Analysis
-
max time kernel
123s -
max time network
82s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
05/03/2025, 19:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe
Resource
win7-20241010-en
windows7-x64
18 signatures
150 seconds
General
-
Target
JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe
-
Size
97KB
-
MD5
535362672f551387e6dc74b9ecbfe14c
-
SHA1
28bc40e861b4b7251bd58c2ef0aef852099fbb6b
-
SHA256
3e214684d5017c9be533a3d560fab38fac344ff484c95b97a223e7ebff0c0bcf
-
SHA512
e9a43a90b1cf547abf2617c5ffc1edaa3f3c1ea5744a1790239012c5e8c090cfdc1377ca971d588ece78c6eaba4115e5eeeb7509f5bd344cf03446fbf865682a
-
SSDEEP
1536:p5zs/HYArf8g3IQyZlcmCI+CaLvThXNVAHOo1IKfLZNVGo94tePb:p5I/yg3TyZjCFzvT9N6LKKzZOoAe
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe -
Sality family
-
UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe -
Windows security bypass 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe -
Windows security modification 2 TTPs 7 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe -
Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe File opened (read-only) \??\L: JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe File opened (read-only) \??\W: JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe File opened (read-only) \??\Y: JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe File opened (read-only) \??\J: JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe File opened (read-only) \??\M: JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe File opened (read-only) \??\P: JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe File opened (read-only) \??\S: JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe File opened (read-only) \??\T: JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe File opened (read-only) \??\V: JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe File opened (read-only) \??\Z: JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe File opened (read-only) \??\E: JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe File opened (read-only) \??\I: JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe File opened (read-only) \??\K: JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe File opened (read-only) \??\Q: JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe File opened (read-only) \??\R: JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe File opened (read-only) \??\U: JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe File opened (read-only) \??\X: JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe File opened (read-only) \??\H: JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe File opened (read-only) \??\N: JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe File opened (read-only) \??\O: JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe File opened for modification F:\autorun.inf JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe -
resource yara_rule behavioral1/memory/2248-1-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2248-17-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2248-21-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2248-19-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2248-4-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2248-5-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2248-22-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2248-20-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2248-18-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2248-3-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2248-35-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2248-36-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2248-37-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2248-38-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2248-39-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2248-41-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2248-42-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2248-49-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2248-50-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2248-52-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2248-54-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2248-57-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2248-59-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2248-63-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2248-71-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2248-72-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2248-73-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2248-74-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2248-82-0x0000000000590000-0x000000000164A000-memory.dmp upx -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe File opened for modification C:\Program Files\7-Zip\7z.exe JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe File opened for modification C:\Program Files\7-Zip\7zG.exe JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\f77c7e1 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe File opened for modification C:\Windows\SYSTEM.INI JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe -
Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeDebugPrivilege 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe Token: SeDebugPrivilege 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe Token: SeDebugPrivilege 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe Token: SeDebugPrivilege 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe Token: SeDebugPrivilege 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe Token: SeDebugPrivilege 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe Token: SeDebugPrivilege 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe Token: SeDebugPrivilege 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe Token: SeDebugPrivilege 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe Token: SeDebugPrivilege 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe Token: SeDebugPrivilege 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe Token: SeDebugPrivilege 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe Token: SeDebugPrivilege 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe Token: SeDebugPrivilege 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe Token: SeDebugPrivilege 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe Token: SeDebugPrivilege 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe Token: SeDebugPrivilege 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe Token: SeDebugPrivilege 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe Token: SeDebugPrivilege 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe Token: SeDebugPrivilege 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe Token: SeDebugPrivilege 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe Token: SeDebugPrivilege 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 2248 wrote to memory of 1108 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 19 PID 2248 wrote to memory of 1164 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 20 PID 2248 wrote to memory of 1220 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 21 PID 2248 wrote to memory of 1244 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 23 PID 2248 wrote to memory of 1108 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 19 PID 2248 wrote to memory of 1164 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 20 PID 2248 wrote to memory of 1220 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 21 PID 2248 wrote to memory of 1244 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 23 PID 2248 wrote to memory of 1108 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 19 PID 2248 wrote to memory of 1164 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 20 PID 2248 wrote to memory of 1220 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 21 PID 2248 wrote to memory of 1244 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 23 PID 2248 wrote to memory of 1108 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 19 PID 2248 wrote to memory of 1164 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 20 PID 2248 wrote to memory of 1220 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 21 PID 2248 wrote to memory of 1244 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 23 PID 2248 wrote to memory of 1108 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 19 PID 2248 wrote to memory of 1164 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 20 PID 2248 wrote to memory of 1220 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 21 PID 2248 wrote to memory of 1244 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 23 PID 2248 wrote to memory of 1108 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 19 PID 2248 wrote to memory of 1164 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 20 PID 2248 wrote to memory of 1220 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 21 PID 2248 wrote to memory of 1244 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 23 PID 2248 wrote to memory of 1108 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 19 PID 2248 wrote to memory of 1164 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 20 PID 2248 wrote to memory of 1220 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 21 PID 2248 wrote to memory of 1244 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 23 PID 2248 wrote to memory of 1108 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 19 PID 2248 wrote to memory of 1164 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 20 PID 2248 wrote to memory of 1220 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 21 PID 2248 wrote to memory of 1244 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 23 PID 2248 wrote to memory of 1108 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 19 PID 2248 wrote to memory of 1164 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 20 PID 2248 wrote to memory of 1220 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 21 PID 2248 wrote to memory of 1244 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 23 PID 2248 wrote to memory of 1108 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 19 PID 2248 wrote to memory of 1164 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 20 PID 2248 wrote to memory of 1220 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 21 PID 2248 wrote to memory of 1244 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 23 PID 2248 wrote to memory of 1108 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 19 PID 2248 wrote to memory of 1164 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 20 PID 2248 wrote to memory of 1220 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 21 PID 2248 wrote to memory of 1244 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 23 PID 2248 wrote to memory of 1108 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 19 PID 2248 wrote to memory of 1164 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 20 PID 2248 wrote to memory of 1220 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 21 PID 2248 wrote to memory of 1244 2248 JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe 23 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1108
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1164
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_535362672f551387e6dc74b9ecbfe14c.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2248
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1244
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD50e5e2852996d3c563df5e343020b7e64
SHA1d9d5122439f610868ab52d2d70be2b29f6c79aa0
SHA2567b469fdff7dfd1a0f485d9fe5901fa83eb7e3d7f2b07215e4351ddba1f4676f3
SHA512e02e91ffe47d60b1bab79415ef39731a8750e49a5bcf4420415f1146512988c81c7fb7842f4b83f670c9680840eea276bbaf94de865ae5baaf87209203923201