Resubmissions
19/02/2022, 05:11
220219-fvblqshbep1017/02/2022, 18:40
220217-xbmckadbe51017/02/2022, 18:30
220217-w5he2aebek10Analysis
- max time kernel
170s - max time network
180s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
17/02/2022, 18:30
Static task
static1
Behavioral task
behavioral1
Sample
48dd5584cf3d6c0930f09e335d98d4fd.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target 48dd5584cf3d6c0930f09e335d98d4fd.exe
- Size 294KB
- Sample220217-w5he2aebek
- SHA256 22d5552fed81b606509972d3c12830cd2cfcd77ec68a8791706099e97b2c1bad
- MD5 48dd5584cf3d6c0930f09e335d98d4fd
- SHA1 a072e576904888726dda9ad1c61673492cd72eae
- SHA512 95492bb4e2a9f51f5ff547d2b7e534787cac49d7004a146bdf3df01d7f22f478a7f89f19f1fb411487d8b58b153223e093db44fc6441696091302459d6c3b9e9
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
xloader
Version
-
2.5
Campaign
-
t9hh
Decoy
-
mine.vin
-
terpenebase.com
-
potomarket.com
-
lmaproshop.com
-
multitecsd.com
-
vacationrentalsct.com
-
france-gravure.com
-
schoolq8.com
-
caravan777.com
-
mimtgexpert.com
-
animesomurie.com
-
buscalogps.online
-
legionstudio.net
-
pdam.top
-
galapaleso.quest
-
gulfweeks.com
-
sedonasuperfit.online
-
arab-xt-pro.com
-
fifeapartment.com
-
pitchgiving.com
-
ebonyassworship.com
-
rrrl.space
-
souscription-ingdiba-ag.com
-
778tt8.com
-
karistell.com
-
novasaudeg1.online
-
nobis.care
-
weirdwoman.info
-
pet-field.com
-
vnpt66-it.com
-
manyi-pcsc.biz
-
bodillion.com
-
ishirmansingh.com
-
arrowsmarthr.net
-
waszom.com
-
boundlessbeliefs.com
-
sangs.info
-
encominate.com
-
bellesonbroadway.net
-
golfbombs.store
-
themerchplug.com
-
garethjame.biz
-
lamaisondesmamans.com
-
gutimautpribuinropgroup.com
-
kurzundklar.com
-
pinpointmarket.com
-
royalprestigehospitality.com
-
dunnfamily.party
-
nystmail.com
-
pconsciousness.com
-
matranutricion.com
-
themagneticpro.com
-
earches3.com
-
lostformailtoyof2.xyz
-
battletabs.xyz
-
spotondigitalsolutions.com
-
blinglj.com
-
priceonpole.com
-
dobsonfryedentist.com
-
maktabeahlesunnat.com
-
mcr-llc.com
-
lens-experts.com
-
thgn38.xyz
-
mciedalu.com
-
stichmarketing.com
Signatures
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 2 IoCs
resource yara_rule behavioral2/memory/3868-134-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1776-142-0x00000000006D0000-0x00000000006F9000-memory.dmp xloader - Executes dropped EXE 2 IoCs
pid Process 1800 tgfxcasyy.exe 3868 tgfxcasyy.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iammtbe = "C:\\Users\\Admin\\AppData\\Roaming\\xtkswrblrgwrif\\jbifouiq.exe" tgfxcasyy.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1800 set thread context of 3868 1800 tgfxcasyy.exe 69 PID 3868 set thread context of 2436 3868 tgfxcasyy.exe 31 PID 1776 set thread context of 2436 1776 mstsc.exe 31 - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe - Modifies data under HKEY_USERS 52 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4308" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132897726995326193" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "4" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "1157726" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "7.894537" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "90228624" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.000000" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" svchost.exe - Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 3868 tgfxcasyy.exe 3868 tgfxcasyy.exe 3868 tgfxcasyy.exe 3868 tgfxcasyy.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe 1776 mstsc.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2436 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 3868 tgfxcasyy.exe 3868 tgfxcasyy.exe 3868 tgfxcasyy.exe 1776 mstsc.exe 1776 mstsc.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3868 tgfxcasyy.exe Token: SeDebugPrivilege 1776 mstsc.exe Token: SeSecurityPrivilege 520 TiWorker.exe Token: SeRestorePrivilege 520 TiWorker.exe Token: SeBackupPrivilege 520 TiWorker.exe Token: SeBackupPrivilege 520 TiWorker.exe Token: SeRestorePrivilege 520 TiWorker.exe Token: SeSecurityPrivilege 520 TiWorker.exe Token: SeBackupPrivilege 520 TiWorker.exe Token: SeRestorePrivilege 520 TiWorker.exe Token: SeSecurityPrivilege 520 TiWorker.exe Token: SeBackupPrivilege 520 TiWorker.exe Token: SeRestorePrivilege 520 TiWorker.exe Token: SeSecurityPrivilege 520 TiWorker.exe Token: SeBackupPrivilege 520 TiWorker.exe Token: SeRestorePrivilege 520 TiWorker.exe Token: SeSecurityPrivilege 520 TiWorker.exe Token: SeBackupPrivilege 520 TiWorker.exe Token: SeRestorePrivilege 520 TiWorker.exe Token: SeSecurityPrivilege 520 TiWorker.exe Token: SeBackupPrivilege 520 TiWorker.exe Token: SeRestorePrivilege 520 TiWorker.exe Token: SeSecurityPrivilege 520 TiWorker.exe Token: SeBackupPrivilege 520 TiWorker.exe Token: SeRestorePrivilege 520 TiWorker.exe Token: SeSecurityPrivilege 520 TiWorker.exe Token: SeBackupPrivilege 520 TiWorker.exe Token: SeRestorePrivilege 520 TiWorker.exe Token: SeSecurityPrivilege 520 TiWorker.exe Token: SeBackupPrivilege 520 TiWorker.exe Token: SeRestorePrivilege 520 TiWorker.exe Token: SeSecurityPrivilege 520 TiWorker.exe Token: SeBackupPrivilege 520 TiWorker.exe Token: SeRestorePrivilege 520 TiWorker.exe Token: SeSecurityPrivilege 520 TiWorker.exe Token: SeBackupPrivilege 520 TiWorker.exe Token: SeRestorePrivilege 520 TiWorker.exe Token: SeSecurityPrivilege 520 TiWorker.exe Token: SeBackupPrivilege 520 TiWorker.exe Token: SeRestorePrivilege 520 TiWorker.exe Token: SeSecurityPrivilege 520 TiWorker.exe Token: SeBackupPrivilege 520 TiWorker.exe Token: SeRestorePrivilege 520 TiWorker.exe Token: SeSecurityPrivilege 520 TiWorker.exe Token: SeBackupPrivilege 520 TiWorker.exe Token: SeRestorePrivilege 520 TiWorker.exe Token: SeSecurityPrivilege 520 TiWorker.exe Token: SeBackupPrivilege 520 TiWorker.exe Token: SeRestorePrivilege 520 TiWorker.exe Token: SeSecurityPrivilege 520 TiWorker.exe Token: SeBackupPrivilege 520 TiWorker.exe Token: SeRestorePrivilege 520 TiWorker.exe Token: SeSecurityPrivilege 520 TiWorker.exe Token: SeBackupPrivilege 520 TiWorker.exe Token: SeRestorePrivilege 520 TiWorker.exe Token: SeSecurityPrivilege 520 TiWorker.exe Token: SeBackupPrivilege 520 TiWorker.exe Token: SeRestorePrivilege 520 TiWorker.exe Token: SeSecurityPrivilege 520 TiWorker.exe Token: SeBackupPrivilege 520 TiWorker.exe Token: SeRestorePrivilege 520 TiWorker.exe Token: SeSecurityPrivilege 520 TiWorker.exe Token: SeBackupPrivilege 520 TiWorker.exe Token: SeRestorePrivilege 520 TiWorker.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1920 wrote to memory of 1800 1920 48dd5584cf3d6c0930f09e335d98d4fd.exe 65 PID 1920 wrote to memory of 1800 1920 48dd5584cf3d6c0930f09e335d98d4fd.exe 65 PID 1920 wrote to memory of 1800 1920 48dd5584cf3d6c0930f09e335d98d4fd.exe 65 PID 1800 wrote to memory of 3868 1800 tgfxcasyy.exe 69 PID 1800 wrote to memory of 3868 1800 tgfxcasyy.exe 69 PID 1800 wrote to memory of 3868 1800 tgfxcasyy.exe 69 PID 1800 wrote to memory of 3868 1800 tgfxcasyy.exe 69 PID 1800 wrote to memory of 3868 1800 tgfxcasyy.exe 69 PID 1800 wrote to memory of 3868 1800 tgfxcasyy.exe 69 PID 2436 wrote to memory of 1776 2436 Explorer.EXE 70 PID 2436 wrote to memory of 1776 2436 Explorer.EXE 70 PID 2436 wrote to memory of 1776 2436 Explorer.EXE 70
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\48dd5584cf3d6c0930f09e335d98d4fd.exe"C:\Users\Admin\AppData\Local\Temp\48dd5584cf3d6c0930f09e335d98d4fd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\tgfxcasyy.exeC:\Users\Admin\AppData\Local\Temp\tgfxcasyy.exe C:\Users\Admin\AppData\Local\Temp\venuwk3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\tgfxcasyy.exeC:\Users\Admin\AppData\Local\Temp\tgfxcasyy.exe C:\Users\Admin\AppData\Local\Temp\venuwk4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3868
-
-
-
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1776
-
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:636
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1044
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:520