Overview
overview
10Static
static
029b714502...39.dll
windows11_x64
10061dfb6a25...52.dll
windows11_x64
1006d55f75d7...d2.dll
windows11_x64
1024401ac43b...65.dll
windows11_x64
8260e2d5769...40.dll
windows11_x64
1026cd036960...18.dll
windows11_x64
102a0a88a2e5...4a.dll
windows11_x64
102f33217d51...94.dll
windows11_x64
10336cdd146b...da.dll
windows11_x64
10417c1828d9...73.dll
windows11_x64
104d3095c796...ee.dll
windows11_x64
1054e526fe05...4c.dll
windows11_x64
106402b33d72...3b.dll
windows11_x64
1064c044cb3e...db.dll
windows11_x64
10671f477c30...4e.dll
windows11_x64
1067785724b6...ce.dll
windows11_x64
106c6934613a...fb.dll
windows11_x64
106f63742c25...fd.dll
windows11_x64
10813a9b03c6...48.dll
windows11_x64
10839ac59a78...e3.dll
windows11_x64
1085d0b72fe8...39.dll
windows11_x64
10a34cb4049e...c4.dll
windows11_x64
1a55c19c552...60.dll
windows11_x64
1a98e988f03...48.dll
windows11_x64
10acc31f97c3...27.dll
windows11_x64
10b194eec1e5...c7.dll
windows11_x64
10bac73f9cce...00.dll
windows11_x64
10c5d2f0da18...0c.dll
windows11_x64
10d559ee0a26...7e.dll
windows11_x64
8db5276c0d5...79.dll
windows11_x64
10e5efde9740...15.dll
windows11_x64
10fe028e6f99...1c.dll
windows11_x64
10Resubmissions
01-11-2021 12:31
211101-pp5r3ahha4 1031-10-2021 09:03
211031-k1bwxacfaq 1014-10-2021 01:44
211014-b6aflafeg4 10Analysis
-
max time kernel
148s -
max time network
139s -
platform
windows11_x64 -
resource
win11 -
submitted
01-11-2021 12:31
Static task
static1
Behavioral task
behavioral1
Sample
029b714502283599a5efb86d41c48fd46751ab727b707bde620e517ec3aa3c39.dll
Resource
win11
windows11_x64
Behavioral task
behavioral2
Sample
061dfb6a251e536f700a295239652dafab34aee5e5145320d1d57e3fca5e5d52.dll
Resource
win11
windows11_x64
Behavioral task
behavioral3
Sample
06d55f75d7c76d6924c0b8439fa3cda28b89284204a6db982e4baf3a37fb35d2.dll
Resource
win11
windows11_x64
Behavioral task
behavioral4
Sample
24401ac43b6dbb7048cb27425b4f0f76a9b20b6b4fffa33ff8091c3c11ef8365.dll
Resource
win11
windows11_x64
Behavioral task
behavioral5
Sample
260e2d5769f0a50a7b49d4c43059221eb7acc4b9fc460763e0cfcd793f2a6840.dll
Resource
win11
windows11_x64
Behavioral task
behavioral6
Sample
26cd03696045fb93b415b022fa6bc832098394bf362f4b4c4e897e9550d12618.dll
Resource
win11
windows11_x64
Behavioral task
behavioral7
Sample
2a0a88a2e5f9cafa10a48d63bdfcdf965b72c25978ab46cf28e795dbedc9624a.dll
Resource
win11
windows11_x64
Behavioral task
behavioral8
Sample
2f33217d51117cf3d6c6ed3ab50724964367fc7a85e1bb1dc87d241b8d953894.dll
Resource
win11
windows11_x64
Behavioral task
behavioral9
Sample
336cdd146beca939c6d1e3e3c00cc10ec2d6e859a18d350bff937ad5194c27da.dll
Resource
win11
windows11_x64
Behavioral task
behavioral10
Sample
417c1828d98ba4f05f7a2edb71a9105f0aebf3d554393970b96e59d4db7b4473.dll
Resource
win11
windows11_x64
Behavioral task
behavioral11
Sample
4d3095c7965c7bdd32b81b72c95f767134915cf08ebe1237721ed5208de4beee.dll
Resource
win11
windows11_x64
Behavioral task
behavioral12
Sample
54e526fe059a3f25cdaed954e32f44eadffb3e51548658409468dcf2d63b634c.dll
Resource
win11
windows11_x64
Behavioral task
behavioral13
Sample
6402b33d729c8bb44881747a8f397f4aec408bf5e18b9af6fd86cdfa3f96323b.dll
Resource
win11
windows11_x64
Behavioral task
behavioral14
Sample
64c044cb3ec26babdd17107b2aa6ded60b22473c4e2943e1fcc03df8bc2e0edb.dll
Resource
win11
windows11_x64
Behavioral task
behavioral15
Sample
671f477c3039786c5f3553760377be03b91bfb66f31ba9370ed2193192cf5b4e.dll
Resource
win11
windows11_x64
Behavioral task
behavioral16
Sample
67785724b67ecd79b7cd4c64a249794b9abda8b680fe52a0ce85bb83ddfb6cce.dll
Resource
win11
windows11_x64
Behavioral task
behavioral17
Sample
6c6934613abde41f82043bb7c269a1e614920a83a2b90eaf325ca7b998183efb.dll
Resource
win11
windows11_x64
Behavioral task
behavioral18
Sample
6f63742c25fd3a2dae5995f182254c253003066488ef86e754f661e8ba1d76fd.dll
Resource
win11
windows11_x64
Behavioral task
behavioral19
Sample
813a9b03c6c1caec4eca8a867dcfbda7860bca6a5d481acb4c131c1a868d4b48.dll
Resource
win11
windows11_x64
Behavioral task
behavioral20
Sample
839ac59a78a0f2c446edb3cccbaf0bc5781605a1f848878f9e96cd5e0e425fe3.dll
Resource
win11
windows11_x64
Behavioral task
behavioral21
Sample
85d0b72fe822fd6c22827b4da1917d2c1f2d9faa838e003e78e533384ea80939.dll
Resource
win11
windows11_x64
Behavioral task
behavioral22
Sample
a34cb4049eb43d455d8619607cc6e1a8c380e9d8507306e9c5bc17eaed6459c4.dll
Resource
win11
windows11_x64
Behavioral task
behavioral23
Sample
a55c19c552f579041ad7289aceeb400da215fe29aedbf0c14e8a66be1bee8360.dll
Resource
win11
windows11_x64
Behavioral task
behavioral24
Sample
a98e988f03fd5be37c66878017a3dcd741adf75bf1df1ed6dde2c15ee213bb48.dll
Resource
win11
windows11_x64
Behavioral task
behavioral25
Sample
acc31f97c3124a317f2939944777e103311f4b0c51788d2e562c24a08e2afe27.dll
Resource
win11
windows11_x64
Behavioral task
behavioral26
Sample
b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7.dll
Resource
win11
windows11_x64
Behavioral task
behavioral27
Sample
bac73f9ccebf93009a6037145a9c71a2e8b916956f6a7e6a4f4b53b4b50b7a00.dll
Resource
win11
windows11_x64
Behavioral task
behavioral28
Sample
c5d2f0da18fb33a25b53fd8b9b98f0bfa95458e3c0feb687852f469167a0110c.dll
Resource
win11
windows11_x64
Behavioral task
behavioral29
Sample
d559ee0a26fa500cd57fac25d58ba4319a794f329c8711e89afac3c281f9dd7e.dll
Resource
win11
windows11_x64
Behavioral task
behavioral30
Sample
db5276c0d5ecd3b338a98983001a5b8cbbf5b488bf420d8cc0267801b963f479.dll
Resource
win11
windows11_x64
Behavioral task
behavioral31
Sample
e5efde974017a12a573548f12b5473887601c897e8660eb57803c18523f72815.dll
Resource
win11
windows11_x64
Behavioral task
behavioral32
Sample
fe028e6f99a02a016643a2db14534fa977a78f45b36ff9db5b60e7e709f5541c.dll
Resource
win11
windows11_x64
General
-
Target
6c6934613abde41f82043bb7c269a1e614920a83a2b90eaf325ca7b998183efb.dll
-
Size
172KB
-
MD5
f943853cddc15b59823962b28f08b809
-
SHA1
3e46675756a6f0dc722c620f3bc12610fe27c010
-
SHA256
6c6934613abde41f82043bb7c269a1e614920a83a2b90eaf325ca7b998183efb
-
SHA512
1a524916b6af5b071e2d4e533fb302b062383c2edb941a7a6e3d9e92897b2e7f612aa444eeff8c4de6499421f3823d54efa9b375b22c0fe6d301ff1bcb632985
Malware Config
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
Bazar/Team9 Loader payload 2 IoCs
resource yara_rule behavioral17/memory/4084-146-0x0000000002970000-0x0000000002A9C000-memory.dmp BazarLoaderVar6 behavioral17/memory/2576-150-0x00000257DC410000-0x00000257DC53C000-memory.dmp BazarLoaderVar6 -
Sets service image path in registry 2 TTPs
-
Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1792 svchost.exe Token: SeCreatePagefilePrivilege 1792 svchost.exe Token: SeShutdownPrivilege 1792 svchost.exe Token: SeCreatePagefilePrivilege 1792 svchost.exe Token: SeShutdownPrivilege 1792 svchost.exe Token: SeCreatePagefilePrivilege 1792 svchost.exe Token: SeShutdownPrivilege 2428 svchost.exe Token: SeCreatePagefilePrivilege 2428 svchost.exe Token: SeSecurityPrivilege 1592 TiWorker.exe Token: SeRestorePrivilege 1592 TiWorker.exe Token: SeBackupPrivilege 1592 TiWorker.exe Token: SeBackupPrivilege 1592 TiWorker.exe Token: SeRestorePrivilege 1592 TiWorker.exe Token: SeSecurityPrivilege 1592 TiWorker.exe Token: SeBackupPrivilege 1592 TiWorker.exe Token: SeRestorePrivilege 1592 TiWorker.exe Token: SeSecurityPrivilege 1592 TiWorker.exe Token: SeBackupPrivilege 1592 TiWorker.exe Token: SeRestorePrivilege 1592 TiWorker.exe Token: SeSecurityPrivilege 1592 TiWorker.exe Token: SeBackupPrivilege 1592 TiWorker.exe Token: SeRestorePrivilege 1592 TiWorker.exe Token: SeSecurityPrivilege 1592 TiWorker.exe Token: SeBackupPrivilege 1592 TiWorker.exe Token: SeRestorePrivilege 1592 TiWorker.exe Token: SeSecurityPrivilege 1592 TiWorker.exe Token: SeBackupPrivilege 1592 TiWorker.exe Token: SeRestorePrivilege 1592 TiWorker.exe Token: SeSecurityPrivilege 1592 TiWorker.exe Token: SeBackupPrivilege 1592 TiWorker.exe Token: SeRestorePrivilege 1592 TiWorker.exe Token: SeSecurityPrivilege 1592 TiWorker.exe Token: SeBackupPrivilege 1592 TiWorker.exe Token: SeRestorePrivilege 1592 TiWorker.exe Token: SeSecurityPrivilege 1592 TiWorker.exe Token: SeBackupPrivilege 1592 TiWorker.exe Token: SeRestorePrivilege 1592 TiWorker.exe Token: SeSecurityPrivilege 1592 TiWorker.exe Token: SeBackupPrivilege 1592 TiWorker.exe Token: SeRestorePrivilege 1592 TiWorker.exe Token: SeSecurityPrivilege 1592 TiWorker.exe Token: SeBackupPrivilege 1592 TiWorker.exe Token: SeRestorePrivilege 1592 TiWorker.exe Token: SeSecurityPrivilege 1592 TiWorker.exe Token: SeBackupPrivilege 1592 TiWorker.exe Token: SeRestorePrivilege 1592 TiWorker.exe Token: SeSecurityPrivilege 1592 TiWorker.exe Token: SeBackupPrivilege 1592 TiWorker.exe Token: SeRestorePrivilege 1592 TiWorker.exe Token: SeSecurityPrivilege 1592 TiWorker.exe Token: SeBackupPrivilege 1592 TiWorker.exe Token: SeRestorePrivilege 1592 TiWorker.exe Token: SeSecurityPrivilege 1592 TiWorker.exe Token: SeBackupPrivilege 1592 TiWorker.exe Token: SeRestorePrivilege 1592 TiWorker.exe Token: SeSecurityPrivilege 1592 TiWorker.exe Token: SeBackupPrivilege 1592 TiWorker.exe Token: SeRestorePrivilege 1592 TiWorker.exe Token: SeSecurityPrivilege 1592 TiWorker.exe Token: SeBackupPrivilege 1592 TiWorker.exe Token: SeRestorePrivilege 1592 TiWorker.exe Token: SeSecurityPrivilege 1592 TiWorker.exe Token: SeBackupPrivilege 1592 TiWorker.exe Token: SeRestorePrivilege 1592 TiWorker.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2428 wrote to memory of 5048 2428 svchost.exe 86 PID 2428 wrote to memory of 5048 2428 svchost.exe 86
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\6c6934613abde41f82043bb7c269a1e614920a83a2b90eaf325ca7b998183efb.dll1⤵PID:4084
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 1f6764066114f4f3d12b9af80fbe9dea wWbm9b2cJUS+6j6NQEP/6w.0.1.0.3.01⤵
- Modifies data under HKEY_USERS
PID:856
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1792
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\6c6934613abde41f82043bb7c269a1e614920a83a2b90eaf325ca7b998183efb.dll,DllRegisterServer {873C12B5-EBF7-4C75-830C-2856BD96A042}1⤵PID:2576
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\uus\AMD64\MoUsoCoreWorker.exeC:\Windows\uus\AMD64\MoUsoCoreWorker.exe2⤵PID:5048
-
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.100_none_04da31ff4c67c24a\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.100_none_04da31ff4c67c24a\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1592
-
C:\Windows\System32\sihclient.exeC:\Windows\System32\sihclient.exe /cv gnqahFohP0ekkzqJluxbkA.0.21⤵PID:3168
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 1f6764066114f4f3d12b9af80fbe9dea wWbm9b2cJUS+6j6NQEP/6w.0.1.0.3.01⤵
- Modifies data under HKEY_USERS
PID:3992
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 1f6764066114f4f3d12b9af80fbe9dea wWbm9b2cJUS+6j6NQEP/6w.0.1.0.3.01⤵
- Modifies data under HKEY_USERS
PID:4252