Analysis
-
max time kernel
186s -
max time network
192s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
16-02-2022 22:58
Static task
static1
Behavioral task
behavioral1
Sample
5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe
-
Size
364KB
-
MD5
d7d5907195cda040a984062294fcdbd5
-
SHA1
ba52267c305ff9bc6f02fa9c5ebcb690ccb267eb
-
SHA256
5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18
-
SHA512
9871626b5f043583dc1f707386304d372a34734e03938d9f97d1ab3281be720ce3c1fed6b5bb78f5c24949fb6b18b5df8c57a456ac4c39bd7063579f1921b9b4
Score
10/10
Malware Config
Extracted
Path
C:\DECRYPT-FILES.txt
Family
maze
Ransom Note
Attention!
----------------------------
| What happened?
----------------------------
All your files, documents, photos, databases, and other important data are safely encrypted with reliable algorithms.
You cannot access the files right now. But do not worry. You have a chance! It is easy to recover in a few steps.
----------------------------
| How to get my files back?
----------------------------
The only method to restore your files is to purchase a unique for you private key which is securely stored on our servers.
To contact us and purchase the key you have to visit our website in a hidden TOR network.
There are general 2 ways to reach us:
1) [Recommended] Using hidden TOR network.
a) Download a special TOR browser: https://www.torproject.org/
b) Install the TOR Browser.
c) Open the TOR Browser.
d) Open our website in the TOR browser: http://aoacugmutagkwctu.onion/875c0983f44a92f
e) Follow the instructions on this page.
2) If you have any problems connecting or using TOR network
a) Open our website: https://mazedecrypt.top/875c0983f44a92f
b) Follow the instructions on this page.
Warning: the second (2) method can be blocked in some countries. That is why the first (1) method is recommended to use.
On this page, you will see instructions on how to make a free decryption test and how to pay.
Also it has a live chat with our operators and support team.
----------------------------
| What about guarantees?
----------------------------
We understand your stress and worry.
So you have a FREE opportunity to test a service by instantly decrypting for free three files on your computer!
If you have any problems our friendly support team is always here to assist you in a live chat!
-------------------------------------------------------------------------------
THIS IS A SPECIAL BLOCK WITH A PERSONAL AND CONFIDENTIAL INFORMATION! DO NOT TOUCH IT WE NEED IT TO IDENTIFY AND AUTHORIZE YOU
---BEGIN MAZE KEY---
j6wLXsxnN3xovaqrq3QyqYUPIFXqoH118x7eiupepWUR7uARF7h0LcPH0iLruAzM93P70clGBweIH4akwdOrYiE0SPa2NYq1XMgNA59b+eVFK5ZZsbktF1mxAhvmNQIrvw8mmXV6zrk8VgfO+2ZkFLKcu9X+NYVyjrPWkqj4qSY9v31OYV7oB2UvjftOpVHab/4b5mkEsVGQGsvWsvxhKZjESfvCd1+Dt0GthPwONSWLzPunmMrxn4kiwMR8hltsQbCCsxE/CF4qkzASdksBoI1+MF37s79bf5n/5NwAbx62Kbys30SoPFPQEu8tB9I9LCj8voUa/rvV+zcaEWXmfX0qs/qZn5QitQsItUmE3K4j1NOFbji03NjCuvpKM+KZYXyAMhjl+7TtsoBOOUsMLK2phEzBOkome7nNZLoGItX6iCMfL5nULch+np0csGsPovaOAZxiNCRKSwtkbp3+GrOONjf4qgtY2mC1vkGSN8ZJnCYzNIoXWxtzswXRwMcFXgPGIxK/++hN5/pN7EXAUlzNi82mHFXI0IKV+lj0Kj6RAN28GnztFkh13FJbz+cK+76U1gW2gKDroMHO4m39uS5oS/oo2pfVm8fdc827FtjD4Z8L+keiJRI+sW0a4RIDNiMS2dSNIe3p2H1W9pN5kU+hCFE6CdjU0YcddaaoZYx/OsH897jLUeRm8H234FLqngxrPYTB1h8pvw5qPkSveVaec9BMU1fKQctKPJuCI3QL0TMD5MZW9mbZ/8O4eYmYhFdQkW81r5Da5nQiw3940RASNVueuQQrr+z2RZnRxMqseEPsIGVzWhnXCiFh8KdX94m5TAcVM79IzN4QlogvZ4+NkeQS76DPv32iuLb5Lj819UidD//cEq81s5sMXtzZsl3HsgKB73RJoDKakVpakccBFKyn9LHqcR4oWkMk/6Wcmn1FpniEN8DwVsrc1wxcW4bl8SNyRYmH11fGQcpKehY1sYUIBp/9oFPQe0BbKDzZHJct+U/Vrh2vvpbI5xswqTvedur4MRElFR6PAsaM1prpIzjZKkqwWNJlc2mkpRVhDMkOT0zIAJ74/QyRSptjQTEEqCKjlnM/xCj2zalg9vSqDwuvNW/BOpOLEOl0mt+to4NeTjYACj6pDX4ghHdymkFifGAOcxb6fIZN08hq49+oTJ6CYo3RQp6R1Pxjg4Tq79RIc81cptBhf9X7I2bEEhSwDkseBhKhHk59Br+J7MNsVnfFS7M3vtLXFSd9Ud2Ubb162QCdvZw25VGWLyBQt9+0ZGyQ7FUdt42JUrH9ipe6/W5O59WwOXBEYwurueYINiCagnZCAoScvNyC9VwToxmB6mQqo3mknkPxo92UTiTTan9rR+89DYE4WhwOryZDku0pI6sVoPVLRFLx+ml/Iksw0q80+mx89gTW19eeT1oK2X/ia9Ejj1QWgJ6eeQdi/xz9AL7GQCf14p5PM+M24dKjDoFA8rOoG5oZR8cl+YL9YGV88uhW3Tn5nYd9o5GoRI9YV7qstJG2lx//No/oW/20ViheICaR8dGuw4b6zCqaz9FlwGrfa066Gty8Pk92rGdnu9vM/reDZpIQhzvppSTDJOU0lxNYutNShLCG3tnrMKc/P2Bw/hfLYh/hUl+duDEwpce7vvXm9aKHYl9GnXzFEaGBxqCB2KS5sIkpIpYp5YIyER8sQzZAWwBrspKYDr22B85ff202MTk+8GArcvNiZ64C3OTd8VxrdKXjnRCQ8hLYJ5uang5ZqW11sIYwEDXzB1HvojNy6HvctghV7ly4vn5IjMEI12fA0qJL10sDF/1X/o9GLFDOPD2zLi6LNF6MiZFeC/Ro/EDZGCru66Rgff44jMAVWOQyDH0iOXOjBu8cICu+31rqvC8naXgUj2GCQ2TS3jfBuOwQ60H97+k2d9TODLn9As1NRWAGPyqyHLzcoO9ZETd/Q19bzWblvc8H61e92YUZOLfUHWp/ux/YOoOX+Nj6OLqqMUKtClKzUr9JeHHf4aIE21qytSjym9ulndSCTFf3c+nP2kDR4nMZhnDHx5Q5l8iXXmZ/TPhl4+eQ3v8BM3oGX28Hty4buuE3MaztcH4z5IrUTdu9N2k7ePbO8DqKCcmtMH3Fmi5J9G0FEsbxTbJ1UmLCa+1+yiz+C0l02RzkXP8zxO9rRUYFcfxL2NkivLdKEy6N9TY0RJCtDYpJZYSJq10BKYERKe6ICkLaVclPUa5moNfCWXvlLQogOAA3ADUAYwAwADkAOAAzAGYANAA0AGEAOQAyAGYAAAAQgGAaDEEAZABtAGkAbgAAACISUgBJAEIAQwBRAFUASABRAAAAKgxuAG8AbgBlAHwAAAAyLFcAaQBuAGQAbwB3AHMAIAAxADAAIABFAG4AdABlAHIAcAByAGkAcwBlAAAAQjZ8AEMAXwBGAF8AMgAwADQAOAAyAC8AMgA2ADEAOAA0ADEAfABEAF8AVQBfADAALwAwAHwAAABIAFBAWIkIYIkIaIkIcLbPvQ54DYABAooBBTIuMS4x
---END MAZE KEY---
URLs
http://aoacugmutagkwctu.onion/875c0983f44a92f
https://mazedecrypt.top/875c0983f44a92f
Signatures
-
Maze
Ransomware family also known as ChaCha.
-
Drops file in Program Files directory 38 IoCs
Processes:
5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exedescription ioc Process File opened for modification C:\Program Files\DebugJoin.zip 5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe File opened for modification C:\Program Files\FindUninstall.MTS 5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe File opened for modification C:\Program Files\StepFind.m1v 5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe File opened for modification C:\Program Files\GroupClose.cfg 5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe File opened for modification C:\Program Files\MountExport.001 5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe File opened for modification C:\Program Files (x86)\875c0983f44a92f.tmp 5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe File opened for modification C:\Program Files\ApprovePing.ico 5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe File opened for modification C:\Program Files\SplitApprove.avi 5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe File opened for modification C:\Program Files\TraceUnblock.m4v 5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe File opened for modification C:\Program Files\CompareProtect.3gp2 5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe File opened for modification C:\Program Files\ConvertUninstall.jfif 5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe File opened for modification C:\Program Files\DisconnectUse.ps1 5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe File opened for modification C:\Program Files\ResolveConvertFrom.pub 5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe File opened for modification C:\Program Files\ShowInstall.ps1 5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe File opened for modification C:\Program Files\875c0983f44a92f.tmp 5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe File opened for modification C:\Program Files\BackupWait.shtml 5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe File opened for modification C:\Program Files\DisableInstall.jpeg 5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe File opened for modification C:\Program Files\SplitPing.vsw 5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe File opened for modification C:\Program Files\StepEnable.gif 5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe File created C:\Program Files\DECRYPT-FILES.txt 5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe File opened for modification C:\Program Files\InstallSave.vssx 5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe File opened for modification C:\Program Files\WaitGet.m1v 5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe File opened for modification C:\Program Files\StepWait.docm 5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe File opened for modification C:\Program Files\WatchPush.jpg 5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe File opened for modification C:\Program Files\DisconnectWrite.xps 5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe File opened for modification C:\Program Files\OpenWatch.htm 5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe File opened for modification C:\Program Files\ReadDisable.ttc 5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe File opened for modification C:\Program Files\RenameSwitch.ppt 5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe File opened for modification C:\Program Files\SkipCompare.au 5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe File opened for modification C:\Program Files\StepUnprotect.clr 5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe File opened for modification C:\Program Files\StopSave.TS 5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe File created C:\Program Files (x86)\DECRYPT-FILES.txt 5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe File opened for modification C:\Program Files\AssertSet.ps1xml 5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe File opened for modification C:\Program Files\BlockEnable.eps 5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe File opened for modification C:\Program Files\CompressImport.iso 5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe File opened for modification C:\Program Files\ConnectPublish.gif 5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe File opened for modification C:\Program Files\FormatPing.nfo 5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe File opened for modification C:\Program Files\NewDeny.tmp 5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe -
Drops file in Windows directory 2 IoCs
Processes:
svchost.exeTiWorker.exedescription ioc Process File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe -
Modifies data under HKEY_USERS 49 IoCs
Processes:
svchost.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132897026788247646" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.173913" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.646554" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "9.999782" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4136" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4376" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exepid Process 832 5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe 832 5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
vssvc.exeTiWorker.exedescription pid Process Token: SeBackupPrivilege 2624 vssvc.exe Token: SeRestorePrivilege 2624 vssvc.exe Token: SeAuditPrivilege 2624 vssvc.exe Token: SeSecurityPrivilege 3936 TiWorker.exe Token: SeRestorePrivilege 3936 TiWorker.exe Token: SeBackupPrivilege 3936 TiWorker.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe"C:\Users\Admin\AppData\Local\Temp\5acbcc1df967d37bf86e429030c9c8ad43e84c8ec5d74bfe3737816c74994c18.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:832
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2624
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2568
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3936