Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
182s -
max time network
192s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
11/02/2022, 06:50
Static task
static1
Behavioral task
behavioral1
Sample
697d752697c1045a0e55e90d6593fbd0bc66b49c1ef52d1b813ea8b23a890fed.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
697d752697c1045a0e55e90d6593fbd0bc66b49c1ef52d1b813ea8b23a890fed.exe
Resource
win10v2004-en-20220113
General
-
Target
697d752697c1045a0e55e90d6593fbd0bc66b49c1ef52d1b813ea8b23a890fed.exe
-
Size
53KB
-
MD5
2f4fe65723c69894112eed9b3723846b
-
SHA1
f1240d919b70116919b11601352cc650b4d8a61b
-
SHA256
697d752697c1045a0e55e90d6593fbd0bc66b49c1ef52d1b813ea8b23a890fed
-
SHA512
114cd194bd4e5399ece0cf6a198c3d7d6d1b588e1c8b0ac73a3e0bb311d9ae9d3693f1c8b71c7d2c416e026ae194023e4eff8dce23ac9147746913adfd277c58
Malware Config
Extracted
C:\how_to_back_files.html
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 2244 created 1432 2244 WerFault.exe 97 -
Modifies extensions of user files 9 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\ResolveDeny.png => C:\Users\Admin\Pictures\ResolveDeny.png.STG 697d752697c1045a0e55e90d6593fbd0bc66b49c1ef52d1b813ea8b23a890fed.exe File renamed C:\Users\Admin\Pictures\ExportTrace.raw => C:\Users\Admin\Pictures\ExportTrace.raw.STG 697d752697c1045a0e55e90d6593fbd0bc66b49c1ef52d1b813ea8b23a890fed.exe File renamed C:\Users\Admin\Pictures\FindUnpublish.raw => C:\Users\Admin\Pictures\FindUnpublish.raw.STG 697d752697c1045a0e55e90d6593fbd0bc66b49c1ef52d1b813ea8b23a890fed.exe File renamed C:\Users\Admin\Pictures\LimitJoin.crw => C:\Users\Admin\Pictures\LimitJoin.crw.STG 697d752697c1045a0e55e90d6593fbd0bc66b49c1ef52d1b813ea8b23a890fed.exe File renamed C:\Users\Admin\Pictures\EditDisconnect.tiff => C:\Users\Admin\Pictures\EditDisconnect.tiff.STG 697d752697c1045a0e55e90d6593fbd0bc66b49c1ef52d1b813ea8b23a890fed.exe File renamed C:\Users\Admin\Pictures\OptimizeBlock.png => C:\Users\Admin\Pictures\OptimizeBlock.png.STG 697d752697c1045a0e55e90d6593fbd0bc66b49c1ef52d1b813ea8b23a890fed.exe File renamed C:\Users\Admin\Pictures\ClearRemove.crw => C:\Users\Admin\Pictures\ClearRemove.crw.STG 697d752697c1045a0e55e90d6593fbd0bc66b49c1ef52d1b813ea8b23a890fed.exe File renamed C:\Users\Admin\Pictures\CopySwitch.crw => C:\Users\Admin\Pictures\CopySwitch.crw.STG 697d752697c1045a0e55e90d6593fbd0bc66b49c1ef52d1b813ea8b23a890fed.exe File opened for modification C:\Users\Admin\Pictures\EditDisconnect.tiff 697d752697c1045a0e55e90d6593fbd0bc66b49c1ef52d1b813ea8b23a890fed.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 697d752697c1045a0e55e90d6593fbd0bc66b49c1ef52d1b813ea8b23a890fed.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\697d752697c1045a0e55e90d6593fbd0bc66b49c1ef52d1b813ea8b23a890fed.exe" 697d752697c1045a0e55e90d6593fbd0bc66b49c1ef52d1b813ea8b23a890fed.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3928 1432 WerFault.exe 97 -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchApp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchApp.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe -
Modifies registry class 33 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "140" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "1576" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\www.bing.com SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "173" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Recognizers\\Tokens\\MS-1033-110-WINMO-DNN" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "173" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "140" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "1944" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "5770" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "2254" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "2254" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "5770" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "1576" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "1944" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "2254" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\MuiCache SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "140" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "1944" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "173" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "5770" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "1576" SearchApp.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3928 WerFault.exe 3928 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3836 svchost.exe Token: SeCreatePagefilePrivilege 3836 svchost.exe Token: SeShutdownPrivilege 3836 svchost.exe Token: SeCreatePagefilePrivilege 3836 svchost.exe Token: SeShutdownPrivilege 3836 svchost.exe Token: SeCreatePagefilePrivilege 3836 svchost.exe Token: SeSecurityPrivilege 948 TiWorker.exe Token: SeRestorePrivilege 948 TiWorker.exe Token: SeBackupPrivilege 948 TiWorker.exe Token: SeBackupPrivilege 948 TiWorker.exe Token: SeRestorePrivilege 948 TiWorker.exe Token: SeSecurityPrivilege 948 TiWorker.exe Token: SeBackupPrivilege 948 TiWorker.exe Token: SeRestorePrivilege 948 TiWorker.exe Token: SeSecurityPrivilege 948 TiWorker.exe Token: SeBackupPrivilege 948 TiWorker.exe Token: SeRestorePrivilege 948 TiWorker.exe Token: SeSecurityPrivilege 948 TiWorker.exe Token: SeBackupPrivilege 948 TiWorker.exe Token: SeRestorePrivilege 948 TiWorker.exe Token: SeSecurityPrivilege 948 TiWorker.exe Token: SeBackupPrivilege 948 TiWorker.exe Token: SeRestorePrivilege 948 TiWorker.exe Token: SeSecurityPrivilege 948 TiWorker.exe Token: SeBackupPrivilege 948 TiWorker.exe Token: SeRestorePrivilege 948 TiWorker.exe Token: SeSecurityPrivilege 948 TiWorker.exe Token: SeBackupPrivilege 948 TiWorker.exe Token: SeRestorePrivilege 948 TiWorker.exe Token: SeSecurityPrivilege 948 TiWorker.exe Token: SeBackupPrivilege 948 TiWorker.exe Token: SeRestorePrivilege 948 TiWorker.exe Token: SeSecurityPrivilege 948 TiWorker.exe Token: SeBackupPrivilege 948 TiWorker.exe Token: SeRestorePrivilege 948 TiWorker.exe Token: SeSecurityPrivilege 948 TiWorker.exe Token: SeBackupPrivilege 948 TiWorker.exe Token: SeRestorePrivilege 948 TiWorker.exe Token: SeSecurityPrivilege 948 TiWorker.exe Token: SeBackupPrivilege 948 TiWorker.exe Token: SeRestorePrivilege 948 TiWorker.exe Token: SeSecurityPrivilege 948 TiWorker.exe Token: SeBackupPrivilege 948 TiWorker.exe Token: SeRestorePrivilege 948 TiWorker.exe Token: SeSecurityPrivilege 948 TiWorker.exe Token: SeBackupPrivilege 948 TiWorker.exe Token: SeRestorePrivilege 948 TiWorker.exe Token: SeSecurityPrivilege 948 TiWorker.exe Token: SeBackupPrivilege 948 TiWorker.exe Token: SeRestorePrivilege 948 TiWorker.exe Token: SeSecurityPrivilege 948 TiWorker.exe Token: SeBackupPrivilege 948 TiWorker.exe Token: SeRestorePrivilege 948 TiWorker.exe Token: SeSecurityPrivilege 948 TiWorker.exe Token: SeBackupPrivilege 948 TiWorker.exe Token: SeRestorePrivilege 948 TiWorker.exe Token: SeSecurityPrivilege 948 TiWorker.exe Token: SeBackupPrivilege 948 TiWorker.exe Token: SeRestorePrivilege 948 TiWorker.exe Token: SeSecurityPrivilege 948 TiWorker.exe Token: SeBackupPrivilege 948 TiWorker.exe Token: SeRestorePrivilege 948 TiWorker.exe Token: SeSecurityPrivilege 948 TiWorker.exe Token: SeBackupPrivilege 948 TiWorker.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1432 SearchApp.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2244 wrote to memory of 1432 2244 WerFault.exe 97 PID 2244 wrote to memory of 1432 2244 WerFault.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\697d752697c1045a0e55e90d6593fbd0bc66b49c1ef52d1b813ea8b23a890fed.exe"C:\Users\Admin\AppData\Local\Temp\697d752697c1045a0e55e90d6593fbd0bc66b49c1ef52d1b813ea8b23a890fed.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
PID:3548
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3836
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1432 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1432 -s 45402⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:3928
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
PID:5064
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵PID:3412
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 204 -p 1432 -ip 14321⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:2244
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:948