Analysis
- max time kernel
149s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 12:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_Virus.Win32.Sality.gen.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target jaffacakes118_Virus.Win32.Sality.gen.exe
- Size 97KB
- Sample261014-precws116p
- SHA256 f4eee23688c65201b0d596d786488f415a25d3832ae8f5912e4583076eeae7d2
- MD5 f5bddf3e34c1f520779af7e16c4c0c70
- SHA1 80bfab9c4852946290122cb33989a4cf51c05c52
- SHA512 7ce441dda1b270582f4e0e91884f43f030e8802aff1433fd5c0e339de51337995b36686cc33c1ab936e8bc199f4c438a9730e0a643c15f109641b61e6e7e851c
- SSDEEP 1536:F8XS0Or+qKq0bR1DkkJ4/hoLtmlezY9sRwrDZ+3aRdeEmw:FRTr+F1NjRxU+3a+y
- TLSH T105A31297111646F4D2B4A17F7BA0C70FC7519732A3701C8E9CFA87BAB5B5E1CA1A5009
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" jaffacakes118_Virus.Win32.Sality.gen.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" jaffacakes118_Virus.Win32.Sality.gen.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" jaffacakes118_Virus.Win32.Sality.gen.exe - UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" jaffacakes118_Virus.Win32.Sality.gen.exe - Windows security bypass 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" jaffacakes118_Virus.Win32.Sality.gen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" jaffacakes118_Virus.Win32.Sality.gen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" jaffacakes118_Virus.Win32.Sality.gen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" jaffacakes118_Virus.Win32.Sality.gen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" jaffacakes118_Virus.Win32.Sality.gen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" jaffacakes118_Virus.Win32.Sality.gen.exe - Windows security modification 2 TTPs 7 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" jaffacakes118_Virus.Win32.Sality.gen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" jaffacakes118_Virus.Win32.Sality.gen.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc jaffacakes118_Virus.Win32.Sality.gen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" jaffacakes118_Virus.Win32.Sality.gen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" jaffacakes118_Virus.Win32.Sality.gen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" jaffacakes118_Virus.Win32.Sality.gen.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" jaffacakes118_Virus.Win32.Sality.gen.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" jaffacakes118_Virus.Win32.Sality.gen.exe - Enumerates connected drives 3 TTPs 7 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: jaffacakes118_Virus.Win32.Sality.gen.exe File opened (read-only) \??\G: jaffacakes118_Virus.Win32.Sality.gen.exe File opened (read-only) \??\H: jaffacakes118_Virus.Win32.Sality.gen.exe File opened (read-only) \??\I: jaffacakes118_Virus.Win32.Sality.gen.exe File opened (read-only) \??\J: jaffacakes118_Virus.Win32.Sality.gen.exe File opened (read-only) \??\K: jaffacakes118_Virus.Win32.Sality.gen.exe File opened (read-only) \??\L: jaffacakes118_Virus.Win32.Sality.gen.exe -
resource yara_rule behavioral2/memory/3864-1-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral2/memory/3864-2-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral2/memory/3864-6-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral2/memory/3864-5-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral2/memory/3864-4-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral2/memory/3864-7-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral2/memory/3864-8-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral2/memory/3864-12-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral2/memory/3864-10-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral2/memory/3864-11-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral2/memory/3864-9-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral2/memory/3864-21-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral2/memory/3864-22-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral2/memory/3864-23-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral2/memory/3864-24-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral2/memory/3864-25-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral2/memory/3864-26-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral2/memory/3864-28-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral2/memory/3864-30-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral2/memory/3864-31-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral2/memory/3864-33-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral2/memory/3864-35-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral2/memory/3864-36-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral2/memory/3864-45-0x0000000000980000-0x0000000001A3A000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI jaffacakes118_Virus.Win32.Sality.gen.exe File created C:\Windows\e59fc58 jaffacakes118_Virus.Win32.Sality.gen.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Virus.Win32.Sality.gen.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3864 jaffacakes118_Virus.Win32.Sality.gen.exe 3864 jaffacakes118_Virus.Win32.Sality.gen.exe 3864 jaffacakes118_Virus.Win32.Sality.gen.exe 3864 jaffacakes118_Virus.Win32.Sality.gen.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe Token: SeDebugPrivilege 3864 jaffacakes118_Virus.Win32.Sality.gen.exe - Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 3864 wrote to memory of 1164 3864 jaffacakes118_Virus.Win32.Sality.gen.exe 15 PID 3864 wrote to memory of 712 3864 jaffacakes118_Virus.Win32.Sality.gen.exe 43 PID 3864 wrote to memory of 3112 3864 jaffacakes118_Virus.Win32.Sality.gen.exe 46 PID 3864 wrote to memory of 3436 3864 jaffacakes118_Virus.Win32.Sality.gen.exe 48 PID 3864 wrote to memory of 3180 3864 jaffacakes118_Virus.Win32.Sality.gen.exe 55 PID 3864 wrote to memory of 4348 3864 jaffacakes118_Virus.Win32.Sality.gen.exe 57 PID 3864 wrote to memory of 4392 3864 jaffacakes118_Virus.Win32.Sality.gen.exe 58 PID 3864 wrote to memory of 4456 3864 jaffacakes118_Virus.Win32.Sality.gen.exe 59 PID 3864 wrote to memory of 4736 3864 jaffacakes118_Virus.Win32.Sality.gen.exe 61 PID 3864 wrote to memory of 4968 3864 jaffacakes118_Virus.Win32.Sality.gen.exe 62 PID 3864 wrote to memory of 5124 3864 jaffacakes118_Virus.Win32.Sality.gen.exe 63 PID 3864 wrote to memory of 5228 3864 jaffacakes118_Virus.Win32.Sality.gen.exe 64 PID 3864 wrote to memory of 5844 3864 jaffacakes118_Virus.Win32.Sality.gen.exe 77 PID 3864 wrote to memory of 3016 3864 jaffacakes118_Virus.Win32.Sality.gen.exe 79 PID 3864 wrote to memory of 816 3864 jaffacakes118_Virus.Win32.Sality.gen.exe 80 PID 3864 wrote to memory of 3572 3864 jaffacakes118_Virus.Win32.Sality.gen.exe 81 PID 3864 wrote to memory of 3684 3864 jaffacakes118_Virus.Win32.Sality.gen.exe 82 PID 3864 wrote to memory of 1164 3864 jaffacakes118_Virus.Win32.Sality.gen.exe 15 PID 3864 wrote to memory of 712 3864 jaffacakes118_Virus.Win32.Sality.gen.exe 43 PID 3864 wrote to memory of 3112 3864 jaffacakes118_Virus.Win32.Sality.gen.exe 46 PID 3864 wrote to memory of 3436 3864 jaffacakes118_Virus.Win32.Sality.gen.exe 48 PID 3864 wrote to memory of 3180 3864 jaffacakes118_Virus.Win32.Sality.gen.exe 55 PID 3864 wrote to memory of 4348 3864 jaffacakes118_Virus.Win32.Sality.gen.exe 57 PID 3864 wrote to memory of 4392 3864 jaffacakes118_Virus.Win32.Sality.gen.exe 58 PID 3864 wrote to memory of 4456 3864 jaffacakes118_Virus.Win32.Sality.gen.exe 59 PID 3864 wrote to memory of 4736 3864 jaffacakes118_Virus.Win32.Sality.gen.exe 61 PID 3864 wrote to memory of 4968 3864 jaffacakes118_Virus.Win32.Sality.gen.exe 62 PID 3864 wrote to memory of 5124 3864 jaffacakes118_Virus.Win32.Sality.gen.exe 63 PID 3864 wrote to memory of 5228 3864 jaffacakes118_Virus.Win32.Sality.gen.exe 64 PID 3864 wrote to memory of 5844 3864 jaffacakes118_Virus.Win32.Sality.gen.exe 77 PID 3864 wrote to memory of 3016 3864 jaffacakes118_Virus.Win32.Sality.gen.exe 79 PID 3864 wrote to memory of 816 3864 jaffacakes118_Virus.Win32.Sality.gen.exe 80 PID 3864 wrote to memory of 3572 3864 jaffacakes118_Virus.Win32.Sality.gen.exe 81 PID 3864 wrote to memory of 3684 3864 jaffacakes118_Virus.Win32.Sality.gen.exe 82 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" jaffacakes118_Virus.Win32.Sality.gen.exe
Processes
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1164
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:712
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc1⤵PID:3112
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵PID:3436
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3180
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4348
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4392
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵PID:4456
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:4736
-
C:\Windows\system32\ctfmon.exe/QuitInfo:0000000000000234;000000000000026C;1⤵PID:4968
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵PID:5124
-
C:\Windows\System32\SecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe"1⤵PID:5228
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:5844
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Virus.Win32.Sality.gen.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Virus.Win32.Sality.gen.exe"3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3864
-
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵PID:816
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3572
-
C:\Windows\System32\smartscreen.exeC:\Windows\System32\smartscreen.exe -Embedding1⤵PID:3684
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\winrhefq.exe
- Size 65KB
- SHA256 f2c0e97417e6a1a6e1277a79505bd643c7f4b732a8cba84c8d367d85b5800ecf
- MD5 d414f304b98f71d26067c0d02e7688a5
- SHA1 0bc3ff557bb5b4c833831cdacdd5e22b1da299f4
- SHA512 f86a3dede64b8dcc1d34987ea5a4c1e3db22f571696a270bb08a71184f48868d2d97fb93ef47d74e23106701ecfd405235fb041d80c7bda2709ba4f2636b32e4
- SSDEEP 1536:JaxBIDivgFUazvAZMYWWuKe8pqYTL3fz0hX:JYqWgFBvAnaKe8pqcCX
- TLSH T10E5302D779514BA1D954AB7FCB0694031EB5082A85B558FBB323AE20721BFAE733C04D
- MD5 SHA1 SHA512 SSDEEP TLSH