42506f9e15ffdab6fce67556b602075ff779e2e84c6a40058a3941f0f71071b2

Analysis

max time kernel
144s
max time network
149s
platform
windows10_x64
resource
win10-en
submitted
19/09/2021, 06:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d5d4f07e59ffad621f322b68c12e411e.exe
Size 2.7MB
Sample210919-hr3l6aechq
SHA256 42506f9e15ffdab6fce67556b602075ff779e2e84c6a40058a3941f0f71071b2
MD5 d5d4f07e59ffad621f322b68c12e411e
SHA1 c29e234e8ecf6eeaa4b6f6fead0f69d14865805a
SHA512 b8faf0ae840a3096ecfe62284c5a6a81ea17c1fa7ab62bdd7281afd15154b62ee35f1ecf4401d8c89ebc5128cba10536b6043e7094633f5b4d9303136591cd1e
MD5 SHA1 SHA512

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 11 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\SecureAssessmentHandlers\\dwm.exe\", \"C:\\Windows\\System32\\ndproxystub\\dllhost.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\d5d4f07e59ffad621f322b68c12e411e\\DriverMaster.exe\", \"C:\\Windows\\System32\\mfc140kor\\winlogon.exe\", \"C:\\Windows\\WMSysPr9\\explorer.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\sihost.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\SecureAssessmentHandlers\\dwm.exe\", \"C:\\Windows\\System32\\ndproxystub\\dllhost.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\d5d4f07e59ffad621f322b68c12e411e\\DriverMaster.exe\", \"C:\\Windows\\System32\\mfc140kor\\winlogon.exe\", \"C:\\Windows\\WMSysPr9\\explorer.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\sihost.exe\", \"C:\\Windows\\System32\\wbem\\WPDShServiceObj\\WmiPrvSE.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\SecureAssessmentHandlers\\dwm.exe\", \"C:\\Windows\\System32\\ndproxystub\\dllhost.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\d5d4f07e59ffad621f322b68c12e411e\\DriverMaster.exe\", \"C:\\Windows\\System32\\mfc140kor\\winlogon.exe\", \"C:\\Windows\\WMSysPr9\\explorer.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\sihost.exe\", \"C:\\Windows\\System32\\wbem\\WPDShServiceObj\\WmiPrvSE.exe\", \"C:\\Windows\\System32\\Chakrathunk\\RuntimeBroker.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\SecureAssessmentHandlers\\dwm.exe\", \"C:\\Windows\\System32\\ndproxystub\\dllhost.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\d5d4f07e59ffad621f322b68c12e411e\\DriverMaster.exe\", \"C:\\Windows\\System32\\mfc140kor\\winlogon.exe\", \"C:\\Windows\\WMSysPr9\\explorer.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\sihost.exe\", \"C:\\Windows\\System32\\wbem\\WPDShServiceObj\\WmiPrvSE.exe\", \"C:\\Windows\\System32\\Chakrathunk\\RuntimeBroker.exe\", \"C:\\Windows\\System32\\d2d1\\spoolsv.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\SecureAssessmentHandlers\\dwm.exe\", \"C:\\Windows\\System32\\ndproxystub\\dllhost.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\SecureAssessmentHandlers\\dwm.exe\", \"C:\\Windows\\System32\\ndproxystub\\dllhost.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\d5d4f07e59ffad621f322b68c12e411e\\DriverMaster.exe\", \"C:\\Windows\\System32\\mfc140kor\\winlogon.exe\", \"C:\\Windows\\WMSysPr9\\explorer.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\SecureAssessmentHandlers\\dwm.exe\", \"C:\\Windows\\System32\\ndproxystub\\dllhost.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\d5d4f07e59ffad621f322b68c12e411e\\DriverMaster.exe\", \"C:\\Windows\\System32\\mfc140kor\\winlogon.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\SecureAssessmentHandlers\\dwm.exe\", \"C:\\Windows\\System32\\ndproxystub\\dllhost.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\d5d4f07e59ffad621f322b68c12e411e\\DriverMaster.exe\", \"C:\\Windows\\System32\\mfc140kor\\winlogon.exe\", \"C:\\Windows\\WMSysPr9\\explorer.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\sihost.exe\", \"C:\\Windows\\System32\\wbem\\WPDShServiceObj\\WmiPrvSE.exe\", \"C:\\Windows\\System32\\Chakrathunk\\RuntimeBroker.exe\", \"C:\\Windows\\System32\\d2d1\\spoolsv.exe\", \"C:\\Windows\\System32\\winload\\RuntimeBroker.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\SecureAssessmentHandlers\\dwm.exe\", \"C:\\Windows\\System32\\ndproxystub\\dllhost.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\d5d4f07e59ffad621f322b68c12e411e\\DriverMaster.exe\", \"C:\\Windows\\System32\\mfc140kor\\winlogon.exe\", \"C:\\Windows\\WMSysPr9\\explorer.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\sihost.exe\", \"C:\\Windows\\System32\\wbem\\WPDShServiceObj\\WmiPrvSE.exe\", \"C:\\Windows\\System32\\Chakrathunk\\RuntimeBroker.exe\", \"C:\\Windows\\System32\\d2d1\\spoolsv.exe\", \"C:\\Windows\\System32\\winload\\RuntimeBroker.exe\", \"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0\\OfficeClickToRun.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\SecureAssessmentHandlers\\dwm.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\SecureAssessmentHandlers\\dwm.exe\", \"C:\\Windows\\System32\\ndproxystub\\dllhost.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\d5d4f07e59ffad621f322b68c12e411e\\DriverMaster.exe\""	DriverRealtekHDmaster.exe

Process spawned unexpected child process 11 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4048	3408	schtasks.exe	23
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3856	3408	schtasks.exe	23
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4028	3408	schtasks.exe	23
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4000	3408	schtasks.exe	23
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3888	3408	schtasks.exe	23
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3996	3408	schtasks.exe	23
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3904	3408	schtasks.exe	23
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1604	3408	schtasks.exe	23
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3944	3408	schtasks.exe	23
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3904	3408	schtasks.exe	23
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3852	3408	schtasks.exe	23

Executes dropped EXE 6 IoCs

pid	Process
3132	DriverRealtekHDmaster.exe
2656	DriverMaster.exe
3988	DriverRealtekHDmaster.exe
3944	spoolsv.exe
3856	EngineDriverMaster.exe
3128	sihost32.exe

Adds Run key to start application 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\System32\\mfc140kor\\winlogon.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\WMSysPr9\\explorer.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\sihost.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Windows\\System32\\wbem\\WPDShServiceObj\\WmiPrvSE.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\Chakrathunk\\RuntimeBroker.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\System32\\d2d1\\spoolsv.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\winload\\RuntimeBroker.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\System32\\SecureAssessmentHandlers\\dwm.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DriverMaster = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\d5d4f07e59ffad621f322b68c12e411e\\DriverMaster.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\System32\\d2d1\\spoolsv.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0\\OfficeClickToRun.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\ndproxystub\\dllhost.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\System32\\mfc140kor\\winlogon.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\sihost.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\Chakrathunk\\RuntimeBroker.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\DriverMaster = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\d5d4f07e59ffad621f322b68c12e411e\\DriverMaster.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\ndproxystub\\dllhost.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\WMSysPr9\\explorer.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Windows\\System32\\wbem\\WPDShServiceObj\\WmiPrvSE.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\winload\\RuntimeBroker.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0\\OfficeClickToRun.exe\""	DriverRealtekHDmaster.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\System32\\SecureAssessmentHandlers\\dwm.exe\""	DriverRealtekHDmaster.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

Drops file in System32 directory 15 IoCs

description	ioc	Process
File created	C:\Windows\System32\ndproxystub\dllhost.exe	DriverRealtekHDmaster.exe
File created	C:\Windows\System32\winload\9e8d7a4ca61bd92aff00cc37a7a4d62a2cac998d	DriverRealtekHDmaster.exe
File created	C:\Windows\System32\SecureAssessmentHandlers\6cb0b6c459d5d3455a3da700e713f2e2529862ff	DriverRealtekHDmaster.exe
File created	C:\Windows\System32\Chakrathunk\RuntimeBroker.exe	DriverRealtekHDmaster.exe
File created	C:\Windows\System32\SecureAssessmentHandlers\dwm.exe	DriverRealtekHDmaster.exe
File opened for modification	C:\Windows\System32\SecureAssessmentHandlers\dwm.exe	DriverRealtekHDmaster.exe
File created	C:\Windows\System32\d2d1\f3b6ecef712a24f33798f5d2fb3790c3d9b894c4	DriverRealtekHDmaster.exe
File created	C:\Windows\System32\mfc140kor\winlogon.exe	DriverRealtekHDmaster.exe
File created	C:\Windows\System32\wbem\WPDShServiceObj\WmiPrvSE.exe	DriverRealtekHDmaster.exe
File created	C:\Windows\System32\wbem\WPDShServiceObj\24dbde2999530ef5fd907494bc374d663924116c	DriverRealtekHDmaster.exe
File created	C:\Windows\System32\Chakrathunk\9e8d7a4ca61bd92aff00cc37a7a4d62a2cac998d	DriverRealtekHDmaster.exe
File created	C:\Windows\System32\d2d1\spoolsv.exe	DriverRealtekHDmaster.exe
File created	C:\Windows\System32\winload\RuntimeBroker.exe	DriverRealtekHDmaster.exe
File created	C:\Windows\System32\ndproxystub\5940a34987c99120d96dace90a3f93f329dcad63	DriverRealtekHDmaster.exe
File created	C:\Windows\System32\mfc140kor\cc11b995f2a76da408ea6a601e682e64743153ad	DriverRealtekHDmaster.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0\OfficeClickToRun.exe	DriverRealtekHDmaster.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0\e6c9b481da804f07baff8eff543b0a1441069b5d	DriverRealtekHDmaster.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\sihost.exe	DriverRealtekHDmaster.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\66fc9ff0ee96c2b21f0cfded48750ae9e3032bf3	DriverRealtekHDmaster.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WMSysPr9\explorer.exe	DriverRealtekHDmaster.exe
File created	C:\Windows\WMSysPr9\7a0fd90576e08807bde2cc57bcf9854bbce05fe3	DriverRealtekHDmaster.exe
File created	C:\Windows\WMSysPr9\explorer.exe	DriverRealtekHDmaster.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 13 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3888	schtasks.exe
1604	schtasks.exe
3904	schtasks.exe
4048	schtasks.exe
4028	schtasks.exe
3996	schtasks.exe
3904	schtasks.exe
2632	schtasks.exe
3944	schtasks.exe
3852	schtasks.exe
528	schtasks.exe
3856	schtasks.exe
4000	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3132	DriverRealtekHDmaster.exe
3132	DriverRealtekHDmaster.exe
3132	DriverRealtekHDmaster.exe
3132	DriverRealtekHDmaster.exe
3132	DriverRealtekHDmaster.exe
3988	DriverRealtekHDmaster.exe
2656	DriverMaster.exe
3988	DriverRealtekHDmaster.exe
3988	DriverRealtekHDmaster.exe
3944	spoolsv.exe
3944	spoolsv.exe
3856	EngineDriverMaster.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	3132	DriverRealtekHDmaster.exe
Token: 33	3132	DriverRealtekHDmaster.exe
Token: SeIncBasePriorityPrivilege	3132	DriverRealtekHDmaster.exe
Token: SeDebugPrivilege	3988	DriverRealtekHDmaster.exe
Token: 33	3988	DriverRealtekHDmaster.exe
Token: SeIncBasePriorityPrivilege	3988	DriverRealtekHDmaster.exe
Token: SeDebugPrivilege	2656	DriverMaster.exe
Token: SeDebugPrivilege	3944	spoolsv.exe
Token: 33	3944	spoolsv.exe
Token: SeIncBasePriorityPrivilege	3944	spoolsv.exe
Token: SeDebugPrivilege	3856	EngineDriverMaster.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 3888	3940	d5d4f07e59ffad621f322b68c12e411e.exe	69
PID 3940 wrote to memory of 3888	3940	d5d4f07e59ffad621f322b68c12e411e.exe	69
PID 3940 wrote to memory of 3888	3940	d5d4f07e59ffad621f322b68c12e411e.exe	69
PID 3940 wrote to memory of 3988	3940	d5d4f07e59ffad621f322b68c12e411e.exe	71
PID 3940 wrote to memory of 3988	3940	d5d4f07e59ffad621f322b68c12e411e.exe	71
PID 3940 wrote to memory of 3988	3940	d5d4f07e59ffad621f322b68c12e411e.exe	71
PID 3888 wrote to memory of 3132	3888	cmd.exe	72
PID 3888 wrote to memory of 3132	3888	cmd.exe	72
PID 3988 wrote to memory of 2656	3988	cmd.exe	74
PID 3988 wrote to memory of 2656	3988	cmd.exe	74
PID 3132 wrote to memory of 3988	3132	DriverRealtekHDmaster.exe	79
PID 3132 wrote to memory of 3988	3132	DriverRealtekHDmaster.exe	79
PID 2656 wrote to memory of 2612	2656	DriverMaster.exe	82
PID 2656 wrote to memory of 2612	2656	DriverMaster.exe	82
PID 2612 wrote to memory of 2632	2612	cmd.exe	86
PID 2612 wrote to memory of 2632	2612	cmd.exe	86
PID 3988 wrote to memory of 3944	3988	DriverRealtekHDmaster.exe	90
PID 3988 wrote to memory of 3944	3988	DriverRealtekHDmaster.exe	90
PID 2656 wrote to memory of 3856	2656	DriverMaster.exe	91
PID 2656 wrote to memory of 3856	2656	DriverMaster.exe	91
PID 3856 wrote to memory of 2532	3856	EngineDriverMaster.exe	92
PID 3856 wrote to memory of 2532	3856	EngineDriverMaster.exe	92
PID 3856 wrote to memory of 3128	3856	EngineDriverMaster.exe	94
PID 3856 wrote to memory of 3128	3856	EngineDriverMaster.exe	94
PID 2532 wrote to memory of 528	2532	cmd.exe	95
PID 2532 wrote to memory of 528	2532	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\d5d4f07e59ffad621f322b68c12e411e.exe
"C:\Users\Admin\AppData\Local\Temp\d5d4f07e59ffad621f322b68c12e411e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Windows\SysWOW64\cmd.exe
  cmd /c start C:\Users\Admin\AppData\Roaming\DriverRealtekHDmaster.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3888
- - C:\Users\Admin\AppData\Roaming\DriverRealtekHDmaster.exe
    C:\Users\Admin\AppData\Roaming\DriverRealtekHDmaster.exe
    3⤵
    - Modifies WinLogon for persistence
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3132
  - - C:\Users\Admin\AppData\Roaming\DriverRealtekHDmaster.exe
      "C:\Users\Admin\AppData\Roaming\DriverRealtekHDmaster.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3988
    - - C:\Windows\System32\d2d1\spoolsv.exe
        
        "C:\Windows\System32\d2d1\spoolsv.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3944
- C:\Windows\SysWOW64\cmd.exe
  cmd /c start C:\Users\Admin\AppData\Local\Temp\DriverMaster.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3988
- - C:\Users\Admin\AppData\Local\Temp\DriverMaster.exe
    C:\Users\Admin\AppData\Local\Temp\DriverMaster.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2656
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "EngineDriverMaster" /tr '"C:\Users\Admin\AppData\Local\Temp\EngineDriverMaster.exe"' & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2612
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "EngineDriverMaster" /tr '"C:\Users\Admin\AppData\Local\Temp\EngineDriverMaster.exe"'
        5⤵
        Creates scheduled task(s)
        
        PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\EngineDriverMaster.exe
      "C:\Users\Admin\AppData\Local\Temp\EngineDriverMaster.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3856
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "EngineDriverMaster" /tr '"C:\Users\Admin\AppData\Local\Temp\EngineDriverMaster.exe"' & exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2532
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "EngineDriverMaster" /tr '"C:\Users\Admin\AppData\Local\Temp\EngineDriverMaster.exe"'
        6⤵
        Creates scheduled task(s)
        
        PID:528
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe"
        5⤵
        Executes dropped EXE
        
        PID:3128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\System32\SecureAssessmentHandlers\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\ndproxystub\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DriverMaster" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\d5d4f07e59ffad621f322b68c12e411e\DriverMaster.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\mfc140kor\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\WMSysPr9\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\System32\wbem\WPDShServiceObj\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\Chakrathunk\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\System32\d2d1\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\winload\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3852

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Winlogon Helper DLL

T1004

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2656-135-0x000000001D030000-0x000000001D217000-memory.dmp

Download

memory/2656-136-0x0000000001780000-0x0000000001781000-memory.dmp

Download

memory/2656-127-0x000000001CE40000-0x000000001D029000-memory.dmp

Download

memory/2656-139-0x0000000001D80000-0x0000000001D82000-memory.dmp

Download

memory/2656-125-0x0000000000D50000-0x0000000000D51000-memory.dmp

Download

memory/3128-166-0x00000000001C0000-0x00000000001C1000-memory.dmp

Download

memory/3128-170-0x0000000002B30000-0x0000000002B32000-memory.dmp

Download

memory/3132-128-0x000000001BB20000-0x000000001BB22000-memory.dmp

Download

memory/3132-120-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

Download

memory/3856-169-0x0000000003230000-0x0000000003232000-memory.dmp

Download

memory/3944-156-0x000000001BAA2000-0x000000001BAA4000-memory.dmp

Download

memory/3944-145-0x000000001BAA0000-0x000000001BAA2000-memory.dmp

Download

memory/3944-157-0x000000001BAA4000-0x000000001BAA5000-memory.dmp

Download

memory/3944-147-0x0000000001430000-0x0000000001437000-memory.dmp

Download

memory/3944-158-0x000000001BAA5000-0x000000001BAA7000-memory.dmp

Download

memory/3944-146-0x0000000001140000-0x0000000001146000-memory.dmp

Download

memory/3944-150-0x00000000014C0000-0x00000000014C2000-memory.dmp

Download

memory/3944-149-0x0000000001470000-0x0000000001472000-memory.dmp

Download

memory/3944-148-0x0000000001440000-0x0000000001446000-memory.dmp

Download

memory/3988-134-0x000000001BC00000-0x000000001BC02000-memory.dmp

Download