD57083bd9b0021f0e1ad2b09a4230dd3ca
SHA1ad6e4bb465ab22a74163f37ec87615782c3e880c
SHA25602041aa6efae78e33227bcd213d13a002d2919c7b2668acd3bc51c2defe93d98
SHA512e5dbbcf5f2431c5a07b418eb3b8164ea9366267c9808acf42c3602c26a6864d5915946cc0d70224e1784aaa27df879e47e88a300bfd237466f8070b951935056