Analysis
- max time kernel
157s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
21/02/2022, 12:58
Static task
static1
Behavioral task
behavioral1
Sample
Order-EM5148932-pdf.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target Order-EM5148932-pdf.exe
- Size 319KB
- Sample220221-p7hp9aacc3
- SHA256 ea1c7db69290a2b343646ede684b58ed96e891feab6dadbbc9909c1c245d4bf2
- MD5 68606139ca13cd2a5f1a5835fed4cb1a
- SHA1 9d0a1485aa82bf9cc7fbfd2854d517244550a342
- SHA512 d26d47c3da27ba7448f0df86770bfe1d5aa959d244e9b6dfa1a5d923f7b9d41b0fb00491bb9e6e55e376f1d76006e2d7f9195d0ed34c16a614d8fb1a8a3f6f5f
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
xloader
Version
-
2.5
Campaign
-
nqs9
Decoy
-
lgingood.com
-
shopgeti.com
-
christianuomo.com
-
sportsxuk.com
-
markidesignstore.com
-
tjhuoliao.com
-
docomobb.xyz
-
ilrespirodelmare.com
-
kfconline.rest
-
paramusrepair.com
-
w3zand.com
-
unguamtruppe.quest
-
bethesdagardensloveland.net
-
bostonstretchlimousine.com
-
yycsmj.net
-
creatorgela.com
-
bestalcoholfreebeer.com
-
jorgeforfr.com
-
dlzxd.com
-
rajaranicoupon.xyz
-
marnannyc.com
-
bettersalud.info
-
xn----etbdbfqj8aat.xn--p1acf
-
brandsagency.net
-
tradequy.net
-
farmaciacentral.online
-
portaal140.top
-
solacebooks.online
-
theroastercoaster.com
-
vanityandsanity.store
-
thediscoverytrail.com
-
comunidadpatriota.com
-
simplyall.xyz
-
db-propertygroup.com
-
mgav37.xyz
-
dwight.store
-
prosperityurgentcare.us
-
realbrother.net
-
shineshaft.website
-
just4beauty.store
-
zoosmash.com
-
paneiro.net
-
splitattherootfilm.com
-
waytokeiomed.com
-
allaroundlandscapingllc.com
-
pageants.xyz
-
amenosu.com
-
karamrentacar.com
-
dfgroup.tech
-
valdicolor.com
-
nu9gayde.xyz
-
bookfling.store
-
trimcatch.com
-
serbersa.com
-
richmondcambiemedicalclinic.com
-
claritydesignz.com
-
finlandfive.xyz
-
hgs777.com
-
mjfashionnz.com
-
pragunananda.com
-
donbicicleta.com
-
executeonpurpose.com
-
proteamstaxconsultancy.com
-
zmduk.com
-
thietketrantam.art
Signatures
- Xloader Payload 2 IoCs
resource yara_rule behavioral2/memory/4020-134-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1808-143-0x0000000002FB0000-0x0000000002FD9000-memory.dmp xloader - Blocklisted process makes network request 2 IoCs
flow pid Process 84 1808 wscript.exe 86 1808 wscript.exe - Executes dropped EXE 2 IoCs
pid Process 1356 zlsdlpt.exe 4020 zlsdlpt.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1356 set thread context of 4020 1356 zlsdlpt.exe 67 PID 4020 set thread context of 2308 4020 zlsdlpt.exe 34 PID 1808 set thread context of 2308 1808 wscript.exe 34 - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe - Modifies data under HKEY_USERS 51 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.006575" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4052" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "2.857070" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "11.957726" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4140" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132900983517926704" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.000000" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4380" svchost.exe - Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 4020 zlsdlpt.exe 4020 zlsdlpt.exe 4020 zlsdlpt.exe 4020 zlsdlpt.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe 1808 wscript.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2308 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 4020 zlsdlpt.exe 4020 zlsdlpt.exe 4020 zlsdlpt.exe 1808 wscript.exe 1808 wscript.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4020 zlsdlpt.exe Token: SeDebugPrivilege 1808 wscript.exe Token: SeSecurityPrivilege 2636 TiWorker.exe Token: SeRestorePrivilege 2636 TiWorker.exe Token: SeBackupPrivilege 2636 TiWorker.exe Token: SeBackupPrivilege 2636 TiWorker.exe Token: SeRestorePrivilege 2636 TiWorker.exe Token: SeSecurityPrivilege 2636 TiWorker.exe Token: SeBackupPrivilege 2636 TiWorker.exe Token: SeRestorePrivilege 2636 TiWorker.exe Token: SeSecurityPrivilege 2636 TiWorker.exe Token: SeBackupPrivilege 2636 TiWorker.exe Token: SeRestorePrivilege 2636 TiWorker.exe Token: SeSecurityPrivilege 2636 TiWorker.exe Token: SeBackupPrivilege 2636 TiWorker.exe Token: SeRestorePrivilege 2636 TiWorker.exe Token: SeSecurityPrivilege 2636 TiWorker.exe Token: SeBackupPrivilege 2636 TiWorker.exe Token: SeRestorePrivilege 2636 TiWorker.exe Token: SeSecurityPrivilege 2636 TiWorker.exe Token: SeBackupPrivilege 2636 TiWorker.exe Token: SeRestorePrivilege 2636 TiWorker.exe Token: SeSecurityPrivilege 2636 TiWorker.exe Token: SeBackupPrivilege 2636 TiWorker.exe Token: SeRestorePrivilege 2636 TiWorker.exe Token: SeSecurityPrivilege 2636 TiWorker.exe Token: SeBackupPrivilege 2636 TiWorker.exe Token: SeRestorePrivilege 2636 TiWorker.exe Token: SeSecurityPrivilege 2636 TiWorker.exe Token: SeBackupPrivilege 2636 TiWorker.exe Token: SeRestorePrivilege 2636 TiWorker.exe Token: SeSecurityPrivilege 2636 TiWorker.exe Token: SeBackupPrivilege 2636 TiWorker.exe Token: SeRestorePrivilege 2636 TiWorker.exe Token: SeSecurityPrivilege 2636 TiWorker.exe Token: SeBackupPrivilege 2636 TiWorker.exe Token: SeRestorePrivilege 2636 TiWorker.exe Token: SeSecurityPrivilege 2636 TiWorker.exe Token: SeBackupPrivilege 2636 TiWorker.exe Token: SeRestorePrivilege 2636 TiWorker.exe Token: SeSecurityPrivilege 2636 TiWorker.exe Token: SeBackupPrivilege 2636 TiWorker.exe Token: SeRestorePrivilege 2636 TiWorker.exe Token: SeSecurityPrivilege 2636 TiWorker.exe Token: SeBackupPrivilege 2636 TiWorker.exe Token: SeRestorePrivilege 2636 TiWorker.exe Token: SeSecurityPrivilege 2636 TiWorker.exe Token: SeBackupPrivilege 2636 TiWorker.exe Token: SeRestorePrivilege 2636 TiWorker.exe Token: SeSecurityPrivilege 2636 TiWorker.exe Token: SeBackupPrivilege 2636 TiWorker.exe Token: SeRestorePrivilege 2636 TiWorker.exe Token: SeSecurityPrivilege 2636 TiWorker.exe Token: SeBackupPrivilege 2636 TiWorker.exe Token: SeRestorePrivilege 2636 TiWorker.exe Token: SeSecurityPrivilege 2636 TiWorker.exe Token: SeBackupPrivilege 2636 TiWorker.exe Token: SeRestorePrivilege 2636 TiWorker.exe Token: SeSecurityPrivilege 2636 TiWorker.exe Token: SeBackupPrivilege 2636 TiWorker.exe Token: SeRestorePrivilege 2636 TiWorker.exe Token: SeSecurityPrivilege 2636 TiWorker.exe Token: SeBackupPrivilege 2636 TiWorker.exe Token: SeRestorePrivilege 2636 TiWorker.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2360 wrote to memory of 1356 2360 Order-EM5148932-pdf.exe 63 PID 2360 wrote to memory of 1356 2360 Order-EM5148932-pdf.exe 63 PID 2360 wrote to memory of 1356 2360 Order-EM5148932-pdf.exe 63 PID 1356 wrote to memory of 4020 1356 zlsdlpt.exe 67 PID 1356 wrote to memory of 4020 1356 zlsdlpt.exe 67 PID 1356 wrote to memory of 4020 1356 zlsdlpt.exe 67 PID 1356 wrote to memory of 4020 1356 zlsdlpt.exe 67 PID 1356 wrote to memory of 4020 1356 zlsdlpt.exe 67 PID 1356 wrote to memory of 4020 1356 zlsdlpt.exe 67 PID 2308 wrote to memory of 1808 2308 Explorer.EXE 68 PID 2308 wrote to memory of 1808 2308 Explorer.EXE 68 PID 2308 wrote to memory of 1808 2308 Explorer.EXE 68 PID 1808 wrote to memory of 2972 1808 wscript.exe 74 PID 1808 wrote to memory of 2972 1808 wscript.exe 74 PID 1808 wrote to memory of 2972 1808 wscript.exe 74
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\Order-EM5148932-pdf.exe"C:\Users\Admin\AppData\Local\Temp\Order-EM5148932-pdf.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\zlsdlpt.exeC:\Users\Admin\AppData\Local\Temp\zlsdlpt.exe C:\Users\Admin\AppData\Local\Temp\vdwoiov3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\zlsdlpt.exeC:\Users\Admin\AppData\Local\Temp\zlsdlpt.exe C:\Users\Admin\AppData\Local\Temp\vdwoiov4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4020
-
-
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\zlsdlpt.exe"3⤵PID:2972
-
-
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:3800
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:4008
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2636