Analysis
-
max time kernel
179s -
max time network
189s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
11-02-2022 06:28
Static task
static1
Behavioral task
behavioral1
Sample
db3ae704e4ea31b79ad7859acfdd0f2c876aaecac3182af2cd64d9108c2d8525.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
db3ae704e4ea31b79ad7859acfdd0f2c876aaecac3182af2cd64d9108c2d8525.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
db3ae704e4ea31b79ad7859acfdd0f2c876aaecac3182af2cd64d9108c2d8525.exe
-
Size
54KB
-
MD5
5a5e32203cf8eee1b7e9125b1c97ed94
-
SHA1
7cd7f7d35abb1bd79cc85db99ff3238ea28c3ef4
-
SHA256
db3ae704e4ea31b79ad7859acfdd0f2c876aaecac3182af2cd64d9108c2d8525
-
SHA512
3fe266ff6ed79eef7a5e857d167833bd3b03cda165298066acc9afbf0641d533083c281a07775e2017e5659ba1343daf721e9fdc81021052ca93ed1b5f0cd941
Score
10/10
Malware Config
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 4388 created 3788 4388 WerFault.exe 95 -
Modifies extensions of user files 9 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\EditDisconnect.tiff => C:\Users\Admin\Pictures\EditDisconnect.tiff..doc db3ae704e4ea31b79ad7859acfdd0f2c876aaecac3182af2cd64d9108c2d8525.exe File renamed C:\Users\Admin\Pictures\OptimizeBlock.png => C:\Users\Admin\Pictures\OptimizeBlock.png..doc db3ae704e4ea31b79ad7859acfdd0f2c876aaecac3182af2cd64d9108c2d8525.exe File renamed C:\Users\Admin\Pictures\ClearRemove.crw => C:\Users\Admin\Pictures\ClearRemove.crw..doc db3ae704e4ea31b79ad7859acfdd0f2c876aaecac3182af2cd64d9108c2d8525.exe File opened for modification C:\Users\Admin\Pictures\EditDisconnect.tiff db3ae704e4ea31b79ad7859acfdd0f2c876aaecac3182af2cd64d9108c2d8525.exe File renamed C:\Users\Admin\Pictures\ExportTrace.raw => C:\Users\Admin\Pictures\ExportTrace.raw..doc db3ae704e4ea31b79ad7859acfdd0f2c876aaecac3182af2cd64d9108c2d8525.exe File renamed C:\Users\Admin\Pictures\FindUnpublish.raw => C:\Users\Admin\Pictures\FindUnpublish.raw..doc db3ae704e4ea31b79ad7859acfdd0f2c876aaecac3182af2cd64d9108c2d8525.exe File renamed C:\Users\Admin\Pictures\LimitJoin.crw => C:\Users\Admin\Pictures\LimitJoin.crw..doc db3ae704e4ea31b79ad7859acfdd0f2c876aaecac3182af2cd64d9108c2d8525.exe File renamed C:\Users\Admin\Pictures\ResolveDeny.png => C:\Users\Admin\Pictures\ResolveDeny.png..doc db3ae704e4ea31b79ad7859acfdd0f2c876aaecac3182af2cd64d9108c2d8525.exe File renamed C:\Users\Admin\Pictures\CopySwitch.crw => C:\Users\Admin\Pictures\CopySwitch.crw..doc db3ae704e4ea31b79ad7859acfdd0f2c876aaecac3182af2cd64d9108c2d8525.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce db3ae704e4ea31b79ad7859acfdd0f2c876aaecac3182af2cd64d9108c2d8525.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Roaming\\db3ae704e4ea31b79ad7859acfdd0f2c876aaecac3182af2cd64d9108c2d8525.exe" db3ae704e4ea31b79ad7859acfdd0f2c876aaecac3182af2cd64d9108c2d8525.exe -
Drops desktop.ini file(s) 23 IoCs
description ioc Process File opened for modification C:\Users\Public\Videos\desktop.ini db3ae704e4ea31b79ad7859acfdd0f2c876aaecac3182af2cd64d9108c2d8525.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini db3ae704e4ea31b79ad7859acfdd0f2c876aaecac3182af2cd64d9108c2d8525.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini db3ae704e4ea31b79ad7859acfdd0f2c876aaecac3182af2cd64d9108c2d8525.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini db3ae704e4ea31b79ad7859acfdd0f2c876aaecac3182af2cd64d9108c2d8525.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini db3ae704e4ea31b79ad7859acfdd0f2c876aaecac3182af2cd64d9108c2d8525.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini db3ae704e4ea31b79ad7859acfdd0f2c876aaecac3182af2cd64d9108c2d8525.exe File opened for modification C:\Users\Public\desktop.ini db3ae704e4ea31b79ad7859acfdd0f2c876aaecac3182af2cd64d9108c2d8525.exe File opened for modification C:\Users\Admin\Links\desktop.ini db3ae704e4ea31b79ad7859acfdd0f2c876aaecac3182af2cd64d9108c2d8525.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini db3ae704e4ea31b79ad7859acfdd0f2c876aaecac3182af2cd64d9108c2d8525.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini db3ae704e4ea31b79ad7859acfdd0f2c876aaecac3182af2cd64d9108c2d8525.exe File opened for modification C:\Users\Admin\Searches\desktop.ini db3ae704e4ea31b79ad7859acfdd0f2c876aaecac3182af2cd64d9108c2d8525.exe File opened for modification C:\Users\Public\Music\desktop.ini db3ae704e4ea31b79ad7859acfdd0f2c876aaecac3182af2cd64d9108c2d8525.exe File opened for modification C:\Users\Public\Documents\desktop.ini db3ae704e4ea31b79ad7859acfdd0f2c876aaecac3182af2cd64d9108c2d8525.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini db3ae704e4ea31b79ad7859acfdd0f2c876aaecac3182af2cd64d9108c2d8525.exe File opened for modification C:\Users\Admin\Videos\desktop.ini db3ae704e4ea31b79ad7859acfdd0f2c876aaecac3182af2cd64d9108c2d8525.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini db3ae704e4ea31b79ad7859acfdd0f2c876aaecac3182af2cd64d9108c2d8525.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini db3ae704e4ea31b79ad7859acfdd0f2c876aaecac3182af2cd64d9108c2d8525.exe File opened for modification C:\Users\Admin\Music\desktop.ini db3ae704e4ea31b79ad7859acfdd0f2c876aaecac3182af2cd64d9108c2d8525.exe File opened for modification C:\Users\Admin\Documents\desktop.ini db3ae704e4ea31b79ad7859acfdd0f2c876aaecac3182af2cd64d9108c2d8525.exe File opened for modification C:\Users\Public\Pictures\desktop.ini db3ae704e4ea31b79ad7859acfdd0f2c876aaecac3182af2cd64d9108c2d8525.exe File opened for modification C:\Users\Public\Libraries\desktop.ini db3ae704e4ea31b79ad7859acfdd0f2c876aaecac3182af2cd64d9108c2d8525.exe File opened for modification C:\Users\Public\Downloads\desktop.ini db3ae704e4ea31b79ad7859acfdd0f2c876aaecac3182af2cd64d9108c2d8525.exe File opened for modification C:\Users\Public\Desktop\desktop.ini db3ae704e4ea31b79ad7859acfdd0f2c876aaecac3182af2cd64d9108c2d8525.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 2424 3788 WerFault.exe 95 4524 3788 WerFault.exe 95 -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchApp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchApp.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe -
Modifies registry class 30 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\MuiCache SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "1944" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "1944" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "3994" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "140" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "3900" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\www.bing.com SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "173" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "140" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "140" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Recognizers\\Tokens\\MS-1033-110-WINMO-DNN" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "3994" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "3900" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "173" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "173" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "1944" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "3994" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "3900" SearchApp.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2700 db3ae704e4ea31b79ad7859acfdd0f2c876aaecac3182af2cd64d9108c2d8525.exe 2700 db3ae704e4ea31b79ad7859acfdd0f2c876aaecac3182af2cd64d9108c2d8525.exe 4524 WerFault.exe 4524 WerFault.exe 2424 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeShutdownPrivilege 2712 svchost.exe Token: SeCreatePagefilePrivilege 2712 svchost.exe Token: SeShutdownPrivilege 2712 svchost.exe Token: SeCreatePagefilePrivilege 2712 svchost.exe Token: SeShutdownPrivilege 2712 svchost.exe Token: SeCreatePagefilePrivilege 2712 svchost.exe Token: SeTakeOwnershipPrivilege 3788 SearchApp.exe Token: SeRestorePrivilege 3788 SearchApp.exe Token: SeTakeOwnershipPrivilege 3788 SearchApp.exe Token: SeRestorePrivilege 3788 SearchApp.exe Token: SeTakeOwnershipPrivilege 3788 SearchApp.exe Token: SeRestorePrivilege 3788 SearchApp.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3788 SearchApp.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3788 wrote to memory of 2424 3788 SearchApp.exe 103 PID 3788 wrote to memory of 2424 3788 SearchApp.exe 103 PID 3788 wrote to memory of 2424 3788 SearchApp.exe 103 PID 4388 wrote to memory of 3788 4388 WerFault.exe 95 PID 4388 wrote to memory of 3788 4388 WerFault.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\db3ae704e4ea31b79ad7859acfdd0f2c876aaecac3182af2cd64d9108c2d8525.exe"C:\Users\Admin\AppData\Local\Temp\db3ae704e4ea31b79ad7859acfdd0f2c876aaecac3182af2cd64d9108c2d8525.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
PID:2700
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2712
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3788 -s 44882⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:2424
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3788 -s 44882⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:4524
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
PID:3572
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵PID:4632
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 408 -p 3788 -ip 37881⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:4388