0b5a4d65bd3424391e5f9bc5b6247635b8097005edb07f35eee3aef1d73e1b64

Analysis

max time kernel
135s
max time network
154s
platform
windows10_x64
resource
win10-en-20210920
submitted
10/10/2021, 14:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ea800644b9dfd027807447fdd98241aa.exe
Size 258KB
Sample211010-rbjnsafhgl
SHA256 0b5a4d65bd3424391e5f9bc5b6247635b8097005edb07f35eee3aef1d73e1b64
MD5 ea800644b9dfd027807447fdd98241aa
SHA1 f58691787bff0e729a63f001a378bed12fd0a899
SHA512 1172ffa9ba8f773b3dbc9b526e80b525680d3a1477b9508c01a57546918f4aff1aeb856aad8af59b078b672b6dd5b590165137a573041f4895c6b89cae006ee2
MD5 SHA1 SHA512

Score

10^/10

evasion persistence spyware stealer trojan

Malware Config

Signatures

Process spawned unexpected child process 7 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1476	2504	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1292	2504	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1636	2504	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3960	2504	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1512	2504	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2252	2504	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3232	2504	schtasks.exe	80

Turns off Windows Defender SpyNet reporting 2 TTPs
evasion

Disabling Security Tools
T1089

Modify Registry
T1112
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Nirsoft 6 IoCs

resource	yara_rule
behavioral2/files/0x000500000001abc0-122.dat	Nirsoft
behavioral2/files/0x000500000001abc0-123.dat	Nirsoft
behavioral2/files/0x000500000001abc0-125.dat	Nirsoft
behavioral2/files/0x000400000001ac04-399.dat	Nirsoft
behavioral2/files/0x000400000001ac04-400.dat	Nirsoft
behavioral2/files/0x000400000001ac04-402.dat	Nirsoft

Executes dropped EXE 6 IoCs

pid	Process
2416	AdvancedRun.exe
640	AdvancedRun.exe
2380	audiodg.exe
2944	AdvancedRun.exe
616	AdvancedRun.exe
1008	audiodg.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 11 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	ea800644b9dfd027807447fdd98241aa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	ea800644b9dfd027807447fdd98241aa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\dpmodemx\audiodg.exe = "0"	audiodg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	ea800644b9dfd027807447fdd98241aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	ea800644b9dfd027807447fdd98241aa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\ea800644b9dfd027807447fdd98241aa.exe = "0"	ea800644b9dfd027807447fdd98241aa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	ea800644b9dfd027807447fdd98241aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection	ea800644b9dfd027807447fdd98241aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet	ea800644b9dfd027807447fdd98241aa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0"	ea800644b9dfd027807447fdd98241aa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0"	ea800644b9dfd027807447fdd98241aa.exe

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ea800644b9dfd027807447fdd98241aa = "\"C:\\PerfLogs\\ea800644b9dfd027807447fdd98241aa.exe\""	ea800644b9dfd027807447fdd98241aa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Windows\\System32\\dpmodemx\\audiodg.exe\""	ea800644b9dfd027807447fdd98241aa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\SensorsApi\\dllhost.exe\""	ea800644b9dfd027807447fdd98241aa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Windows\\System32\\KBDTT102\\taskhostw.exe\""	ea800644b9dfd027807447fdd98241aa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Windows\\System32\\odbcjt32\\taskhostw.exe\""	ea800644b9dfd027807447fdd98241aa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Windows\\System32\\imaadp32\\sihost.exe\""	ea800644b9dfd027807447fdd98241aa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\System32\\KBDFR\\fontdrvhost.exe\""	ea800644b9dfd027807447fdd98241aa.exe

Drops file in System32 directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\odbcjt32\taskhostw.exe	ea800644b9dfd027807447fdd98241aa.exe
File created	C:\Windows\SysWOW64\odbcjt32\ea9f0e6c9e2dcd4dfacdaf29ba21541fb815a988	ea800644b9dfd027807447fdd98241aa.exe
File created	C:\Windows\SysWOW64\dpmodemx\audiodg.exe	ea800644b9dfd027807447fdd98241aa.exe
File created	C:\Windows\SysWOW64\SensorsApi\dllhost.exe	ea800644b9dfd027807447fdd98241aa.exe
File created	C:\Windows\SysWOW64\imaadp32\66fc9ff0ee96c2b21f0cfded48750ae9e3032bf3	ea800644b9dfd027807447fdd98241aa.exe
File created	C:\Windows\SysWOW64\KBDFR\fontdrvhost.exe	ea800644b9dfd027807447fdd98241aa.exe
File created	C:\Windows\SysWOW64\KBDFR\5b884080fd4f94e2695da25c503f9e33b9605b83	ea800644b9dfd027807447fdd98241aa.exe
File created	C:\Windows\SysWOW64\dpmodemx\42af1c969fbb7b2ae36b0e06bea61fc9a154b4af	ea800644b9dfd027807447fdd98241aa.exe
File created	C:\Windows\SysWOW64\KBDTT102\taskhostw.exe	ea800644b9dfd027807447fdd98241aa.exe
File opened for modification	C:\Windows\SysWOW64\KBDTT102\taskhostw.exe	ea800644b9dfd027807447fdd98241aa.exe
File created	C:\Windows\SysWOW64\KBDTT102\ea9f0e6c9e2dcd4dfacdaf29ba21541fb815a988	ea800644b9dfd027807447fdd98241aa.exe
File created	C:\Windows\SysWOW64\imaadp32\sihost.exe	ea800644b9dfd027807447fdd98241aa.exe
File created	C:\Windows\SysWOW64\SensorsApi\5940a34987c99120d96dace90a3f93f329dcad63	ea800644b9dfd027807447fdd98241aa.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 31 IoCs

pid	Process
1812	ea800644b9dfd027807447fdd98241aa.exe
1812	ea800644b9dfd027807447fdd98241aa.exe
1812	ea800644b9dfd027807447fdd98241aa.exe
1812	ea800644b9dfd027807447fdd98241aa.exe
1812	ea800644b9dfd027807447fdd98241aa.exe
1812	ea800644b9dfd027807447fdd98241aa.exe
1812	ea800644b9dfd027807447fdd98241aa.exe
1812	ea800644b9dfd027807447fdd98241aa.exe
1812	ea800644b9dfd027807447fdd98241aa.exe
1812	ea800644b9dfd027807447fdd98241aa.exe
1812	ea800644b9dfd027807447fdd98241aa.exe
1812	ea800644b9dfd027807447fdd98241aa.exe
1812	ea800644b9dfd027807447fdd98241aa.exe
1812	ea800644b9dfd027807447fdd98241aa.exe
1812	ea800644b9dfd027807447fdd98241aa.exe
1812	ea800644b9dfd027807447fdd98241aa.exe
2380	audiodg.exe
2380	audiodg.exe
2380	audiodg.exe
2380	audiodg.exe
2380	audiodg.exe
2380	audiodg.exe
2380	audiodg.exe
2380	audiodg.exe
2380	audiodg.exe
2380	audiodg.exe
2380	audiodg.exe
2380	audiodg.exe
2380	audiodg.exe
2380	audiodg.exe
2380	audiodg.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1812 set thread context of 3456	1812	ea800644b9dfd027807447fdd98241aa.exe	77
PID 2380 set thread context of 1008	2380	audiodg.exe	98

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe
File created	C:\Windows\SystemResources\Windows.ApplicationModel.LockScreen\SearchUI.exe	ea800644b9dfd027807447fdd98241aa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1572	1812	WerFault.exe	69
2164	2380	WerFault.exe	93

Creates scheduled task(s) 1 TTPs 7 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2252	schtasks.exe
3232	schtasks.exe
1476	schtasks.exe
1292	schtasks.exe
1636	schtasks.exe
3960	schtasks.exe
1512	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\Local Settings	ea800644b9dfd027807447fdd98241aa.exe

Suspicious behavior: EnumeratesProcesses 63 IoCs

pid	Process
2416	AdvancedRun.exe
2416	AdvancedRun.exe
2416	AdvancedRun.exe
2416	AdvancedRun.exe
640	AdvancedRun.exe
640	AdvancedRun.exe
640	AdvancedRun.exe
640	AdvancedRun.exe
1812	ea800644b9dfd027807447fdd98241aa.exe
1812	ea800644b9dfd027807447fdd98241aa.exe
1812	ea800644b9dfd027807447fdd98241aa.exe
1812	ea800644b9dfd027807447fdd98241aa.exe
1812	ea800644b9dfd027807447fdd98241aa.exe
3744	powershell.exe
3744	powershell.exe
1572	WerFault.exe
1572	WerFault.exe
1572	WerFault.exe
1572	WerFault.exe
1572	WerFault.exe
1572	WerFault.exe
1572	WerFault.exe
1572	WerFault.exe
1572	WerFault.exe
1572	WerFault.exe
1572	WerFault.exe
1572	WerFault.exe
1572	WerFault.exe
3456	ea800644b9dfd027807447fdd98241aa.exe
3744	powershell.exe
2944	AdvancedRun.exe
2944	AdvancedRun.exe
2944	AdvancedRun.exe
2944	AdvancedRun.exe
616	AdvancedRun.exe
616	AdvancedRun.exe
616	AdvancedRun.exe
616	AdvancedRun.exe
2380	audiodg.exe
2380	audiodg.exe
2380	audiodg.exe
2164	WerFault.exe
2164	WerFault.exe
2164	WerFault.exe
2164	WerFault.exe
2164	WerFault.exe
2164	WerFault.exe
2164	WerFault.exe
2164	WerFault.exe
2164	WerFault.exe
2164	WerFault.exe
2164	WerFault.exe
2164	WerFault.exe
2164	WerFault.exe
2164	WerFault.exe
2088	powershell.exe
2088	powershell.exe
2088	powershell.exe
1008	audiodg.exe
1008	audiodg.exe
1008	audiodg.exe
1008	audiodg.exe
1008	audiodg.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1008	audiodg.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1812	ea800644b9dfd027807447fdd98241aa.exe
Token: SeDebugPrivilege	2416	AdvancedRun.exe
Token: SeImpersonatePrivilege	2416	AdvancedRun.exe
Token: SeDebugPrivilege	640	AdvancedRun.exe
Token: SeImpersonatePrivilege	640	AdvancedRun.exe
Token: SeDebugPrivilege	3456	ea800644b9dfd027807447fdd98241aa.exe
Token: SeDebugPrivilege	3744	powershell.exe
Token: SeRestorePrivilege	1572	WerFault.exe
Token: SeBackupPrivilege	1572	WerFault.exe
Token: SeBackupPrivilege	1572	WerFault.exe
Token: SeDebugPrivilege	1572	WerFault.exe
Token: SeDebugPrivilege	2380	audiodg.exe
Token: SeDebugPrivilege	2944	AdvancedRun.exe
Token: SeImpersonatePrivilege	2944	AdvancedRun.exe
Token: SeDebugPrivilege	616	AdvancedRun.exe
Token: SeImpersonatePrivilege	616	AdvancedRun.exe
Token: SeDebugPrivilege	2164	WerFault.exe
Token: SeDebugPrivilege	2088	powershell.exe
Token: SeDebugPrivilege	1008	audiodg.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 2416	1812	ea800644b9dfd027807447fdd98241aa.exe	71
PID 1812 wrote to memory of 2416	1812	ea800644b9dfd027807447fdd98241aa.exe	71
PID 1812 wrote to memory of 2416	1812	ea800644b9dfd027807447fdd98241aa.exe	71
PID 2416 wrote to memory of 640	2416	AdvancedRun.exe	72
PID 2416 wrote to memory of 640	2416	AdvancedRun.exe	72
PID 2416 wrote to memory of 640	2416	AdvancedRun.exe	72
PID 1812 wrote to memory of 3744	1812	ea800644b9dfd027807447fdd98241aa.exe	74
PID 1812 wrote to memory of 3744	1812	ea800644b9dfd027807447fdd98241aa.exe	74
PID 1812 wrote to memory of 3744	1812	ea800644b9dfd027807447fdd98241aa.exe	74
PID 1812 wrote to memory of 976	1812	ea800644b9dfd027807447fdd98241aa.exe	76
PID 1812 wrote to memory of 976	1812	ea800644b9dfd027807447fdd98241aa.exe	76
PID 1812 wrote to memory of 976	1812	ea800644b9dfd027807447fdd98241aa.exe	76
PID 1812 wrote to memory of 3456	1812	ea800644b9dfd027807447fdd98241aa.exe	77
PID 1812 wrote to memory of 3456	1812	ea800644b9dfd027807447fdd98241aa.exe	77
PID 1812 wrote to memory of 3456	1812	ea800644b9dfd027807447fdd98241aa.exe	77
PID 1812 wrote to memory of 3456	1812	ea800644b9dfd027807447fdd98241aa.exe	77
PID 1812 wrote to memory of 3456	1812	ea800644b9dfd027807447fdd98241aa.exe	77
PID 1812 wrote to memory of 3456	1812	ea800644b9dfd027807447fdd98241aa.exe	77
PID 1812 wrote to memory of 3456	1812	ea800644b9dfd027807447fdd98241aa.exe	77
PID 1812 wrote to memory of 3456	1812	ea800644b9dfd027807447fdd98241aa.exe	77
PID 3456 wrote to memory of 3096	3456	ea800644b9dfd027807447fdd98241aa.exe	88
PID 3456 wrote to memory of 3096	3456	ea800644b9dfd027807447fdd98241aa.exe	88
PID 3456 wrote to memory of 3096	3456	ea800644b9dfd027807447fdd98241aa.exe	88
PID 3096 wrote to memory of 3228	3096	cmd.exe	90
PID 3096 wrote to memory of 3228	3096	cmd.exe	90
PID 3096 wrote to memory of 3228	3096	cmd.exe	90
PID 3096 wrote to memory of 1052	3096	cmd.exe	91
PID 3096 wrote to memory of 1052	3096	cmd.exe	91
PID 3096 wrote to memory of 1052	3096	cmd.exe	91
PID 1052 wrote to memory of 1452	1052	w32tm.exe	92
PID 1052 wrote to memory of 1452	1052	w32tm.exe	92
PID 3096 wrote to memory of 2380	3096	cmd.exe	93
PID 3096 wrote to memory of 2380	3096	cmd.exe	93
PID 3096 wrote to memory of 2380	3096	cmd.exe	93
PID 2380 wrote to memory of 2944	2380	audiodg.exe	94
PID 2380 wrote to memory of 2944	2380	audiodg.exe	94
PID 2380 wrote to memory of 2944	2380	audiodg.exe	94
PID 2944 wrote to memory of 616	2944	AdvancedRun.exe	95
PID 2944 wrote to memory of 616	2944	AdvancedRun.exe	95
PID 2944 wrote to memory of 616	2944	AdvancedRun.exe	95
PID 2380 wrote to memory of 2088	2380	audiodg.exe	96
PID 2380 wrote to memory of 2088	2380	audiodg.exe	96
PID 2380 wrote to memory of 2088	2380	audiodg.exe	96
PID 2380 wrote to memory of 1008	2380	audiodg.exe	98
PID 2380 wrote to memory of 1008	2380	audiodg.exe	98
PID 2380 wrote to memory of 1008	2380	audiodg.exe	98
PID 2380 wrote to memory of 1008	2380	audiodg.exe	98
PID 2380 wrote to memory of 1008	2380	audiodg.exe	98
PID 2380 wrote to memory of 1008	2380	audiodg.exe	98
PID 2380 wrote to memory of 1008	2380	audiodg.exe	98
PID 2380 wrote to memory of 1008	2380	audiodg.exe	98

C:\Users\Admin\AppData\Local\Temp\ea800644b9dfd027807447fdd98241aa.exe
"C:\Users\Admin\AppData\Local\Temp\ea800644b9dfd027807447fdd98241aa.exe"
1⤵
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Users\Admin\AppData\Local\Temp\daedc15f-2d2e-4d72-89b1-ad0fbb9b7253\AdvancedRun.exe
  "C:\Users\Admin\AppData\Local\Temp\daedc15f-2d2e-4d72-89b1-ad0fbb9b7253\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\daedc15f-2d2e-4d72-89b1-ad0fbb9b7253\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Users\Admin\AppData\Local\Temp\daedc15f-2d2e-4d72-89b1-ad0fbb9b7253\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\daedc15f-2d2e-4d72-89b1-ad0fbb9b7253\AdvancedRun.exe" /SpecialRun 4101d8 2416
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:640
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ea800644b9dfd027807447fdd98241aa.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3744
- C:\Users\Admin\AppData\Local\Temp\ea800644b9dfd027807447fdd98241aa.exe
  "C:\Users\Admin\AppData\Local\Temp\ea800644b9dfd027807447fdd98241aa.exe"
  2⤵
  PID:976
- C:\Users\Admin\AppData\Local\Temp\ea800644b9dfd027807447fdd98241aa.exe
  "C:\Users\Admin\AppData\Local\Temp\ea800644b9dfd027807447fdd98241aa.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3456
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IPfEfXPoJG.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3096
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:3228
  - - C:\Windows\SysWOW64\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1052
    - - C:\Windows\System32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        5⤵
        
        PID:1452
  - - C:\Windows\SysWOW64\dpmodemx\audiodg.exe
      "C:\Windows\System32\dpmodemx\audiodg.exe"
      4⤵
      Executes dropped EXE
      Windows security modification
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2380
    - - C:\Users\Admin\AppData\Local\Temp\95706d06-947c-41f7-b925-9f3cd5977fe8\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\95706d06-947c-41f7-b925-9f3cd5977fe8\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\95706d06-947c-41f7-b925-9f3cd5977fe8\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2944
      - C:\Users\Admin\AppData\Local\Temp\95706d06-947c-41f7-b925-9f3cd5977fe8\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\95706d06-947c-41f7-b925-9f3cd5977fe8\AdvancedRun.exe" /SpecialRun 4101d8 2944
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:616
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\SysWOW64\dpmodemx\audiodg.exe" -Force
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2088
    - - C:\Windows\SysWOW64\dpmodemx\audiodg.exe
        
        "C:\Windows\SysWOW64\dpmodemx\audiodg.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:1008
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 2252
        5⤵
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2164
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 2212
  2⤵
  - Drops file in Windows directory
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\System32\KBDTT102\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\System32\odbcjt32\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\System32\imaadp32\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\System32\KBDFR\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ea800644b9dfd027807447fdd98241aa" /sc ONLOGON /tr "'C:\PerfLogs\ea800644b9dfd027807447fdd98241aa.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Windows\System32\dpmodemx\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\SensorsApi\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3232

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1008-422-0x00000000050B0000-0x00000000055AE000-memory.dmp

Download

memory/1812-120-0x0000000007870000-0x000000000792D000-memory.dmp

Download

memory/1812-117-0x0000000005C30000-0x0000000005C31000-memory.dmp

Download

memory/1812-115-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

Download

memory/1812-118-0x0000000005730000-0x0000000005731000-memory.dmp

Download

memory/1812-119-0x0000000005700000-0x0000000005701000-memory.dmp

Download

memory/2088-516-0x000000007E0B0000-0x000000007E0B1000-memory.dmp

Download

memory/2088-517-0x0000000004CA3000-0x0000000004CA4000-memory.dmp

Download

memory/2088-420-0x0000000004CA2000-0x0000000004CA3000-memory.dmp

Download

memory/2088-418-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

Download

memory/2380-396-0x00000000050C0000-0x00000000055BE000-memory.dmp

Download

memory/3456-127-0x0000000000400000-0x0000000000468000-memory.dmp

Download

memory/3456-143-0x00000000056E0000-0x0000000005BDE000-memory.dmp

Download

memory/3744-142-0x00000000009D2000-0x00000000009D3000-memory.dmp

Download

memory/3744-139-0x0000000007450000-0x0000000007451000-memory.dmp

Download

memory/3744-174-0x00000000009D3000-0x00000000009D4000-memory.dmp

Download

memory/3744-148-0x0000000000680000-0x0000000000681000-memory.dmp

Download

memory/3744-146-0x0000000007BC0000-0x0000000007BC1000-memory.dmp

Download

memory/3744-145-0x00000000078B0000-0x00000000078B1000-memory.dmp

Download

memory/3744-144-0x0000000007890000-0x0000000007891000-memory.dmp

Download

memory/3744-173-0x000000007E570000-0x000000007E571000-memory.dmp

Download

memory/3744-160-0x0000000008920000-0x0000000008953000-memory.dmp

Download

memory/3744-141-0x00000000009D0000-0x00000000009D1000-memory.dmp

Download

memory/3744-140-0x0000000007500000-0x0000000007501000-memory.dmp

Download

memory/3744-175-0x0000000008E40000-0x0000000008E41000-memory.dmp

Download

memory/3744-138-0x00000000073E0000-0x00000000073E1000-memory.dmp

Download

memory/3744-137-0x0000000004380000-0x0000000004381000-memory.dmp

Download

memory/3744-136-0x0000000006DB0000-0x0000000006DB1000-memory.dmp

Download

memory/3744-133-0x0000000006740000-0x0000000006741000-memory.dmp

Download

memory/3744-131-0x0000000000680000-0x0000000000681000-memory.dmp

Download

memory/3744-129-0x0000000000680000-0x0000000000681000-memory.dmp

Download

memory/3744-172-0x0000000008A70000-0x0000000008A71000-memory.dmp

Download

memory/3744-167-0x0000000008900000-0x0000000008901000-memory.dmp

Download