formbook | c0255201237bfaac3d1396aa62c0277631f9ccbae295de89e71b504a1373002a

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
16/02/2022, 09:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
INV-DHL202038.exe
Size 424KB
Sample220216-kyb4wsbec7
SHA256 c0255201237bfaac3d1396aa62c0277631f9ccbae295de89e71b504a1373002a
MD5 4c0b272dd02c5122e1d8656ef6df3f4a
SHA1 2f1486fcac72c3577669c104890e100ea5a9a419
SHA512 b95d1cf9a7847459f0c612890cc9486f27fda6cfcd4c7f4867cd5cd03b119fcc36c0f6d7f7a53b7d5581734268e42e141368ced40368c17b5ea2bc7672a91471
MD5 SHA1 SHA512

Score

10^/10

formbook cn31 rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

cn31

Decoy

jdklawnmaintenance.com
honshukensetsu.com
physicsengineering.com
xs.business
carrierguard.net
glasses-shop.online
fwqim.icu
drmoedavirtual.com
mindmedicine.institute
pe9dze.site
domise.xyz
appaloosa.design
msiems.info
wersling.com
proeasyit.com
mercatelectric.com
utahtitle9lawyer.com
happi-lyfe.com
miamihumanfactor.com
14239765.club
clientes-24h-numero.site
dienst-zimmer.com
agpfincorp.com
opulencephysique.com
newlifelaundrydrycleaner.com
lilymelrosebook.com
promotionalverse.com
pmsecintl.com
lambers-associates.com
astrologerduniya.com
support-findmys.com
ruilameng.com
maj1d.com
thelabbuilt.com
headmana.com
zhuo360.com
granitick.com
bankofavalanche.com
fishdatessecured.com
gasinvest.digital
gorillagraphic.com
55r3d.tech
chicagocarelab.com
angelosdelicatessen.com
blacklovepledge.info
biennegarden.com
businesscreditph.com
infoatsite.com
gazinst.com
flowertubs.com
platformdigi.com
puckergallerys.com
locindo.com
88wwyy.com
hexlights2.com
loop-breaker.com
restaurantesentollas.com
kucoins-wo.online
cn6.email
xxbyqt.icu
daljrepairs.com
sanchuanwu.com
marigarage.com
appartd.com
nodet.icu

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook Payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/3728-134-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/1096-142-0x0000000000380000-0x00000000003AF000-memory.dmp	formbook

Executes dropped EXE 2 IoCs

pid	Process
1368	qmukbw.exe
3728	qmukbw.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1368 set thread context of 3728	1368	qmukbw.exe	63
PID 3728 set thread context of 2444	3728	qmukbw.exe	35
PID 1096 set thread context of 2444	1096	mstsc.exe	35

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat	svchost.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\WinSxS\pending.xml	TiWorker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotifyIcon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotifyIcon.exe

Modifies data under HKEY_USERS 51 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.000000"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.006561"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "4.255247"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4024"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "8.823971"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4156"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4348"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132896520238793164"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0"	svchost.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
3728	qmukbw.exe
3728	qmukbw.exe
3728	qmukbw.exe
3728	qmukbw.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe
1096	mstsc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2444	Explorer.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
3728	qmukbw.exe
3728	qmukbw.exe
3728	qmukbw.exe
1096	mstsc.exe
1096	mstsc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3728	qmukbw.exe
Token: SeDebugPrivilege	1096	mstsc.exe
Token: SeSecurityPrivilege	3144	TiWorker.exe
Token: SeRestorePrivilege	3144	TiWorker.exe
Token: SeBackupPrivilege	3144	TiWorker.exe
Token: SeBackupPrivilege	3144	TiWorker.exe
Token: SeRestorePrivilege	3144	TiWorker.exe
Token: SeSecurityPrivilege	3144	TiWorker.exe
Token: SeBackupPrivilege	3144	TiWorker.exe
Token: SeRestorePrivilege	3144	TiWorker.exe
Token: SeSecurityPrivilege	3144	TiWorker.exe
Token: SeBackupPrivilege	3144	TiWorker.exe
Token: SeRestorePrivilege	3144	TiWorker.exe
Token: SeSecurityPrivilege	3144	TiWorker.exe
Token: SeBackupPrivilege	3144	TiWorker.exe
Token: SeRestorePrivilege	3144	TiWorker.exe
Token: SeSecurityPrivilege	3144	TiWorker.exe
Token: SeBackupPrivilege	3144	TiWorker.exe
Token: SeRestorePrivilege	3144	TiWorker.exe
Token: SeSecurityPrivilege	3144	TiWorker.exe
Token: SeBackupPrivilege	3144	TiWorker.exe
Token: SeRestorePrivilege	3144	TiWorker.exe
Token: SeSecurityPrivilege	3144	TiWorker.exe
Token: SeBackupPrivilege	3144	TiWorker.exe
Token: SeRestorePrivilege	3144	TiWorker.exe
Token: SeSecurityPrivilege	3144	TiWorker.exe
Token: SeBackupPrivilege	3144	TiWorker.exe
Token: SeRestorePrivilege	3144	TiWorker.exe
Token: SeSecurityPrivilege	3144	TiWorker.exe
Token: SeBackupPrivilege	3144	TiWorker.exe
Token: SeRestorePrivilege	3144	TiWorker.exe
Token: SeSecurityPrivilege	3144	TiWorker.exe
Token: SeBackupPrivilege	3144	TiWorker.exe
Token: SeRestorePrivilege	3144	TiWorker.exe
Token: SeSecurityPrivilege	3144	TiWorker.exe
Token: SeBackupPrivilege	3144	TiWorker.exe
Token: SeRestorePrivilege	3144	TiWorker.exe
Token: SeSecurityPrivilege	3144	TiWorker.exe
Token: SeBackupPrivilege	3144	TiWorker.exe
Token: SeRestorePrivilege	3144	TiWorker.exe
Token: SeSecurityPrivilege	3144	TiWorker.exe
Token: SeBackupPrivilege	3144	TiWorker.exe
Token: SeRestorePrivilege	3144	TiWorker.exe
Token: SeSecurityPrivilege	3144	TiWorker.exe
Token: SeBackupPrivilege	3144	TiWorker.exe
Token: SeRestorePrivilege	3144	TiWorker.exe
Token: SeSecurityPrivilege	3144	TiWorker.exe
Token: SeBackupPrivilege	3144	TiWorker.exe
Token: SeRestorePrivilege	3144	TiWorker.exe
Token: SeSecurityPrivilege	3144	TiWorker.exe
Token: SeBackupPrivilege	3144	TiWorker.exe
Token: SeRestorePrivilege	3144	TiWorker.exe
Token: SeSecurityPrivilege	3144	TiWorker.exe
Token: SeBackupPrivilege	3144	TiWorker.exe
Token: SeRestorePrivilege	3144	TiWorker.exe
Token: SeSecurityPrivilege	3144	TiWorker.exe
Token: SeBackupPrivilege	3144	TiWorker.exe
Token: SeRestorePrivilege	3144	TiWorker.exe
Token: SeSecurityPrivilege	3144	TiWorker.exe
Token: SeBackupPrivilege	3144	TiWorker.exe
Token: SeRestorePrivilege	3144	TiWorker.exe
Token: SeSecurityPrivilege	3144	TiWorker.exe
Token: SeBackupPrivilege	3144	TiWorker.exe
Token: SeRestorePrivilege	3144	TiWorker.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3792 wrote to memory of 1368	3792	INV-DHL202038.exe	61
PID 3792 wrote to memory of 1368	3792	INV-DHL202038.exe	61
PID 3792 wrote to memory of 1368	3792	INV-DHL202038.exe	61
PID 1368 wrote to memory of 3728	1368	qmukbw.exe	63
PID 1368 wrote to memory of 3728	1368	qmukbw.exe	63
PID 1368 wrote to memory of 3728	1368	qmukbw.exe	63
PID 1368 wrote to memory of 3728	1368	qmukbw.exe	63
PID 1368 wrote to memory of 3728	1368	qmukbw.exe	63
PID 1368 wrote to memory of 3728	1368	qmukbw.exe	63
PID 2444 wrote to memory of 1096	2444	Explorer.EXE	66
PID 2444 wrote to memory of 1096	2444	Explorer.EXE	66
PID 2444 wrote to memory of 1096	2444	Explorer.EXE	66
PID 1096 wrote to memory of 2344	1096	mstsc.exe	68
PID 1096 wrote to memory of 2344	1096	mstsc.exe	68
PID 1096 wrote to memory of 2344	1096	mstsc.exe	68

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Users\Admin\AppData\Local\Temp\INV-DHL202038.exe
  "C:\Users\Admin\AppData\Local\Temp\INV-DHL202038.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3792
- - C:\Users\Admin\AppData\Local\Temp\qmukbw.exe
    C:\Users\Admin\AppData\Local\Temp\qmukbw.exe C:\Users\Admin\AppData\Local\Temp\cvkzbsi
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1368
  - - C:\Users\Admin\AppData\Local\Temp\qmukbw.exe
      C:\Users\Admin\AppData\Local\Temp\qmukbw.exe C:\Users\Admin\AppData\Local\Temp\cvkzbsi
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:3728
- C:\Windows\SysWOW64\mstsc.exe
  "C:\Windows\SysWOW64\mstsc.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1096
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\qmukbw.exe"
    3⤵
    PID:2344

C:\Windows\system32\MusNotifyIcon.exe
%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
1⤵
- Checks processor information in registry
PID:2484

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:3556

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3144

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1096-144-0x0000000004520000-0x00000000045B3000-memory.dmp

Download

memory/1096-143-0x00000000047E0000-0x0000000004B2A000-memory.dmp

Download

memory/1096-142-0x0000000000380000-0x00000000003AF000-memory.dmp

Download

memory/1096-141-0x0000000000870000-0x00000000009AA000-memory.dmp

Download

memory/2444-140-0x0000000008740000-0x000000000881A000-memory.dmp

Download

memory/2444-145-0x00000000089C0000-0x0000000008B28000-memory.dmp

Download

memory/3728-139-0x0000000001880000-0x0000000001894000-memory.dmp

Download

memory/3728-138-0x000000000041F000-0x0000000000420000-memory.dmp

Download

memory/3728-137-0x0000000001430000-0x000000000177A000-memory.dmp

Download

memory/3728-134-0x0000000000400000-0x000000000042F000-memory.dmp

Download