Analysis
- max time kernel
160s - max time network
171s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
18/02/2022, 08:14
Static task
static1
Behavioral task
behavioral1
Sample
42ccd61f1357d37d8c439082e195eed6eb0d3a6b060852ce57161b469919f778.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target 42ccd61f1357d37d8c439082e195eed6eb0d3a6b060852ce57161b469919f778.exe
- Size 122.5MB
- Sample220218-j5f6radbep
- SHA256 42ccd61f1357d37d8c439082e195eed6eb0d3a6b060852ce57161b469919f778
- MD5 c893af41e33ca5da0a8acf8ac623c2ae
- SHA1 65412f1aa3839e41a00adc2ebc7162880c258be7
- SHA512 20474b4ab6e85a7b33d544a5f8cdb5d6b03b86ee67b07a54a17ee6358d51abdcd0711a78999fceb83f971590707c62941f0d2c5d18abc1c091694ea29ceb517f
- MD5 SHA1 SHA512
Malware Config
Signatures
- Babadeda Crypter 2 IoCs
resource yara_rule behavioral2/files/0x00080000000220d8-167.dat family_babadeda behavioral2/memory/4012-200-0x0000000008130000-0x000000000D230000-memory.dmp family_babadeda - Blocklisted process makes network request 1 IoCs
flow pid Process 37 488 msiexec.exe - Executes dropped EXE 1 IoCs
pid Process 4012 iisexpress.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation 42ccd61f1357d37d8c439082e195eed6eb0d3a6b060852ce57161b469919f778.exe - Loads dropped DLL 53 IoCs
pid Process 3096 MsiExec.exe 3096 MsiExec.exe 3096 MsiExec.exe 3096 MsiExec.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe 4012 iisexpress.exe - Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe - Drops file in Windows directory 14 IoCs
description ioc Process File created C:\Windows\Installer\1cdec71.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIF72F.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIFB0A.tmp msiexec.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\Installer\1cdec71.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIFA8C.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{C5C70855-D3F8-46FD-8572-5142D5091E6F} msiexec.exe File opened for modification C:\Windows\Installer\MSIFE47.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIFA0E.tmp msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Detects BABADEDA Crypter 2 IoCs
Detects BABADEDA Crypter.
resource yara_rule behavioral2/files/0x00080000000220d8-167.dat BABADEDA_Crypter behavioral2/memory/4012-200-0x0000000008130000-0x000000000D230000-memory.dmp BABADEDA_Crypter - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe - Modifies data under HKEY_USERS 51 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4360" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4032" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "6.999549" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132898221790558348" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "25.032683" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.032791" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4152" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "5.555180" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings 42ccd61f1357d37d8c439082e195eed6eb0d3a6b060852ce57161b469919f778.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 488 msiexec.exe 488 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2144 msiexec.exe Token: SeIncreaseQuotaPrivilege 2144 msiexec.exe Token: SeSecurityPrivilege 488 msiexec.exe Token: SeCreateTokenPrivilege 2144 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2144 msiexec.exe Token: SeLockMemoryPrivilege 2144 msiexec.exe Token: SeIncreaseQuotaPrivilege 2144 msiexec.exe Token: SeMachineAccountPrivilege 2144 msiexec.exe Token: SeTcbPrivilege 2144 msiexec.exe Token: SeSecurityPrivilege 2144 msiexec.exe Token: SeTakeOwnershipPrivilege 2144 msiexec.exe Token: SeLoadDriverPrivilege 2144 msiexec.exe Token: SeSystemProfilePrivilege 2144 msiexec.exe Token: SeSystemtimePrivilege 2144 msiexec.exe Token: SeProfSingleProcessPrivilege 2144 msiexec.exe Token: SeIncBasePriorityPrivilege 2144 msiexec.exe Token: SeCreatePagefilePrivilege 2144 msiexec.exe Token: SeCreatePermanentPrivilege 2144 msiexec.exe Token: SeBackupPrivilege 2144 msiexec.exe Token: SeRestorePrivilege 2144 msiexec.exe Token: SeShutdownPrivilege 2144 msiexec.exe Token: SeDebugPrivilege 2144 msiexec.exe Token: SeAuditPrivilege 2144 msiexec.exe Token: SeSystemEnvironmentPrivilege 2144 msiexec.exe Token: SeChangeNotifyPrivilege 2144 msiexec.exe Token: SeRemoteShutdownPrivilege 2144 msiexec.exe Token: SeUndockPrivilege 2144 msiexec.exe Token: SeSyncAgentPrivilege 2144 msiexec.exe Token: SeEnableDelegationPrivilege 2144 msiexec.exe Token: SeManageVolumePrivilege 2144 msiexec.exe Token: SeImpersonatePrivilege 2144 msiexec.exe Token: SeCreateGlobalPrivilege 2144 msiexec.exe Token: SeRestorePrivilege 488 msiexec.exe Token: SeTakeOwnershipPrivilege 488 msiexec.exe Token: SeRestorePrivilege 488 msiexec.exe Token: SeTakeOwnershipPrivilege 488 msiexec.exe Token: SeRestorePrivilege 488 msiexec.exe Token: SeTakeOwnershipPrivilege 488 msiexec.exe Token: SeRestorePrivilege 488 msiexec.exe Token: SeTakeOwnershipPrivilege 488 msiexec.exe Token: SeRestorePrivilege 488 msiexec.exe Token: SeTakeOwnershipPrivilege 488 msiexec.exe Token: SeRestorePrivilege 488 msiexec.exe Token: SeTakeOwnershipPrivilege 488 msiexec.exe Token: SeRestorePrivilege 488 msiexec.exe Token: SeTakeOwnershipPrivilege 488 msiexec.exe Token: SeRestorePrivilege 488 msiexec.exe Token: SeTakeOwnershipPrivilege 488 msiexec.exe Token: SeSecurityPrivilege 3760 TiWorker.exe Token: SeRestorePrivilege 3760 TiWorker.exe Token: SeBackupPrivilege 3760 TiWorker.exe Token: SeBackupPrivilege 3760 TiWorker.exe Token: SeRestorePrivilege 3760 TiWorker.exe Token: SeSecurityPrivilege 3760 TiWorker.exe Token: SeBackupPrivilege 3760 TiWorker.exe Token: SeRestorePrivilege 3760 TiWorker.exe Token: SeSecurityPrivilege 3760 TiWorker.exe Token: SeBackupPrivilege 3760 TiWorker.exe Token: SeRestorePrivilege 3760 TiWorker.exe Token: SeSecurityPrivilege 3760 TiWorker.exe Token: SeBackupPrivilege 3760 TiWorker.exe Token: SeRestorePrivilege 3760 TiWorker.exe Token: SeSecurityPrivilege 3760 TiWorker.exe Token: SeBackupPrivilege 3760 TiWorker.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4012 iisexpress.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3880 wrote to memory of 2144 3880 42ccd61f1357d37d8c439082e195eed6eb0d3a6b060852ce57161b469919f778.exe 61 PID 3880 wrote to memory of 2144 3880 42ccd61f1357d37d8c439082e195eed6eb0d3a6b060852ce57161b469919f778.exe 61 PID 3880 wrote to memory of 2144 3880 42ccd61f1357d37d8c439082e195eed6eb0d3a6b060852ce57161b469919f778.exe 61 PID 488 wrote to memory of 3096 488 msiexec.exe 67 PID 488 wrote to memory of 3096 488 msiexec.exe 67 PID 488 wrote to memory of 3096 488 msiexec.exe 67 PID 488 wrote to memory of 4012 488 msiexec.exe 72 PID 488 wrote to memory of 4012 488 msiexec.exe 72 PID 488 wrote to memory of 4012 488 msiexec.exe 72 PID 488 wrote to memory of 4012 488 msiexec.exe 72 PID 488 wrote to memory of 4012 488 msiexec.exe 72
Processes
-
C:\Users\Admin\AppData\Local\Temp\42ccd61f1357d37d8c439082e195eed6eb0d3a6b060852ce57161b469919f778.exe"C:\Users\Admin\AppData\Local\Temp\42ccd61f1357d37d8c439082e195eed6eb0d3a6b060852ce57161b469919f778.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\setup.msi" /q2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2144
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:488 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AE5AAA22B39FB0DD2BCB24BF26665B422⤵
- Loads dropped DLL
PID:3096
-
-
C:\Users\Admin\AppData\Roaming\Plex, Inc\Plex Media Server DLNA\iisexpress.exe"C:\Users\Admin\AppData\Roaming\Plex, Inc\Plex Media Server DLNA\iisexpress.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4012
-
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:3644
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:3436
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3760