Analysis
-
max time kernel
138s -
max time network
143s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
15-05-2021 07:33
Static task
static1
Behavioral task
behavioral1
Sample
03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe
Resource
win7v20210410
General
-
Target
03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe
-
Size
306KB
-
MD5
f1380563caff56b0847c81bbbbdd37f5
-
SHA1
9d167fef0749448a3e121bc0bf6304904c5b63f0
-
SHA256
03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683
-
SHA512
2a1de292465385756bca95aa01fb033df6c36f0394a5059a40e16c94672dd907f9c1b0e92678c1b9805c40a71ca1f2ed848d6f6b044d0574a72f83890b798cdf
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 4 IoCs
Processes:
03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe:*:enabled:@shell32.dll,-1" 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe -
Executes dropped EXE 2 IoCs
Processes:
03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683Srv.exeDesktopLayer.exepid process 3744 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683Srv.exe 2660 DesktopLayer.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683Srv.exe upx C:\Users\Admin\AppData\Local\Temp\03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683Srv.exe upx C:\Program Files (x86)\Microsoft\DesktopLayer.exe upx C:\Program Files (x86)\Microsoft\DesktopLayer.exe upx behavioral2/memory/3744-124-0x0000000000400000-0x000000000042E000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
Processes:
03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683Srv.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\px15D0.tmp 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683Srv.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683Srv.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683Srv.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30886301" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "327905538" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30886301" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F65E5793-B590-11EB-A11C-465F29FC5D21} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "327873546" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3410534591" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30886301" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "327856953" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz! iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3404440931" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3404440931" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exeDesktopLayer.exepid process 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 2660 DesktopLayer.exe 2660 DesktopLayer.exe 2660 DesktopLayer.exe 2660 DesktopLayer.exe 2660 DesktopLayer.exe 2660 DesktopLayer.exe 2660 DesktopLayer.exe 2660 DesktopLayer.exe -
Suspicious behavior: MapViewOfSection 62 IoCs
Processes:
03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exepid process 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exedescription pid process Token: SeDebugPrivilege 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 188 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 188 iexplore.exe 188 iexplore.exe 2224 IEXPLORE.EXE 2224 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683Srv.exedescription pid process target process PID 3196 wrote to memory of 3744 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683Srv.exe PID 3196 wrote to memory of 3744 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683Srv.exe PID 3196 wrote to memory of 3744 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683Srv.exe PID 3744 wrote to memory of 2660 3744 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683Srv.exe DesktopLayer.exe PID 3744 wrote to memory of 2660 3744 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683Srv.exe DesktopLayer.exe PID 3744 wrote to memory of 2660 3744 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683Srv.exe DesktopLayer.exe PID 3196 wrote to memory of 572 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe winlogon.exe PID 3196 wrote to memory of 572 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe winlogon.exe PID 3196 wrote to memory of 572 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe winlogon.exe PID 3196 wrote to memory of 572 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe winlogon.exe PID 3196 wrote to memory of 572 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe winlogon.exe PID 3196 wrote to memory of 572 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe winlogon.exe PID 3196 wrote to memory of 632 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe lsass.exe PID 3196 wrote to memory of 632 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe lsass.exe PID 3196 wrote to memory of 632 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe lsass.exe PID 3196 wrote to memory of 632 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe lsass.exe PID 3196 wrote to memory of 632 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe lsass.exe PID 3196 wrote to memory of 632 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe lsass.exe PID 3196 wrote to memory of 716 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe svchost.exe PID 3196 wrote to memory of 716 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe svchost.exe PID 3196 wrote to memory of 716 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe svchost.exe PID 3196 wrote to memory of 716 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe svchost.exe PID 3196 wrote to memory of 716 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe svchost.exe PID 3196 wrote to memory of 716 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe svchost.exe PID 3196 wrote to memory of 732 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe fontdrvhost.exe PID 3196 wrote to memory of 732 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe fontdrvhost.exe PID 3196 wrote to memory of 732 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe fontdrvhost.exe PID 3196 wrote to memory of 732 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe fontdrvhost.exe PID 3196 wrote to memory of 732 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe fontdrvhost.exe PID 3196 wrote to memory of 732 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe fontdrvhost.exe PID 3196 wrote to memory of 736 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe fontdrvhost.exe PID 3196 wrote to memory of 736 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe fontdrvhost.exe PID 3196 wrote to memory of 736 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe fontdrvhost.exe PID 3196 wrote to memory of 736 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe fontdrvhost.exe PID 3196 wrote to memory of 736 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe fontdrvhost.exe PID 3196 wrote to memory of 736 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe fontdrvhost.exe PID 3196 wrote to memory of 796 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe svchost.exe PID 3196 wrote to memory of 796 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe svchost.exe PID 3196 wrote to memory of 796 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe svchost.exe PID 3196 wrote to memory of 796 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe svchost.exe PID 3196 wrote to memory of 796 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe svchost.exe PID 3196 wrote to memory of 796 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe svchost.exe PID 3196 wrote to memory of 856 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe svchost.exe PID 3196 wrote to memory of 856 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe svchost.exe PID 3196 wrote to memory of 856 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe svchost.exe PID 3196 wrote to memory of 856 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe svchost.exe PID 3196 wrote to memory of 856 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe svchost.exe PID 3196 wrote to memory of 856 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe svchost.exe PID 3196 wrote to memory of 896 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe svchost.exe PID 3196 wrote to memory of 896 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe svchost.exe PID 3196 wrote to memory of 896 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe svchost.exe PID 3196 wrote to memory of 896 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe svchost.exe PID 3196 wrote to memory of 896 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe svchost.exe PID 3196 wrote to memory of 896 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe svchost.exe PID 3196 wrote to memory of 980 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe dwm.exe PID 3196 wrote to memory of 980 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe dwm.exe PID 3196 wrote to memory of 980 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe dwm.exe PID 3196 wrote to memory of 980 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe dwm.exe PID 3196 wrote to memory of 980 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe dwm.exe PID 3196 wrote to memory of 980 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe dwm.exe PID 3196 wrote to memory of 1000 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe svchost.exe PID 3196 wrote to memory of 1000 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe svchost.exe PID 3196 wrote to memory of 1000 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe svchost.exe PID 3196 wrote to memory of 1000 3196 03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe svchost.exe
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservice -s netprofm1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k appmodel -s StateRepository1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3901⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵
-
c:\windows\system32\sihost.exesihost.exe1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k networkservice -s CryptSvc1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe"C:\Users\Admin\AppData\Local\Temp\03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683.exe"2⤵
- Modifies firewall policy service
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683Srv.exeC:\Users\Admin\AppData\Local\Temp\03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683Srv.exe3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:188 CREDAT:82945 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R2⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservice -s CDPSvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks1⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k networkservice -s Dnscache1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k networkservice -s NlaSvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservice -s FontCache1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservice -s EventSystem1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservice -s nsi1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s LSM1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k rpcss1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch1⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding2⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}2⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay1⤵
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeMD5
e7efb2a2b36ab241b6c9b770abf95000
SHA1d4c253cbf80dc65a04747aea4afc91de6a4a4c5d
SHA2564c7bf8d4e1ad5bd27b4b990791d4968be2a1d9cbb092c1af2e19a42c1b93e4c8
SHA512958e64677c0acc6b2c0ef8e5ff5c39ea12986b8d5d0820710572af7669fdb6fe740e3ee609c1d9dfcdbfaee6a6f8fdeda25f64f7ad4d335627a024d6a1b4fcf3
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeMD5
e7efb2a2b36ab241b6c9b770abf95000
SHA1d4c253cbf80dc65a04747aea4afc91de6a4a4c5d
SHA2564c7bf8d4e1ad5bd27b4b990791d4968be2a1d9cbb092c1af2e19a42c1b93e4c8
SHA512958e64677c0acc6b2c0ef8e5ff5c39ea12986b8d5d0820710572af7669fdb6fe740e3ee609c1d9dfcdbfaee6a6f8fdeda25f64f7ad4d335627a024d6a1b4fcf3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776MD5
a0a5a4d72ad62fd610b043c84033deaf
SHA1aa5c3deaba3b479e004880b369f63f2b59b23b9a
SHA25635d20d28885d84fef2a2e06125bf9626fbab13b99d1238a435a444a8db1cb9c6
SHA51220dd0d4276e854bca2767bd4cf7f04068a23742ff33926a7ba5296d2b0a453d456f37662e443c4df2fc3027bbead658a8ca6f8be40a61c82e3d6085cf85b9243
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776MD5
5934fd131a319dc33730cd20bd45103f
SHA18c582a3b2f710eda7a7c1e35413bd1d76677740c
SHA256e799fab0545f95c599e19ea65ac15a47e3867b12a32261346420310e986842ac
SHA512def006169c5a406d918c408c607b67fb13b64c17356e6c7e4d51e8f7926f3c5dc398bb3d7809b53daba34f56914ae21d191cd45677c0086e2557051fc8742efb
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\K55PUGGH.cookieMD5
711bf622a3e287f60555d5e0a8543b37
SHA1dd71770dd5a68442d9dd9c1c770a96160c7f968b
SHA2563f5fb7d655e7b42338adf3fbcf682500cdc0810ef43df6a95b3fc6fd6e7a4fe5
SHA51291e6e35c5d27b5a988dd5782b9cbcae21771ebae9ea0b74fe3aa319b520188eb660692994e7c9e18586deb7b537a1f9e81948b50279e14597525e696a08017c5
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\VXYSPXE3.cookieMD5
ce94fe559dafb8008034dd1705c28446
SHA1eea9f51c12a75061331a398c2a715205aee2707e
SHA256f3df62d425a9840ad9caa4bacedd6ea8612bbc374d82376a94a54570fd4c0154
SHA5126fd5d59dcd14f8d16618cc359072a2078c45c582b4553aaf7205cbd7cdccfbc34744046e02805e8e73e34e079b2fbee63a4527dcb8a3bebf4ca1ae4cafff48c4
-
C:\Users\Admin\AppData\Local\Temp\03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683Srv.exeMD5
e7efb2a2b36ab241b6c9b770abf95000
SHA1d4c253cbf80dc65a04747aea4afc91de6a4a4c5d
SHA2564c7bf8d4e1ad5bd27b4b990791d4968be2a1d9cbb092c1af2e19a42c1b93e4c8
SHA512958e64677c0acc6b2c0ef8e5ff5c39ea12986b8d5d0820710572af7669fdb6fe740e3ee609c1d9dfcdbfaee6a6f8fdeda25f64f7ad4d335627a024d6a1b4fcf3
-
C:\Users\Admin\AppData\Local\Temp\03972841581917922e355d754ac6fcd5ef8ff10656bf9f030d8f11686c3ad683Srv.exeMD5
e7efb2a2b36ab241b6c9b770abf95000
SHA1d4c253cbf80dc65a04747aea4afc91de6a4a4c5d
SHA2564c7bf8d4e1ad5bd27b4b990791d4968be2a1d9cbb092c1af2e19a42c1b93e4c8
SHA512958e64677c0acc6b2c0ef8e5ff5c39ea12986b8d5d0820710572af7669fdb6fe740e3ee609c1d9dfcdbfaee6a6f8fdeda25f64f7ad4d335627a024d6a1b4fcf3
-
memory/188-122-0x00007FF9EBA70000-0x00007FF9EBADB000-memory.dmpFilesize
428KB
-
memory/188-121-0x0000000000000000-mapping.dmp
-
memory/2224-127-0x0000000000000000-mapping.dmp
-
memory/2660-120-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/2660-117-0x0000000000000000-mapping.dmp
-
memory/3196-128-0x0000000000500000-0x0000000000501000-memory.dmpFilesize
4KB
-
memory/3744-123-0x00000000001E0000-0x00000000001EF000-memory.dmpFilesize
60KB
-
memory/3744-124-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3744-114-0x0000000000000000-mapping.dmp