Analysis
-
max time kernel
123s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 12:01
Static task
static1
Behavioral task
behavioral1
Sample
1b392f652b111a20742563590351de64_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
1b392f652b111a20742563590351de64_JaffaCakes118.exe
-
Size
512KB
-
MD5
1b392f652b111a20742563590351de64
-
SHA1
98342fadeabd907ad3e9c7f2bea5555019bfc26d
-
SHA256
1e85acf018823342c785dd3c7f092f88a3dd72d65a0dbc436be728d05a270362
-
SHA512
825cf6b82a10372fcce1254309cd1708ffc9d5dc888a5370605997021075545dfc7961c98f181ed96e1331eb215ba885f01a14d87e08af54aba4c56f8577f97f
-
SSDEEP
3072:hr2BBXUqCYS+0ywYB5YdDZrovRorsiXGIRWi4pPXzr:klBpmlWC4xn
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
Processes:
1b392f652b111a20742563590351de64_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 1b392f652b111a20742563590351de64_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 1b392f652b111a20742563590351de64_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 1b392f652b111a20742563590351de64_JaffaCakes118.exe -
Processes:
1b392f652b111a20742563590351de64_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1b392f652b111a20742563590351de64_JaffaCakes118.exe -
Processes:
1b392f652b111a20742563590351de64_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 1b392f652b111a20742563590351de64_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 1b392f652b111a20742563590351de64_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 1b392f652b111a20742563590351de64_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 1b392f652b111a20742563590351de64_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 1b392f652b111a20742563590351de64_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 1b392f652b111a20742563590351de64_JaffaCakes118.exe -
Processes:
resource yara_rule behavioral1/memory/2856-3-0x0000000001F00000-0x0000000002F8E000-memory.dmp upx behavioral1/memory/2856-4-0x0000000001F00000-0x0000000002F8E000-memory.dmp upx behavioral1/memory/2856-5-0x0000000001F00000-0x0000000002F8E000-memory.dmp upx behavioral1/memory/2856-8-0x0000000001F00000-0x0000000002F8E000-memory.dmp upx behavioral1/memory/2856-6-0x0000000001F00000-0x0000000002F8E000-memory.dmp upx behavioral1/memory/2856-25-0x0000000001F00000-0x0000000002F8E000-memory.dmp upx behavioral1/memory/2856-7-0x0000000001F00000-0x0000000002F8E000-memory.dmp upx behavioral1/memory/2856-24-0x0000000001F00000-0x0000000002F8E000-memory.dmp upx behavioral1/memory/2856-26-0x0000000001F00000-0x0000000002F8E000-memory.dmp upx behavioral1/memory/2856-27-0x0000000001F00000-0x0000000002F8E000-memory.dmp upx behavioral1/memory/2856-28-0x0000000001F00000-0x0000000002F8E000-memory.dmp upx behavioral1/memory/2856-29-0x0000000001F00000-0x0000000002F8E000-memory.dmp upx behavioral1/memory/2856-30-0x0000000001F00000-0x0000000002F8E000-memory.dmp upx behavioral1/memory/2856-31-0x0000000001F00000-0x0000000002F8E000-memory.dmp upx behavioral1/memory/2856-33-0x0000000001F00000-0x0000000002F8E000-memory.dmp upx behavioral1/memory/2856-34-0x0000000001F00000-0x0000000002F8E000-memory.dmp upx behavioral1/memory/2856-35-0x0000000001F00000-0x0000000002F8E000-memory.dmp upx behavioral1/memory/2856-37-0x0000000001F00000-0x0000000002F8E000-memory.dmp upx behavioral1/memory/2856-45-0x0000000001F00000-0x0000000002F8E000-memory.dmp upx behavioral1/memory/2856-46-0x0000000001F00000-0x0000000002F8E000-memory.dmp upx behavioral1/memory/2856-47-0x0000000001F00000-0x0000000002F8E000-memory.dmp upx behavioral1/memory/2856-51-0x0000000001F00000-0x0000000002F8E000-memory.dmp upx behavioral1/memory/2856-52-0x0000000001F00000-0x0000000002F8E000-memory.dmp upx behavioral1/memory/2856-55-0x0000000001F00000-0x0000000002F8E000-memory.dmp upx behavioral1/memory/2856-56-0x0000000001F00000-0x0000000002F8E000-memory.dmp upx behavioral1/memory/2856-58-0x0000000001F00000-0x0000000002F8E000-memory.dmp upx behavioral1/memory/2856-59-0x0000000001F00000-0x0000000002F8E000-memory.dmp upx behavioral1/memory/2856-62-0x0000000001F00000-0x0000000002F8E000-memory.dmp upx behavioral1/memory/2856-63-0x0000000001F00000-0x0000000002F8E000-memory.dmp upx -
Processes:
1b392f652b111a20742563590351de64_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 1b392f652b111a20742563590351de64_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 1b392f652b111a20742563590351de64_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 1b392f652b111a20742563590351de64_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 1b392f652b111a20742563590351de64_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 1b392f652b111a20742563590351de64_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 1b392f652b111a20742563590351de64_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 1b392f652b111a20742563590351de64_JaffaCakes118.exe -
Processes:
1b392f652b111a20742563590351de64_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1b392f652b111a20742563590351de64_JaffaCakes118.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
1b392f652b111a20742563590351de64_JaffaCakes118.exedescription ioc process File opened (read-only) \??\I: 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened (read-only) \??\L: 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened (read-only) \??\M: 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened (read-only) \??\R: 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened (read-only) \??\S: 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened (read-only) \??\V: 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened (read-only) \??\Y: 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened (read-only) \??\H: 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened (read-only) \??\Z: 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened (read-only) \??\K: 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened (read-only) \??\J: 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened (read-only) \??\N: 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened (read-only) \??\O: 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened (read-only) \??\Q: 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened (read-only) \??\T: 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened (read-only) \??\W: 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened (read-only) \??\X: 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened (read-only) \??\E: 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened (read-only) \??\P: 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened (read-only) \??\U: 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened (read-only) \??\G: 1b392f652b111a20742563590351de64_JaffaCakes118.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
1b392f652b111a20742563590351de64_JaffaCakes118.exedescription ioc process File opened for modification C:\autorun.inf 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened for modification F:\autorun.inf 1b392f652b111a20742563590351de64_JaffaCakes118.exe -
Drops file in Program Files directory 5 IoCs
Processes:
1b392f652b111a20742563590351de64_JaffaCakes118.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe 1b392f652b111a20742563590351de64_JaffaCakes118.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe 1b392f652b111a20742563590351de64_JaffaCakes118.exe -
Drops file in Windows directory 1 IoCs
Processes:
1b392f652b111a20742563590351de64_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 1b392f652b111a20742563590351de64_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
1b392f652b111a20742563590351de64_JaffaCakes118.exepid process 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 32 IoCs
Processes:
1b392f652b111a20742563590351de64_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Token: SeDebugPrivilege 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
1b392f652b111a20742563590351de64_JaffaCakes118.exepid process 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
1b392f652b111a20742563590351de64_JaffaCakes118.exedescription pid process target process PID 2856 wrote to memory of 1116 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe taskhost.exe PID 2856 wrote to memory of 1168 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Dwm.exe PID 2856 wrote to memory of 1232 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Explorer.EXE PID 2856 wrote to memory of 2176 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe DllHost.exe PID 2856 wrote to memory of 1116 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe taskhost.exe PID 2856 wrote to memory of 1168 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Dwm.exe PID 2856 wrote to memory of 1232 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Explorer.EXE PID 2856 wrote to memory of 1116 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe taskhost.exe PID 2856 wrote to memory of 1168 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Dwm.exe PID 2856 wrote to memory of 1232 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Explorer.EXE PID 2856 wrote to memory of 1116 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe taskhost.exe PID 2856 wrote to memory of 1168 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Dwm.exe PID 2856 wrote to memory of 1232 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Explorer.EXE PID 2856 wrote to memory of 1116 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe taskhost.exe PID 2856 wrote to memory of 1168 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Dwm.exe PID 2856 wrote to memory of 1232 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Explorer.EXE PID 2856 wrote to memory of 1116 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe taskhost.exe PID 2856 wrote to memory of 1168 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Dwm.exe PID 2856 wrote to memory of 1232 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Explorer.EXE PID 2856 wrote to memory of 1116 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe taskhost.exe PID 2856 wrote to memory of 1168 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Dwm.exe PID 2856 wrote to memory of 1232 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Explorer.EXE PID 2856 wrote to memory of 1116 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe taskhost.exe PID 2856 wrote to memory of 1168 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Dwm.exe PID 2856 wrote to memory of 1232 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Explorer.EXE PID 2856 wrote to memory of 1116 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe taskhost.exe PID 2856 wrote to memory of 1168 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Dwm.exe PID 2856 wrote to memory of 1232 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Explorer.EXE PID 2856 wrote to memory of 1116 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe taskhost.exe PID 2856 wrote to memory of 1168 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Dwm.exe PID 2856 wrote to memory of 1232 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Explorer.EXE PID 2856 wrote to memory of 1116 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe taskhost.exe PID 2856 wrote to memory of 1168 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Dwm.exe PID 2856 wrote to memory of 1232 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Explorer.EXE PID 2856 wrote to memory of 1116 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe taskhost.exe PID 2856 wrote to memory of 1168 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Dwm.exe PID 2856 wrote to memory of 1232 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Explorer.EXE PID 2856 wrote to memory of 1116 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe taskhost.exe PID 2856 wrote to memory of 1168 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Dwm.exe PID 2856 wrote to memory of 1232 2856 1b392f652b111a20742563590351de64_JaffaCakes118.exe Explorer.EXE -
System policy modification 1 TTPs 1 IoCs
Processes:
1b392f652b111a20742563590351de64_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1b392f652b111a20742563590351de64_JaffaCakes118.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\1b392f652b111a20742563590351de64_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1b392f652b111a20742563590351de64_JaffaCakes118.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Impair Defenses
4Disable or Modify Tools
3Disable or Modify System Firewall
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
F:\stxb.pifFilesize
100KB
MD5c3e42335fa1351a43c11230eab46bd36
SHA12fb67349ab43cecf37a19a299421e493f7e7f246
SHA256557937fb4dbb7c69bde6e2ad640eee842ccf548e5cc8b133f75ef5e7d2cbcd10
SHA512d27dabfae20093617fc5db38f34af31f7456bd4f3476361218de43729dbbab6a28c9d6399f79c337a23147124d87a0debdd6c9cfa9cdba765da85cb8557c55a9
-
memory/1116-9-0x0000000001F90000-0x0000000001F92000-memory.dmpFilesize
8KB
-
memory/2856-29-0x0000000001F00000-0x0000000002F8E000-memory.dmpFilesize
16.6MB
-
memory/2856-8-0x0000000001F00000-0x0000000002F8E000-memory.dmpFilesize
16.6MB
-
memory/2856-0-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/2856-30-0x0000000001F00000-0x0000000002F8E000-memory.dmpFilesize
16.6MB
-
memory/2856-18-0x00000000004E0000-0x00000000004E2000-memory.dmpFilesize
8KB
-
memory/2856-19-0x00000000004F0000-0x00000000004F1000-memory.dmpFilesize
4KB
-
memory/2856-22-0x00000000004E0000-0x00000000004E2000-memory.dmpFilesize
8KB
-
memory/2856-21-0x00000000004F0000-0x00000000004F1000-memory.dmpFilesize
4KB
-
memory/2856-6-0x0000000001F00000-0x0000000002F8E000-memory.dmpFilesize
16.6MB
-
memory/2856-25-0x0000000001F00000-0x0000000002F8E000-memory.dmpFilesize
16.6MB
-
memory/2856-23-0x00000000004E0000-0x00000000004E2000-memory.dmpFilesize
8KB
-
memory/2856-7-0x0000000001F00000-0x0000000002F8E000-memory.dmpFilesize
16.6MB
-
memory/2856-24-0x0000000001F00000-0x0000000002F8E000-memory.dmpFilesize
16.6MB
-
memory/2856-26-0x0000000001F00000-0x0000000002F8E000-memory.dmpFilesize
16.6MB
-
memory/2856-27-0x0000000001F00000-0x0000000002F8E000-memory.dmpFilesize
16.6MB
-
memory/2856-28-0x0000000001F00000-0x0000000002F8E000-memory.dmpFilesize
16.6MB
-
memory/2856-4-0x0000000001F00000-0x0000000002F8E000-memory.dmpFilesize
16.6MB
-
memory/2856-31-0x0000000001F00000-0x0000000002F8E000-memory.dmpFilesize
16.6MB
-
memory/2856-5-0x0000000001F00000-0x0000000002F8E000-memory.dmpFilesize
16.6MB
-
memory/2856-33-0x0000000001F00000-0x0000000002F8E000-memory.dmpFilesize
16.6MB
-
memory/2856-34-0x0000000001F00000-0x0000000002F8E000-memory.dmpFilesize
16.6MB
-
memory/2856-35-0x0000000001F00000-0x0000000002F8E000-memory.dmpFilesize
16.6MB
-
memory/2856-37-0x0000000001F00000-0x0000000002F8E000-memory.dmpFilesize
16.6MB
-
memory/2856-45-0x0000000001F00000-0x0000000002F8E000-memory.dmpFilesize
16.6MB
-
memory/2856-46-0x0000000001F00000-0x0000000002F8E000-memory.dmpFilesize
16.6MB
-
memory/2856-47-0x0000000001F00000-0x0000000002F8E000-memory.dmpFilesize
16.6MB
-
memory/2856-51-0x0000000001F00000-0x0000000002F8E000-memory.dmpFilesize
16.6MB
-
memory/2856-52-0x0000000001F00000-0x0000000002F8E000-memory.dmpFilesize
16.6MB
-
memory/2856-55-0x0000000001F00000-0x0000000002F8E000-memory.dmpFilesize
16.6MB
-
memory/2856-56-0x0000000001F00000-0x0000000002F8E000-memory.dmpFilesize
16.6MB
-
memory/2856-58-0x0000000001F00000-0x0000000002F8E000-memory.dmpFilesize
16.6MB
-
memory/2856-59-0x0000000001F00000-0x0000000002F8E000-memory.dmpFilesize
16.6MB
-
memory/2856-62-0x0000000001F00000-0x0000000002F8E000-memory.dmpFilesize
16.6MB
-
memory/2856-63-0x0000000001F00000-0x0000000002F8E000-memory.dmpFilesize
16.6MB
-
memory/2856-78-0x00000000004E0000-0x00000000004E2000-memory.dmpFilesize
8KB
-
memory/2856-3-0x0000000001F00000-0x0000000002F8E000-memory.dmpFilesize
16.6MB