Analysis
-
max time kernel
31s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
02/02/2025, 01:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c6c02498efa122dd945e31577098ea8c7497d9e303d0a33c4b4b1a5b60b48471N.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
120 seconds
General
-
Target
c6c02498efa122dd945e31577098ea8c7497d9e303d0a33c4b4b1a5b60b48471N.dll
-
Size
120KB
-
MD5
0dc6074b25a20c1f7cb5e06e33ae5630
-
SHA1
d00bdda9119c9eb3a5c84b3f6c8017b607fb8596
-
SHA256
c6c02498efa122dd945e31577098ea8c7497d9e303d0a33c4b4b1a5b60b48471
-
SHA512
ed8ec8be9572c86b6517e3dafd65bc859245d1969ed7414cf1ef251e42f8f6389f3333b43c22eb49711cecdaa50d6ee0c10398b18496c24107e9892bbb586a94
-
SSDEEP
1536:gYW1BZqAJ5UBZUCrLw72oAcCjqyTtqgYZrAROH8UatBrKeLuHtyqCO4CS+1I/i:zWfJC2zCjqQiroOH8USrCCO4CShK
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57927c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57927c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57927c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57665b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57665b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57665b.exe -
Sality family
-
UAC bypass 3 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57665b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57927c.exe -
Windows security bypass 2 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57665b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57665b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57927c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57927c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57927c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57927c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57927c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57665b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57665b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57665b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57665b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57927c.exe -
Executes dropped EXE 4 IoCs
pid Process 1524 e57665b.exe 4772 e5767c2.exe 2596 e57927c.exe 612 e57929b.exe -
Windows security modification 2 TTPs 14 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57927c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57665b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57665b.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57665b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57927c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57927c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57927c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57665b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57927c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57927c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57665b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57665b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57665b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57927c.exe -
Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57665b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57927c.exe -
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: e57927c.exe File opened (read-only) \??\H: e57927c.exe File opened (read-only) \??\H: e57665b.exe File opened (read-only) \??\I: e57665b.exe File opened (read-only) \??\I: e57927c.exe File opened (read-only) \??\M: e57665b.exe File opened (read-only) \??\E: e57927c.exe File opened (read-only) \??\J: e57665b.exe File opened (read-only) \??\K: e57665b.exe File opened (read-only) \??\L: e57665b.exe File opened (read-only) \??\N: e57665b.exe File opened (read-only) \??\J: e57927c.exe File opened (read-only) \??\E: e57665b.exe File opened (read-only) \??\G: e57665b.exe -
resource yara_rule behavioral2/memory/1524-6-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/1524-8-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/1524-9-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/1524-10-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/1524-20-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/1524-32-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/1524-27-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/1524-33-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/1524-34-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/1524-37-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/1524-36-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/1524-35-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/1524-38-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/1524-39-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/1524-40-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/1524-46-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/1524-59-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/1524-61-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/1524-63-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/1524-65-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/1524-66-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/1524-68-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/1524-70-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/1524-73-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/1524-78-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/2596-110-0x0000000000780000-0x000000000183A000-memory.dmp upx behavioral2/memory/2596-159-0x0000000000780000-0x000000000183A000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e5766e8 e57665b.exe File opened for modification C:\Windows\SYSTEM.INI e57665b.exe File created C:\Windows\e57b9da e57927c.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57929b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57665b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e5767c2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e57927c.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1524 e57665b.exe 1524 e57665b.exe 1524 e57665b.exe 1524 e57665b.exe 2596 e57927c.exe 2596 e57927c.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe Token: SeDebugPrivilege 1524 e57665b.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4384 wrote to memory of 1856 4384 rundll32.exe 83 PID 4384 wrote to memory of 1856 4384 rundll32.exe 83 PID 4384 wrote to memory of 1856 4384 rundll32.exe 83 PID 1856 wrote to memory of 1524 1856 rundll32.exe 85 PID 1856 wrote to memory of 1524 1856 rundll32.exe 85 PID 1856 wrote to memory of 1524 1856 rundll32.exe 85 PID 1524 wrote to memory of 788 1524 e57665b.exe 8 PID 1524 wrote to memory of 796 1524 e57665b.exe 9 PID 1524 wrote to memory of 384 1524 e57665b.exe 13 PID 1524 wrote to memory of 3068 1524 e57665b.exe 50 PID 1524 wrote to memory of 784 1524 e57665b.exe 51 PID 1524 wrote to memory of 3160 1524 e57665b.exe 53 PID 1524 wrote to memory of 3432 1524 e57665b.exe 56 PID 1524 wrote to memory of 3540 1524 e57665b.exe 57 PID 1524 wrote to memory of 3736 1524 e57665b.exe 58 PID 1524 wrote to memory of 3840 1524 e57665b.exe 59 PID 1524 wrote to memory of 3912 1524 e57665b.exe 60 PID 1524 wrote to memory of 4004 1524 e57665b.exe 61 PID 1524 wrote to memory of 4160 1524 e57665b.exe 62 PID 1524 wrote to memory of 4924 1524 e57665b.exe 74 PID 1524 wrote to memory of 4420 1524 e57665b.exe 76 PID 1524 wrote to memory of 3612 1524 e57665b.exe 80 PID 1524 wrote to memory of 3528 1524 e57665b.exe 81 PID 1524 wrote to memory of 4384 1524 e57665b.exe 82 PID 1524 wrote to memory of 1856 1524 e57665b.exe 83 PID 1524 wrote to memory of 1856 1524 e57665b.exe 83 PID 1524 wrote to memory of 3392 1524 e57665b.exe 84 PID 1856 wrote to memory of 4772 1856 rundll32.exe 86 PID 1856 wrote to memory of 4772 1856 rundll32.exe 86 PID 1856 wrote to memory of 4772 1856 rundll32.exe 86 PID 1524 wrote to memory of 788 1524 e57665b.exe 8 PID 1524 wrote to memory of 796 1524 e57665b.exe 9 PID 1524 wrote to memory of 384 1524 e57665b.exe 13 PID 1524 wrote to memory of 3068 1524 e57665b.exe 50 PID 1524 wrote to memory of 784 1524 e57665b.exe 51 PID 1524 wrote to memory of 3160 1524 e57665b.exe 53 PID 1524 wrote to memory of 3432 1524 e57665b.exe 56 PID 1524 wrote to memory of 3540 1524 e57665b.exe 57 PID 1524 wrote to memory of 3736 1524 e57665b.exe 58 PID 1524 wrote to memory of 3840 1524 e57665b.exe 59 PID 1524 wrote to memory of 3912 1524 e57665b.exe 60 PID 1524 wrote to memory of 4004 1524 e57665b.exe 61 PID 1524 wrote to memory of 4160 1524 e57665b.exe 62 PID 1524 wrote to memory of 4924 1524 e57665b.exe 74 PID 1524 wrote to memory of 4420 1524 e57665b.exe 76 PID 1524 wrote to memory of 3612 1524 e57665b.exe 80 PID 1524 wrote to memory of 3528 1524 e57665b.exe 81 PID 1524 wrote to memory of 4384 1524 e57665b.exe 82 PID 1524 wrote to memory of 4772 1524 e57665b.exe 86 PID 1524 wrote to memory of 4772 1524 e57665b.exe 86 PID 1524 wrote to memory of 3356 1524 e57665b.exe 87 PID 1524 wrote to memory of 4236 1524 e57665b.exe 88 PID 1856 wrote to memory of 2596 1856 rundll32.exe 89 PID 1856 wrote to memory of 2596 1856 rundll32.exe 89 PID 1856 wrote to memory of 2596 1856 rundll32.exe 89 PID 1856 wrote to memory of 612 1856 rundll32.exe 90 PID 1856 wrote to memory of 612 1856 rundll32.exe 90 PID 1856 wrote to memory of 612 1856 rundll32.exe 90 PID 2596 wrote to memory of 788 2596 e57927c.exe 8 PID 2596 wrote to memory of 796 2596 e57927c.exe 9 PID 2596 wrote to memory of 384 2596 e57927c.exe 13 PID 2596 wrote to memory of 3068 2596 e57927c.exe 50 PID 2596 wrote to memory of 784 2596 e57927c.exe 51 PID 2596 wrote to memory of 3160 2596 e57927c.exe 53 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57665b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57927c.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:796
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:384
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:3068
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:784
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3160
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3432
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c6c02498efa122dd945e31577098ea8c7497d9e303d0a33c4b4b1a5b60b48471N.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c6c02498efa122dd945e31577098ea8c7497d9e303d0a33c4b4b1a5b60b48471N.dll,#13⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\e57665b.exeC:\Users\Admin\AppData\Local\Temp\e57665b.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1524
-
-
C:\Users\Admin\AppData\Local\Temp\e5767c2.exeC:\Users\Admin\AppData\Local\Temp\e5767c2.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4772
-
-
C:\Users\Admin\AppData\Local\Temp\e57927c.exeC:\Users\Admin\AppData\Local\Temp\e57927c.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2596
-
-
C:\Users\Admin\AppData\Local\Temp\e57929b.exeC:\Users\Admin\AppData\Local\Temp\e57929b.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:612
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3540
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3736
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3840
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3912
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4004
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4160
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4924
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4420
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:3612
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:3528
-
C:\Windows\system32\BackgroundTaskHost.exe"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider1⤵PID:3392
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3356
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4236
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD50128e7eb42d0c07202f5bdaba9c93ddc
SHA1768743e79058859dadd6e6c0e5191a9885646a57
SHA256cdb2875b4f7da9ce1361bd01d0f63dd4217970e3db5086de1e7e0a5277e35aae
SHA512ac1a37d25dd5bce52c377b41c4ea4ef1f29c7d2c067e916e2231d2da64dc6fd803ee23b8c35551e73be19a2db2a1990df72a121a8560cf47e6c9c3586f2986f2
-
Filesize
257B
MD5e63b2a36c1e531cd118ae0096a279292
SHA1c78fdd07643c599edd040236daa7d81eb7b275cb
SHA256200cc47511cb1f3bc95cae9b5848cd88fa6abdb4cd04f908e876dfd53989b662
SHA51268e525d231a1efa501fa2435421e6bc057828c3064b51aa56d5e8ffc6022cceb508ec6a153a72f13ddb5f5d0891bb07b44d7602d03c29175692630f798c5c52e