Analysis
-
max time kernel
141s -
max time network
149s -
resource
win10v191014
Task
task1
Sample
9.bin.exe
Resource
win7v191014
0 signatures
General
-
Target
9.bin
-
Sample
191111-hb6qpeaars
-
SHA256
6b88260f4c4da4651a82bb62761cd23ee9ad6662a2a0abbec017e7193668397b
Score
N/A
Malware Config
Extracted
Family
qakbot
Campaign
1573198674
C2
173.3.132.17:995
75.131.72.82:443
68.238.144.55:443
100.4.185.8:443
80.14.209.42:2222
24.253.109.46:443
5.182.39.156:443
201.188.17.26:443
23.240.185.215:443
69.92.54.95:995
68.131.9.203:443
187.163.139.200:993
75.81.25.223:995
24.201.68.105:2078
32.208.1.239:443
170.10.78.48:443
74.194.4.181:443
71.30.56.170:443
174.16.234.171:993
47.153.115.154:443
75.175.209.163:995
68.238.56.27:443
173.22.120.11:2222
184.180.157.203:2222
24.203.64.26:2222
99.228.5.106:443
47.153.115.154:995
64.19.74.29:995
104.3.91.20:995
72.214.25.227:995
73.37.61.237:443
76.181.237.223:443
107.12.140.181:443
67.5.33.229:2078
50.246.229.50:443
67.246.16.250:995
75.130.117.134:443
75.110.250.89:443
173.91.254.236:443
50.78.93.74:995
197.89.78.71:995
5.89.115.73:2222
47.23.101.26:993
12.5.37.3:995
24.30.71.200:443
72.29.181.77:2078
71.93.60.90:443
72.46.151.196:995
173.233.182.249:443
67.10.18.112:993
98.148.177.77:443
184.74.101.234:995
172.78.45.13:995
181.14.188.8:443
168.245.228.71:443
186.47.208.238:50000
96.244.38.23:443
74.134.35.54:443
105.246.79.153:995
70.74.159.126:2222
172.250.91.246:443
47.202.98.230:443
47.214.144.253:443
70.187.124.135:443
186.109.159.172:443
75.142.59.167:443
107.12.131.249:443
96.35.170.82:2222
65.16.241.150:443
107.184.252.92:443
47.155.19.205:443
98.155.154.220:443
69.170.237.82:995
75.110.90.155:443
75.165.181.122:443
166.62.180.194:2078
62.103.70.217:995
108.45.183.59:443
83.79.2.218:2222
47.153.115.154:443
108.5.34.128:443
76.116.128.81:443
185.219.83.73:443
76.169.19.193:443
104.235.94.7:443
65.30.12.240:443
76.80.66.226:443
111.125.70.30:2222
181.197.195.138:995
2.177.101.143:443
24.196.158.28:443
123.252.128.47:443
199.126.92.231:995
173.178.129.3:990
12.5.37.3:443
184.191.62.78:443
71.77.231.251:443
12.176.32.146:443
72.16.212.107:995
108.227.161.27:443
205.250.79.62:443
201.152.218.64:995
73.226.220.56:443
181.126.80.118:443
108.160.123.244:443
67.214.201.117:2222
173.247.186.90:443
50.247.230.33:443
104.32.185.213:2222
68.174.15.223:443
96.59.11.86:443
174.131.181.120:995
207.162.184.228:443
173.178.129.3:443
47.23.101.26:465
206.51.202.106:50002
75.131.72.82:995
174.48.72.160:443
70.120.151.69:443
47.146.169.85:443
24.184.6.58:2222
24.93.168.38:443
75.70.218.193:443
162.244.225.30:443
106.51.0.228:443
174.130.203.235:443
67.200.146.98:2222
109.169.204.115:21
162.244.224.166:443
104.34.122.18:443
72.29.181.77:2083
112.171.126.153:443
75.131.72.82:2087
73.195.20.237:443
66.214.75.176:443
137.25.72.175:443
24.180.7.155:443
67.160.63.127:443
24.203.221.252:2222
73.209.113.58:443
74.78.77.189:443
71.57.230.51:50000
75.165.132.69:443
200.104.40.85:443
97.84.226.90:443
73.137.187.150:443
75.165.162.33:443
74.134.4.236:443
1.172.91.243:443
181.47.60.21:995
Signatures
-
Drops file in system dir 5 IoCs
Processes:
svchost.exedescription ioc pid process File opened for modification C:\Windows\Debug\ESE.TXT 3080 svchost.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp 3080 svchost.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp 3080 svchost.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-2.tmp 3080 svchost.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-2.tmp 3080 svchost.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exesvchost.exedescription ioc pid process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet\SpyNetReporting = "0" 4644 reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet\SubmitSamplesConsent = "2" 4348 reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0" 4188 reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "2" 4116 reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0" 3716 reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "2" 4132 reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\cval = "0" 1804 svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\cval = "1" 1804 svchost.exe -
Qakbot persistence 1 IoCs
Processes:
explorer.exedescription ioc pid process Event created 2ijsethyt4360 4360 explorer.exe -
Uses Task Scheduler COM API 1 TTPs 14 IoCs
Processes:
schtasks.exedescription ioc pid process Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD} 2604 schtasks.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd} 2604 schtasks.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs 2604 schtasks.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\ 2604 schtasks.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32 2604 schtasks.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32\InprocServer32 2604 schtasks.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32\ 2604 schtasks.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32\ThreadingModel 2604 schtasks.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32 2604 schtasks.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler 2604 schtasks.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32 2604 schtasks.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\AppID 2604 schtasks.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer 2604 schtasks.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation 2604 schtasks.exe -
Adds Run entry to start application 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc pid process Set value (str) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Software\Microsoft\Windows\CurrentVersion\Run\najyrt = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Onjpsefhpr\\ijsethyt.exe\"" 4360 explorer.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
ijsethyt.exepid process 452 ijsethyt.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
9.bin.exe9.bin.exeijsethyt.exeijsethyt.exeexplorer.exe9.bin.exeijsethyt.exeijsethyt.exepid process 4924 9.bin.exe 5020 9.bin.exe 452 ijsethyt.exe 4292 ijsethyt.exe 4360 explorer.exe 4612 9.bin.exe 4128 ijsethyt.exe 4828 ijsethyt.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
9.bin.exeSppExtComObj.exeijsethyt.exe9.bin.exeijsethyt.exedescription pid process target process PID 4924 wrote to memory of 5020 4924 9.bin.exe 9.bin.exe PID 5092 wrote to memory of 4196 5092 SppExtComObj.exe SLUI.exe PID 4924 wrote to memory of 452 4924 9.bin.exe ijsethyt.exe PID 4924 wrote to memory of 2108 4924 9.bin.exe schtasks.exe PID 452 wrote to memory of 4292 452 ijsethyt.exe ijsethyt.exe PID 452 wrote to memory of 4360 452 ijsethyt.exe explorer.exe PID 4612 wrote to memory of 4644 4612 9.bin.exe reg.exe PID 4612 wrote to memory of 4348 4612 9.bin.exe reg.exe PID 4612 wrote to memory of 4320 4612 9.bin.exe reg.exe PID 4612 wrote to memory of 4276 4612 9.bin.exe reg.exe PID 4612 wrote to memory of 4188 4612 9.bin.exe reg.exe PID 4612 wrote to memory of 4116 4612 9.bin.exe reg.exe PID 4612 wrote to memory of 3716 4612 9.bin.exe reg.exe PID 4612 wrote to memory of 4132 4612 9.bin.exe reg.exe PID 4612 wrote to memory of 3828 4612 9.bin.exe reg.exe PID 4612 wrote to memory of 4128 4612 9.bin.exe ijsethyt.exe PID 4612 wrote to memory of 2592 4612 9.bin.exe cmd.exe PID 4612 wrote to memory of 2604 4612 9.bin.exe schtasks.exe PID 4128 wrote to memory of 4828 4128 ijsethyt.exe ijsethyt.exe -
Checks SCSI registry key(s) (likely anti-VM) 3 TTPs 18 IoCs
Processes:
9.bin.exeijsethyt.exeijsethyt.exedescription ioc pid process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&135B206D&0&010000 5020 9.bin.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\DeviceDesc 5020 9.bin.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\Service 5020 9.bin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&135B206D&0&000000 5020 9.bin.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\DeviceDesc 5020 9.bin.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\Service 5020 9.bin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&135B206D&0&010000 4292 ijsethyt.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\DeviceDesc 4292 ijsethyt.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\Service 4292 ijsethyt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&135B206D&0&000000 4292 ijsethyt.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\DeviceDesc 4292 ijsethyt.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\Service 4292 ijsethyt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&135B206D&0&010000 4828 ijsethyt.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\DeviceDesc 4828 ijsethyt.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\Service 4828 ijsethyt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&135B206D&0&000000 4828 ijsethyt.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\DeviceDesc 4828 ijsethyt.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\Service 4828 ijsethyt.exe -
Executes dropped EXE 4 IoCs
Processes:
ijsethyt.exeijsethyt.exeijsethyt.exeijsethyt.exepid process 452 ijsethyt.exe 4292 ijsethyt.exe 4128 ijsethyt.exe 4828 ijsethyt.exe -
Processes:
reg.exedescription ioc pid process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Onjpsefhpr = "0" 3828 reg.exe -
Checks system information in the registry (likely anti-VM) 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc pid process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer 4108 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName 4108 svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9.bin.exe"C:\Users\Admin\AppData\Local\Temp\9.bin.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4924
-
C:\Users\Admin\AppData\Local\Temp\9.bin.exeC:\Users\Admin\AppData\Local\Temp\9.bin.exe /C1⤵
- Suspicious behavior: EnumeratesProcesses
- Checks SCSI registry key(s) (likely anti-VM)
PID:5020
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:5092
-
C:\Windows\System32\SLUI.exe"C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent1⤵PID:4196
-
C:\Users\Admin\AppData\Roaming\Microsoft\Onjpsefhpr\ijsethyt.exeC:\Users\Admin\AppData\Roaming\Microsoft\Onjpsefhpr\ijsethyt.exe1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:452
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn tctcvismel /tr "\"C:\Users\Admin\AppData\Local\Temp\9.bin.exe\" /I tctcvismel" /SC ONCE /Z /ST 11:29 /ET 11:411⤵PID:2108
-
C:\Users\Admin\AppData\Roaming\Microsoft\Onjpsefhpr\ijsethyt.exeC:\Users\Admin\AppData\Roaming\Microsoft\Onjpsefhpr\ijsethyt.exe /C1⤵
- Suspicious behavior: EnumeratesProcesses
- Checks SCSI registry key(s) (likely anti-VM)
- Executes dropped EXE
PID:4292
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Qakbot persistence
- Adds Run entry to start application
- Suspicious behavior: EnumeratesProcesses
PID:4360
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Drops file in system dir
PID:3080
-
C:\Users\Admin\AppData\Local\Temp\9.bin.exeC:\Users\Admin\AppData\Local\Temp\9.bin.exe /I tctcvismel1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4612
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV1⤵PID:4580
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"1⤵
- Windows security modification
PID:4644
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"1⤵
- Windows security modification
PID:4348
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"1⤵PID:4320
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"1⤵PID:4276
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"1⤵
- Windows security modification
PID:4188
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"1⤵
- Windows security modification
PID:4116
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"1⤵
- Windows security modification
PID:3716
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"1⤵
- Windows security modification
PID:4132
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Onjpsefhpr" /d "0"1⤵
- Windows security bypass
PID:3828
-
C:\Users\Admin\AppData\Roaming\Microsoft\Onjpsefhpr\ijsethyt.exeC:\Users\Admin\AppData\Roaming\Microsoft\Onjpsefhpr\ijsethyt.exe1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:4128
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\9.bin.exe"1⤵PID:2592
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /DELETE /F /TN tctcvismel1⤵
- Uses Task Scheduler COM API
PID:2604
-
C:\Windows\system32\PING.EXEping.exe -n 6 127.0.0.11⤵
- Runs ping.exe
PID:4836
-
C:\Users\Admin\AppData\Roaming\Microsoft\Onjpsefhpr\ijsethyt.exeC:\Users\Admin\AppData\Roaming\Microsoft\Onjpsefhpr\ijsethyt.exe /C1⤵
- Suspicious behavior: EnumeratesProcesses
- Checks SCSI registry key(s) (likely anti-VM)
- Executes dropped EXE
PID:4828
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DoSvc1⤵
- Checks system information in the registry (likely anti-VM)
PID:4108
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s wscsvc1⤵
- Windows security modification
PID:1804
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup1⤵PID:520
Network
MITRE ATT&CK Enterprise v15
MITRE ATT&CK Additional techniques
- T1089
- T1060