Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
172s -
max time network
199s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
11/02/2022, 06:42
Static task
static1
Behavioral task
behavioral1
Sample
9104c3148d0de87de6e7608d8fb8fc92de13c4fc41c9090b7a39db7337770e38.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
9104c3148d0de87de6e7608d8fb8fc92de13c4fc41c9090b7a39db7337770e38.exe
Resource
win10v2004-en-20220113
General
-
Target
9104c3148d0de87de6e7608d8fb8fc92de13c4fc41c9090b7a39db7337770e38.exe
-
Size
53KB
-
MD5
eab9e6a0163f10437b4b418aacb06983
-
SHA1
b7ec1192dc5b85e702da82e00b664284ee32f499
-
SHA256
9104c3148d0de87de6e7608d8fb8fc92de13c4fc41c9090b7a39db7337770e38
-
SHA512
9423894e7e81a7adb31bb0f0be98a8fcef9382387055abbbe7f296bab8a12c04894ead036e7e03de210dbdd623cf0cc620ecf7c7606896e8a40449efa1b48e09
Malware Config
Extracted
C:\Recovery_Instructions.html
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 3128 created 1272 3128 WerFault.exe 95 -
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\CheckpointJoin.tiff 9104c3148d0de87de6e7608d8fb8fc92de13c4fc41c9090b7a39db7337770e38.exe File renamed C:\Users\Admin\Pictures\CheckpointJoin.tiff => C:\Users\Admin\Pictures\CheckpointJoin.tiff.recovery 9104c3148d0de87de6e7608d8fb8fc92de13c4fc41c9090b7a39db7337770e38.exe File renamed C:\Users\Admin\Pictures\ExportFormat.png => C:\Users\Admin\Pictures\ExportFormat.png.recovery 9104c3148d0de87de6e7608d8fb8fc92de13c4fc41c9090b7a39db7337770e38.exe File renamed C:\Users\Admin\Pictures\StartWait.raw => C:\Users\Admin\Pictures\StartWait.raw.recovery 9104c3148d0de87de6e7608d8fb8fc92de13c4fc41c9090b7a39db7337770e38.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\9104c3148d0de87de6e7608d8fb8fc92de13c4fc41c9090b7a39db7337770e38.exe" 9104c3148d0de87de6e7608d8fb8fc92de13c4fc41c9090b7a39db7337770e38.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 9104c3148d0de87de6e7608d8fb8fc92de13c4fc41c9090b7a39db7337770e38.exe -
Drops desktop.ini file(s) 19 IoCs
description ioc Process File opened for modification C:\Users\Admin\Searches\desktop.ini 9104c3148d0de87de6e7608d8fb8fc92de13c4fc41c9090b7a39db7337770e38.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 9104c3148d0de87de6e7608d8fb8fc92de13c4fc41c9090b7a39db7337770e38.exe File opened for modification C:\Users\Public\Music\desktop.ini 9104c3148d0de87de6e7608d8fb8fc92de13c4fc41c9090b7a39db7337770e38.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 9104c3148d0de87de6e7608d8fb8fc92de13c4fc41c9090b7a39db7337770e38.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 9104c3148d0de87de6e7608d8fb8fc92de13c4fc41c9090b7a39db7337770e38.exe File opened for modification C:\Users\Public\Videos\desktop.ini 9104c3148d0de87de6e7608d8fb8fc92de13c4fc41c9090b7a39db7337770e38.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 9104c3148d0de87de6e7608d8fb8fc92de13c4fc41c9090b7a39db7337770e38.exe File opened for modification C:\Users\Admin\Music\desktop.ini 9104c3148d0de87de6e7608d8fb8fc92de13c4fc41c9090b7a39db7337770e38.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 9104c3148d0de87de6e7608d8fb8fc92de13c4fc41c9090b7a39db7337770e38.exe File opened for modification C:\Users\Admin\Links\desktop.ini 9104c3148d0de87de6e7608d8fb8fc92de13c4fc41c9090b7a39db7337770e38.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 9104c3148d0de87de6e7608d8fb8fc92de13c4fc41c9090b7a39db7337770e38.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 9104c3148d0de87de6e7608d8fb8fc92de13c4fc41c9090b7a39db7337770e38.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 9104c3148d0de87de6e7608d8fb8fc92de13c4fc41c9090b7a39db7337770e38.exe File opened for modification C:\Users\Public\Documents\desktop.ini 9104c3148d0de87de6e7608d8fb8fc92de13c4fc41c9090b7a39db7337770e38.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 9104c3148d0de87de6e7608d8fb8fc92de13c4fc41c9090b7a39db7337770e38.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 9104c3148d0de87de6e7608d8fb8fc92de13c4fc41c9090b7a39db7337770e38.exe File opened for modification C:\Users\Public\desktop.ini 9104c3148d0de87de6e7608d8fb8fc92de13c4fc41c9090b7a39db7337770e38.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 9104c3148d0de87de6e7608d8fb8fc92de13c4fc41c9090b7a39db7337770e38.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 9104c3148d0de87de6e7608d8fb8fc92de13c4fc41c9090b7a39db7337770e38.exe -
Drops file in Windows directory 7 IoCs
description ioc Process File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe -
Program crash 3 IoCs
pid pid_target Process procid_target 4904 1272 WerFault.exe 95 4832 1272 WerFault.exe 95 3372 2792 WerFault.exe 105 -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe -
Enumerates system info in registry 2 TTPs 8 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchApp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchApp.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchApp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchApp.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe -
Modifies registry class 34 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "173" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "5768" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "173" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "2688" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "2254" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "881" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\www.bing.com SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "140" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\MuiCache SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "5768" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "140" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "140" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "173" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "2688" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "2254" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Recognizers\\Tokens\\MS-1033-110-WINMO-DNN" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "2688" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\MuiCache SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "881" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "881" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "2254" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "5768" SearchApp.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 4904 WerFault.exe 4832 WerFault.exe 4832 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeShutdownPrivilege 1084 svchost.exe Token: SeCreatePagefilePrivilege 1084 svchost.exe Token: SeShutdownPrivilege 1084 svchost.exe Token: SeCreatePagefilePrivilege 1084 svchost.exe Token: SeShutdownPrivilege 1084 svchost.exe Token: SeCreatePagefilePrivilege 1084 svchost.exe Token: SeTakeOwnershipPrivilege 1272 SearchApp.exe Token: SeRestorePrivilege 1272 SearchApp.exe Token: SeTakeOwnershipPrivilege 1272 SearchApp.exe Token: SeRestorePrivilege 1272 SearchApp.exe Token: SeTakeOwnershipPrivilege 1272 SearchApp.exe Token: SeRestorePrivilege 1272 SearchApp.exe Token: SeSecurityPrivilege 1624 TiWorker.exe Token: SeRestorePrivilege 1624 TiWorker.exe Token: SeBackupPrivilege 1624 TiWorker.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1272 SearchApp.exe 2792 SearchApp.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3128 wrote to memory of 1272 3128 WerFault.exe 95 PID 3128 wrote to memory of 1272 3128 WerFault.exe 95 PID 1272 wrote to memory of 4904 1272 SearchApp.exe 101 PID 1272 wrote to memory of 4904 1272 SearchApp.exe 101 PID 1272 wrote to memory of 4904 1272 SearchApp.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\9104c3148d0de87de6e7608d8fb8fc92de13c4fc41c9090b7a39db7337770e38.exe"C:\Users\Admin\AppData\Local\Temp\9104c3148d0de87de6e7608d8fb8fc92de13c4fc41c9090b7a39db7337770e38.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
PID:4988
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1084
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1272 -s 43682⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:4904
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1272 -s 43682⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:4832
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
PID:3296
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵PID:1196
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 412 -p 1272 -ip 12721⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:3128
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1624
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2792 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2792 -s 38842⤵
- Program crash
PID:3372
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 524 -p 2792 -ip 27921⤵PID:4884