Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29/01/2025, 01:06
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe
-
Size
134KB
-
MD5
511ce68def4409e1f6cd108601eeacbd
-
SHA1
66096cd45e9275624fcb2c0d6d5eb21bdae3767b
-
SHA256
20dbdcbcb3356a4ab2bc3b21e6da4f946a17c21baafcb77daf895e4a0d5adbac
-
SHA512
2a42060fbba139a9a8702e12fe3e14c7e33729d6a722815015c7e4801669ef6ef07e442d37fb69bd0e776696bf5693ba54448d7970edda7b8c2e59fa0ca9c8c3
-
SSDEEP
3072:37kDOJ2+dKSBCt71xt8RddBKoN8spx5bgzZbytRxP0by6G:rkDOJ2+dKSBCtpGddYoNxxZyZbytrd
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Sality family
-
UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe -
Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe File opened (read-only) \??\K: JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe File opened (read-only) \??\M: JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe File opened (read-only) \??\N: JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe File opened (read-only) \??\O: JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe File opened (read-only) \??\S: JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe File opened (read-only) \??\V: JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe File opened (read-only) \??\W: JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe File opened (read-only) \??\Z: JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe File opened (read-only) \??\A: JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe File opened (read-only) \??\P: JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe File opened (read-only) \??\T: JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe File opened (read-only) \??\B: JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe File opened (read-only) \??\I: JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe File opened (read-only) \??\L: JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe File opened (read-only) \??\Q: JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe File opened (read-only) \??\R: JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe File opened (read-only) \??\Y: JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe File opened (read-only) \??\E: JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe File opened (read-only) \??\G: JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe File opened (read-only) \??\H: JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe File opened (read-only) \??\J: JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe File opened (read-only) \??\U: JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\LogFiles\setupcln\setuperr.log JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe File opened for modification C:\Windows\system32\LogFiles\setupcln\diagerr.xml JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe File opened for modification C:\Windows\system32\LogFiles\setupcln\diagwrn.xml JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe File opened for modification C:\Windows\system32\LogFiles\setupcln\setupact.log JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe -
resource yara_rule behavioral2/memory/3588-9-0x0000000002440000-0x0000000003470000-memory.dmp upx behavioral2/memory/3588-6-0x0000000002440000-0x0000000003470000-memory.dmp upx behavioral2/memory/3588-3-0x0000000002440000-0x0000000003470000-memory.dmp upx behavioral2/memory/3588-17-0x0000000002440000-0x0000000003470000-memory.dmp upx behavioral2/memory/3588-18-0x0000000002440000-0x0000000003470000-memory.dmp upx behavioral2/memory/3588-68-0x0000000002440000-0x0000000003470000-memory.dmp upx behavioral2/memory/3588-71-0x0000000002440000-0x0000000003470000-memory.dmp upx behavioral2/memory/3588-87-0x0000000002440000-0x0000000003470000-memory.dmp upx behavioral2/memory/3588-89-0x0000000002440000-0x0000000003470000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe Token: SeDebugPrivilege 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe -
Suspicious use of WriteProcessMemory 45 IoCs
description pid Process procid_target PID 3588 wrote to memory of 800 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 8 PID 3588 wrote to memory of 808 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 9 PID 3588 wrote to memory of 388 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 13 PID 3588 wrote to memory of 2676 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 45 PID 3588 wrote to memory of 2760 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 48 PID 3588 wrote to memory of 2352 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 52 PID 3588 wrote to memory of 3436 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 56 PID 3588 wrote to memory of 3556 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 57 PID 3588 wrote to memory of 3748 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 58 PID 3588 wrote to memory of 3840 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 59 PID 3588 wrote to memory of 3900 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 60 PID 3588 wrote to memory of 3996 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 61 PID 3588 wrote to memory of 3684 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 62 PID 3588 wrote to memory of 4576 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 74 PID 3588 wrote to memory of 4660 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 76 PID 3588 wrote to memory of 800 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 8 PID 3588 wrote to memory of 808 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 9 PID 3588 wrote to memory of 388 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 13 PID 3588 wrote to memory of 2676 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 45 PID 3588 wrote to memory of 2760 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 48 PID 3588 wrote to memory of 2352 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 52 PID 3588 wrote to memory of 3436 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 56 PID 3588 wrote to memory of 3556 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 57 PID 3588 wrote to memory of 3748 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 58 PID 3588 wrote to memory of 3840 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 59 PID 3588 wrote to memory of 3900 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 60 PID 3588 wrote to memory of 3996 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 61 PID 3588 wrote to memory of 3684 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 62 PID 3588 wrote to memory of 4576 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 74 PID 3588 wrote to memory of 4660 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 76 PID 3588 wrote to memory of 800 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 8 PID 3588 wrote to memory of 808 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 9 PID 3588 wrote to memory of 388 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 13 PID 3588 wrote to memory of 2676 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 45 PID 3588 wrote to memory of 2760 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 48 PID 3588 wrote to memory of 2352 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 52 PID 3588 wrote to memory of 3436 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 56 PID 3588 wrote to memory of 3556 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 57 PID 3588 wrote to memory of 3748 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 58 PID 3588 wrote to memory of 3840 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 59 PID 3588 wrote to memory of 3900 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 60 PID 3588 wrote to memory of 3996 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 61 PID 3588 wrote to memory of 3684 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 62 PID 3588 wrote to memory of 4576 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 74 PID 3588 wrote to memory of 4660 3588 JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe 76 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:800
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:808
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:388
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2676
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2760
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2352
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_511ce68def4409e1f6cd108601eeacbd.exe"2⤵
- UAC bypass
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3588
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3556
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3748
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3840
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3900
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3996
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3684
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4576
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4660
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD5863cb071df73bf4da3392f1fa9d8d42a
SHA1d32dd48e80434028627338ba618e3d99c167800b
SHA25695aec7d0eb48602d93568c7f0d37ed0c67ca5b837f766a6a12eb6aa2119422df
SHA512ff86733b3499784acae1503f429baf0a9cf25dc15cbc8b8a7372e684e39b16129b0436b3c7cce31ed0cd334475edb3c2ea87fe523f986adff48fb3e94a7a31dd
-
Filesize
9KB
MD5ef82b304067edcf3cf990a42de93b695
SHA1a2a2af4015e81562bab4454232bbcb69708f5cd9
SHA25663a505045b1d4549428a469bf00b0f83aaf58cfd9eb2c32b24f17336e323ab31
SHA5128f5e17ed20bd033370220c7dc9f1373cd9aa79d3fe3b73cef1dbf0134f8705997f1287427c03d87e16a5932855a553501988b3c43b4ca2329d4d8f153dbe5d41
-
Filesize
9KB
MD59fb36b9c1664ea51d9a02399820be07e
SHA13e5e8b9a08c1e842752743ef0caf1714e519fde3
SHA2564719c2fbdfca9835584fabbdbf856e38240830e164a1caf7ad867c9d49c8d8aa
SHA51214c023876c206dbf47e86a1013c2dfe63690d34f20ec048d9da2675c79f5961243761cb6940153269d931b4bb24255ffc917241a4632a3c123c117a5f293ae74