Analysis
-
max time kernel
92s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30-06-2024 18:22
Static task
static1
Behavioral task
behavioral1
Sample
491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe
Resource
win7-20240508-en
General
-
Target
491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe
-
Size
689KB
-
MD5
52a0860155906d97838ac445fb91d303
-
SHA1
b6a2317d54c964e270fb63508b12e0c390f9b06a
-
SHA256
491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7
-
SHA512
0b2c3da7b07e7ab5ee926aca352fe6fc76007aa0b006efaa23b55db4cae2b362c091839d181a5004f62c1601b966809dd511c638b7448defeba9de1aad030a09
-
SSDEEP
12288:5tpyxhomlpOKPjAavqoBWOmNsaBoPvnTEHeK5d:VyxhoUTv5Wtsa0vA+K5
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
Processes:
491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe -
Processes:
491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe -
Processes:
491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe -
Processes:
resource yara_rule behavioral2/memory/4316-1-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4316-3-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4316-5-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4316-13-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4316-6-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4316-8-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4316-4-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4316-14-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4316-23-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4316-24-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4316-25-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4316-26-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4316-27-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4316-28-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4316-29-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4316-30-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4316-31-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4316-33-0x00000000024B0000-0x000000000356A000-memory.dmp upx behavioral2/memory/4316-34-0x00000000024B0000-0x000000000356A000-memory.dmp upx -
Processes:
491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe -
Processes:
491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exedescription ioc process File opened (read-only) \??\G: 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe -
Drops file in Windows directory 2 IoCs
Processes:
491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exedescription ioc process File created C:\Windows\e574fd5 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe File opened for modification C:\Windows\SYSTEM.INI 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe -
Modifies registry class 3 IoCs
Processes:
491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A893393-71A8-4a50-95A1-2B89DE87B24C} 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A893393-71A8-4a50-95A1-2B89DE87B24C}\ = "0" 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A893393-71A8-4a50-95A1-2B89DE87B24C} 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exepid process 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exedescription pid process Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Token: SeDebugPrivilege 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exedescription pid process target process PID 4316 wrote to memory of 792 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe fontdrvhost.exe PID 4316 wrote to memory of 796 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe fontdrvhost.exe PID 4316 wrote to memory of 64 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe dwm.exe PID 4316 wrote to memory of 2636 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe sihost.exe PID 4316 wrote to memory of 2648 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe svchost.exe PID 4316 wrote to memory of 2984 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe taskhostw.exe PID 4316 wrote to memory of 3448 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe Explorer.EXE PID 4316 wrote to memory of 3588 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe svchost.exe PID 4316 wrote to memory of 3796 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe DllHost.exe PID 4316 wrote to memory of 3884 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe StartMenuExperienceHost.exe PID 4316 wrote to memory of 3952 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe RuntimeBroker.exe PID 4316 wrote to memory of 4052 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe SearchApp.exe PID 4316 wrote to memory of 3996 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe RuntimeBroker.exe PID 4316 wrote to memory of 4544 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe RuntimeBroker.exe PID 4316 wrote to memory of 3760 4316 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe TextInputHost.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe"C:\Users\Admin\AppData\Local\Temp\491647d7b61df3309fd6f389172a33d6c25edae73b4523b1ad025e9784194ce7.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Impair Defenses
4Disable or Modify Tools
3Disable or Modify System Firewall
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4316-0-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/4316-1-0x00000000024B0000-0x000000000356A000-memory.dmpFilesize
16.7MB
-
memory/4316-3-0x00000000024B0000-0x000000000356A000-memory.dmpFilesize
16.7MB
-
memory/4316-5-0x00000000024B0000-0x000000000356A000-memory.dmpFilesize
16.7MB
-
memory/4316-15-0x00000000006A0000-0x00000000006A2000-memory.dmpFilesize
8KB
-
memory/4316-22-0x00000000006A0000-0x00000000006A2000-memory.dmpFilesize
8KB
-
memory/4316-13-0x00000000024B0000-0x000000000356A000-memory.dmpFilesize
16.7MB
-
memory/4316-21-0x00000000774C0000-0x00000000774D0000-memory.dmpFilesize
64KB
-
memory/4316-20-0x00000000775F2000-0x00000000775F3000-memory.dmpFilesize
4KB
-
memory/4316-19-0x00000000006A0000-0x00000000006A2000-memory.dmpFilesize
8KB
-
memory/4316-17-0x00000000774C0000-0x00000000774D0000-memory.dmpFilesize
64KB
-
memory/4316-6-0x00000000024B0000-0x000000000356A000-memory.dmpFilesize
16.7MB
-
memory/4316-8-0x00000000024B0000-0x000000000356A000-memory.dmpFilesize
16.7MB
-
memory/4316-4-0x00000000024B0000-0x000000000356A000-memory.dmpFilesize
16.7MB
-
memory/4316-16-0x0000000002310000-0x0000000002311000-memory.dmpFilesize
4KB
-
memory/4316-14-0x00000000024B0000-0x000000000356A000-memory.dmpFilesize
16.7MB
-
memory/4316-23-0x00000000024B0000-0x000000000356A000-memory.dmpFilesize
16.7MB
-
memory/4316-24-0x00000000024B0000-0x000000000356A000-memory.dmpFilesize
16.7MB
-
memory/4316-25-0x00000000024B0000-0x000000000356A000-memory.dmpFilesize
16.7MB
-
memory/4316-26-0x00000000024B0000-0x000000000356A000-memory.dmpFilesize
16.7MB
-
memory/4316-27-0x00000000024B0000-0x000000000356A000-memory.dmpFilesize
16.7MB
-
memory/4316-28-0x00000000024B0000-0x000000000356A000-memory.dmpFilesize
16.7MB
-
memory/4316-29-0x00000000024B0000-0x000000000356A000-memory.dmpFilesize
16.7MB
-
memory/4316-30-0x00000000024B0000-0x000000000356A000-memory.dmpFilesize
16.7MB
-
memory/4316-31-0x00000000024B0000-0x000000000356A000-memory.dmpFilesize
16.7MB
-
memory/4316-33-0x00000000024B0000-0x000000000356A000-memory.dmpFilesize
16.7MB
-
memory/4316-42-0x00000000006A0000-0x00000000006A2000-memory.dmpFilesize
8KB
-
memory/4316-52-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/4316-34-0x00000000024B0000-0x000000000356A000-memory.dmpFilesize
16.7MB