Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
16/02/2022, 03:03
Static task
static1
Behavioral task
behavioral1
Sample
Bakuras.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target Bakuras.exe
- Size 295KB
- Sample220216-dj2bxabca5
- SHA256 9ceceb144ec9613aaef8b7e653711623f17e6e983abd50f5c47fda97f87e9549
- MD5 39ee14723774e66da455a4e612c90b96
- SHA1 e23d5d7df46ebb0df805d5263cf9f2f96ddcb82f
- SHA512 854d1a2088c175964edffeb0aa170167ba759c397b83ad850c1e1d382ef0d0aae62a2804b6bec2ede1bc4be9bf6fb28886e1adf5e35d1cd2e7fefc65424a0b17
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
Version
-
4.1
Campaign
-
b1s5
Decoy
-
stockdistance100.com
-
bit-latino.com
-
paradimetempest.com
-
budgetmdfdoors.com
-
huacadao.com
-
rezcoat.online
-
p1122.com
-
tongtaigj.com
-
gashouseweeds.com
-
statewide-inspections.com
-
fan1234.com
-
shishang.show
-
metaplumbers.xyz
-
yaojiaoks.com
-
sowiesoverzekerd.site
-
navifoil.com
-
goodlandfabrics.com
-
leongeo.com
-
happy-planet.space
-
inproinfra.com
-
siegeofjerusalem70ce.com
-
33y319.com
-
audittheofficial.net
-
edezaflores.com
-
gameofstones.info
-
yuanchengjob.com
-
otfextk.com
-
pf9w3t.com
-
myshop-document.com
-
playism.xyz
-
futuremoney.asia
-
dyrinelcom.com
-
ilu2.store
-
h2prf.com
-
metaversemediastream.com
-
dccannabisfestival.com
-
vajqd.icu
-
mvb2d1.store
-
bean.info
-
drjalili.com
-
berliner-sektfestival.com
-
kas-assets.net
-
defokai.com
-
soundcheer.com
-
yxpha8288.club
-
matthewcremeens.com
-
agoraretailco.com
-
ipotick.com
-
babycollectionz.com
-
myselecthomesac.com
-
cityofokean.com
-
radiochaffd.xyz
-
yearnewg5.tech
-
facebookviolationpolicy.com
-
27266.xyz
-
shopnewclothes.com
-
innovacond.com
-
magnoliabygigi.com
-
adeptus-astartes.net
-
pusceddu.online
-
laramie247.com
-
to-mag.com
-
kfnlaw.online
-
multiversesearchengine.com
-
tg-vulcsite.top
Signatures
- Formbook Payload 2 IoCs
resource yara_rule behavioral2/memory/1448-134-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1980-142-0x0000000002F00000-0x0000000002F2F000-memory.dmp formbook - Executes dropped EXE 2 IoCs
pid Process 2888 lmdbldip.exe 1448 lmdbldip.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2888 set thread context of 1448 2888 lmdbldip.exe 62 PID 1448 set thread context of 2460 1448 lmdbldip.exe 34 PID 1980 set thread context of 2460 1980 colorcpl.exe 34 - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe - Modifies data under HKEY_USERS 52 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "24.978738" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "2.106883" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "10.713992" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132896305967353949" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4132" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4324" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4108" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4328" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.006600" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe - Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 1448 lmdbldip.exe 1448 lmdbldip.exe 1448 lmdbldip.exe 1448 lmdbldip.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe 1980 colorcpl.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2460 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1448 lmdbldip.exe 1448 lmdbldip.exe 1448 lmdbldip.exe 1980 colorcpl.exe 1980 colorcpl.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1448 lmdbldip.exe Token: SeDebugPrivilege 1980 colorcpl.exe Token: SeSecurityPrivilege 3040 TiWorker.exe Token: SeRestorePrivilege 3040 TiWorker.exe Token: SeBackupPrivilege 3040 TiWorker.exe Token: SeBackupPrivilege 3040 TiWorker.exe Token: SeRestorePrivilege 3040 TiWorker.exe Token: SeSecurityPrivilege 3040 TiWorker.exe Token: SeBackupPrivilege 3040 TiWorker.exe Token: SeRestorePrivilege 3040 TiWorker.exe Token: SeSecurityPrivilege 3040 TiWorker.exe Token: SeBackupPrivilege 3040 TiWorker.exe Token: SeRestorePrivilege 3040 TiWorker.exe Token: SeSecurityPrivilege 3040 TiWorker.exe Token: SeBackupPrivilege 3040 TiWorker.exe Token: SeRestorePrivilege 3040 TiWorker.exe Token: SeSecurityPrivilege 3040 TiWorker.exe Token: SeBackupPrivilege 3040 TiWorker.exe Token: SeRestorePrivilege 3040 TiWorker.exe Token: SeSecurityPrivilege 3040 TiWorker.exe Token: SeBackupPrivilege 3040 TiWorker.exe Token: SeRestorePrivilege 3040 TiWorker.exe Token: SeSecurityPrivilege 3040 TiWorker.exe Token: SeBackupPrivilege 3040 TiWorker.exe Token: SeRestorePrivilege 3040 TiWorker.exe Token: SeSecurityPrivilege 3040 TiWorker.exe Token: SeBackupPrivilege 3040 TiWorker.exe Token: SeRestorePrivilege 3040 TiWorker.exe Token: SeSecurityPrivilege 3040 TiWorker.exe Token: SeBackupPrivilege 3040 TiWorker.exe Token: SeRestorePrivilege 3040 TiWorker.exe Token: SeSecurityPrivilege 3040 TiWorker.exe Token: SeBackupPrivilege 3040 TiWorker.exe Token: SeRestorePrivilege 3040 TiWorker.exe Token: SeSecurityPrivilege 3040 TiWorker.exe Token: SeBackupPrivilege 3040 TiWorker.exe Token: SeRestorePrivilege 3040 TiWorker.exe Token: SeSecurityPrivilege 3040 TiWorker.exe Token: SeBackupPrivilege 3040 TiWorker.exe Token: SeRestorePrivilege 3040 TiWorker.exe Token: SeSecurityPrivilege 3040 TiWorker.exe Token: SeBackupPrivilege 3040 TiWorker.exe Token: SeRestorePrivilege 3040 TiWorker.exe Token: SeSecurityPrivilege 3040 TiWorker.exe Token: SeBackupPrivilege 3040 TiWorker.exe Token: SeRestorePrivilege 3040 TiWorker.exe Token: SeSecurityPrivilege 3040 TiWorker.exe Token: SeBackupPrivilege 3040 TiWorker.exe Token: SeRestorePrivilege 3040 TiWorker.exe Token: SeSecurityPrivilege 3040 TiWorker.exe Token: SeBackupPrivilege 3040 TiWorker.exe Token: SeRestorePrivilege 3040 TiWorker.exe Token: SeSecurityPrivilege 3040 TiWorker.exe Token: SeBackupPrivilege 3040 TiWorker.exe Token: SeRestorePrivilege 3040 TiWorker.exe Token: SeSecurityPrivilege 3040 TiWorker.exe Token: SeBackupPrivilege 3040 TiWorker.exe Token: SeRestorePrivilege 3040 TiWorker.exe Token: SeSecurityPrivilege 3040 TiWorker.exe Token: SeBackupPrivilege 3040 TiWorker.exe Token: SeRestorePrivilege 3040 TiWorker.exe Token: SeSecurityPrivilege 3040 TiWorker.exe Token: SeBackupPrivilege 3040 TiWorker.exe Token: SeRestorePrivilege 3040 TiWorker.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3976 wrote to memory of 2888 3976 Bakuras.exe 59 PID 3976 wrote to memory of 2888 3976 Bakuras.exe 59 PID 3976 wrote to memory of 2888 3976 Bakuras.exe 59 PID 2888 wrote to memory of 1448 2888 lmdbldip.exe 62 PID 2888 wrote to memory of 1448 2888 lmdbldip.exe 62 PID 2888 wrote to memory of 1448 2888 lmdbldip.exe 62 PID 2888 wrote to memory of 1448 2888 lmdbldip.exe 62 PID 2888 wrote to memory of 1448 2888 lmdbldip.exe 62 PID 2888 wrote to memory of 1448 2888 lmdbldip.exe 62 PID 2460 wrote to memory of 1980 2460 Explorer.EXE 64 PID 2460 wrote to memory of 1980 2460 Explorer.EXE 64 PID 2460 wrote to memory of 1980 2460 Explorer.EXE 64 PID 1980 wrote to memory of 460 1980 colorcpl.exe 68 PID 1980 wrote to memory of 460 1980 colorcpl.exe 68 PID 1980 wrote to memory of 460 1980 colorcpl.exe 68
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\Bakuras.exe"C:\Users\Admin\AppData\Local\Temp\Bakuras.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\lmdbldip.exeC:\Users\Admin\AppData\Local\Temp\lmdbldip.exe C:\Users\Admin\AppData\Local\Temp\vsoyu3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\lmdbldip.exeC:\Users\Admin\AppData\Local\Temp\lmdbldip.exe C:\Users\Admin\AppData\Local\Temp\vsoyu4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1448
-
-
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:1244
-
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\lmdbldip.exe"3⤵PID:460
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1308
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:3016
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3040