Analysis
- max time kernel
161s - max time network
163s - platform
windows10-2004_x64 - resource
win10v2004-20220310-en - submitted
26/03/2022, 01:30
Static task
static1
Behavioral task
behavioral1
Sample
c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe
Resource
win7-20220310-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe
Resource
win10v2004-20220310-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe
- Size 536KB
- Sample220326-bwt29abfcl
- SHA256 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2
- MD5 62dd270c7a45183db0a73060993e2583
- SHA1 637555c1d202f54aa2e3bf192217eda00046e0dc
- SHA512 544100d742d3b683d5f3cb012ad05aac08d7bfb3a7fd50928a57cf18b2cf7655c13d191051313c7eae52241cc8aec810bd309ce2f631caeb5a6d8e5b71126efc
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\winras.exe," c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\winras.exe c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe File created C:\Windows\SysWOW64\winras.exe c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\INF\netrasa.PNF svchost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\DeviceDesc svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Capabilities svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Mfg svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Mfg svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Capabilities svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D svchost.exe - Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe - Suspicious behavior: LoadsDriver 6 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 668 Process not Found - Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeDebugPrivilege 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe Token: SeShutdownPrivilege 3976 svchost.exe Token: SeCreatePagefilePrivilege 3976 svchost.exe Token: SeLoadDriverPrivilege 3976 svchost.exe Token: SeLoadDriverPrivilege 3976 svchost.exe Token: SeShutdownPrivilege 4432 svchost.exe Token: SeCreatePagefilePrivilege 4432 svchost.exe Token: SeLoadDriverPrivilege 4432 svchost.exe Token: SeLoadDriverPrivilege 4432 svchost.exe Token: SeLoadDriverPrivilege 4432 svchost.exe Token: SeLoadDriverPrivilege 4432 svchost.exe Token: SeLoadDriverPrivilege 4432 svchost.exe Token: SeLoadDriverPrivilege 4432 svchost.exe Token: SeLoadDriverPrivilege 4432 svchost.exe Token: SeLoadDriverPrivilege 4432 svchost.exe Token: SeLoadDriverPrivilege 4432 svchost.exe Token: SeLoadDriverPrivilege 4432 svchost.exe Token: SeShutdownPrivilege 2264 svchost.exe Token: SeCreatePagefilePrivilege 2264 svchost.exe Token: SeLoadDriverPrivilege 2264 svchost.exe Token: SeLoadDriverPrivilege 2264 svchost.exe Token: SeLoadDriverPrivilege 2264 svchost.exe Token: SeLoadDriverPrivilege 2264 svchost.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1 PID 4428 wrote to memory of 624 4428 c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe 1
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe"C:\Users\Admin\AppData\Local\Temp\c71f91be4c1bf1645867ed1d42d80f18ed71de9de1aab54d784af7679b4a59d2.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4428
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SstpSvc1⤵PID:3456
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:2508
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3976
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs1⤵PID:4040
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4432
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2264