f44ea5109b380e8bdedc44930b4a7b43df8a5e5c4fb9bb81163e44097c7a78d3

Analysis

max time kernel
144s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220331-en
submitted
05/04/2022, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
be27c2351c45b75a4226338bf92a8ff9.exe
Size 1.4MB
Sample220405-tkl7dadbaq
SHA256 f44ea5109b380e8bdedc44930b4a7b43df8a5e5c4fb9bb81163e44097c7a78d3
MD5 be27c2351c45b75a4226338bf92a8ff9
SHA1 aa765268796902e40c31eb2eeefd571c7971a18f
SHA512 a7d3894d76bfb1304f2543a8c814e2f3b887142fe29cb7a482ddf1aa513477afade1e6805ba0779215b991a7552cde54915869283982ed2ec175f493fcb2a1ac
MD5 SHA1 SHA512

Score

10^/10

persistence spyware stealer suricata

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 12 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\odt\\SppExtComObj.exe\", \"C:\\odt\\smss.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\Registry.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\spoolsv.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\dwm.exe\", \"C:\\Windows\\Web\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\""	be27c2351c45b75a4226338bf92a8ff9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\odt\\SppExtComObj.exe\", \"C:\\odt\\smss.exe\""	be27c2351c45b75a4226338bf92a8ff9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\odt\\SppExtComObj.exe\", \"C:\\odt\\smss.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\Registry.exe\""	be27c2351c45b75a4226338bf92a8ff9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\odt\\SppExtComObj.exe\", \"C:\\odt\\smss.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\Registry.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\spoolsv.exe\""	be27c2351c45b75a4226338bf92a8ff9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\odt\\SppExtComObj.exe\", \"C:\\odt\\smss.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\Registry.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\spoolsv.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\dwm.exe\""	be27c2351c45b75a4226338bf92a8ff9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\odt\\SppExtComObj.exe\", \"C:\\odt\\smss.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\Registry.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\spoolsv.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\dwm.exe\", \"C:\\Windows\\Web\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Users\\Default User\\backgroundTaskHost.exe\", \"C:\\odt\\WmiPrvSE.exe\""	be27c2351c45b75a4226338bf92a8ff9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\odt\\SppExtComObj.exe\", \"C:\\odt\\smss.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\Registry.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\spoolsv.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\dwm.exe\", \"C:\\Windows\\Web\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Users\\Default User\\backgroundTaskHost.exe\", \"C:\\odt\\WmiPrvSE.exe\", \"C:\\Users\\Default\\Application Data\\System.exe\""	be27c2351c45b75a4226338bf92a8ff9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\odt\\SppExtComObj.exe\", \"C:\\odt\\smss.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\Registry.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\spoolsv.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\dwm.exe\", \"C:\\Windows\\Web\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Users\\Default User\\backgroundTaskHost.exe\", \"C:\\odt\\WmiPrvSE.exe\", \"C:\\Users\\Default\\Application Data\\System.exe\", \"C:\\ProgramData\\Package Cache\\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\\packages\\vcRuntimeAdditional_x86\\winlogon.exe\""	be27c2351c45b75a4226338bf92a8ff9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	be27c2351c45b75a4226338bf92a8ff9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\odt\\SppExtComObj.exe\""	be27c2351c45b75a4226338bf92a8ff9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\odt\\SppExtComObj.exe\", \"C:\\odt\\smss.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\Registry.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\spoolsv.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\dwm.exe\", \"C:\\Windows\\Web\\RuntimeBroker.exe\""	be27c2351c45b75a4226338bf92a8ff9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\odt\\SppExtComObj.exe\", \"C:\\odt\\smss.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\Registry.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\spoolsv.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\dwm.exe\", \"C:\\Windows\\Web\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Users\\Default User\\backgroundTaskHost.exe\""	be27c2351c45b75a4226338bf92a8ff9.exe

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5056	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4788	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4832	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2180	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2256	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4548	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2152	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1104	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4076	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3132	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2288	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3116	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3204	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1008	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3860	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1972	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4784	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2032	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4452	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1508	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4836	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4744	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4300	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4288	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4516	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4536	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4500	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	884	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4124	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4412	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4800	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3428	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4916	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4028	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4012	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	212	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2316	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	500	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3688	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1868	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1844	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4048	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1780	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3500	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2284	4692	schtasks.exe	21
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	4692	schtasks.exe	21

suricata: ET MALWARE DCRAT Activity (GET)
suricata: ET MALWARE DCRAT Activity (GET)
suricata

Executes dropped EXE 1 IoCs

pid	Process
4968	smss.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Control Panel\International\Geo\Nation	be27c2351c45b75a4226338bf92a8ff9.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\ProgramData\\Package Cache\\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\\packages\\vcRuntimeAdditional_x86\\winlogon.exe\""	be27c2351c45b75a4226338bf92a8ff9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\odt\\smss.exe\""	be27c2351c45b75a4226338bf92a8ff9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\spoolsv.exe\""	be27c2351c45b75a4226338bf92a8ff9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\dwm.exe\""	be27c2351c45b75a4226338bf92a8ff9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\Web\\RuntimeBroker.exe\""	be27c2351c45b75a4226338bf92a8ff9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\""	be27c2351c45b75a4226338bf92a8ff9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Users\\Default User\\backgroundTaskHost.exe\""	be27c2351c45b75a4226338bf92a8ff9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	be27c2351c45b75a4226338bf92a8ff9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\odt\\SppExtComObj.exe\""	be27c2351c45b75a4226338bf92a8ff9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Users\\All Users\\SoftwareDistribution\\Registry.exe\""	be27c2351c45b75a4226338bf92a8ff9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\odt\\WmiPrvSE.exe\""	be27c2351c45b75a4226338bf92a8ff9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\Default\\Application Data\\System.exe\""	be27c2351c45b75a4226338bf92a8ff9.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
9	ipinfo.io

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\skins\fonts\spoolsv.exe	be27c2351c45b75a4226338bf92a8ff9.exe
File created	C:\Program Files\VideoLAN\VLC\skins\fonts\f3b6ecef712a24	be27c2351c45b75a4226338bf92a8ff9.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\skins\fonts\RCX73B9.tmp	be27c2351c45b75a4226338bf92a8ff9.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\skins\fonts\spoolsv.exe	be27c2351c45b75a4226338bf92a8ff9.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\en-US\dwm.exe	be27c2351c45b75a4226338bf92a8ff9.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\dwm.exe	be27c2351c45b75a4226338bf92a8ff9.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\6cb0b6c459d5d3	be27c2351c45b75a4226338bf92a8ff9.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\skins\fonts\RCX732B.tmp	be27c2351c45b75a4226338bf92a8ff9.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\en-US\RCX763B.tmp	be27c2351c45b75a4226338bf92a8ff9.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\en-US\RCX76C8.tmp	be27c2351c45b75a4226338bf92a8ff9.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\Web\RuntimeBroker.exe	be27c2351c45b75a4226338bf92a8ff9.exe
File created	C:\Windows\Web\9e8d7a4ca61bd9	be27c2351c45b75a4226338bf92a8ff9.exe
File opened for modification	C:\Windows\Web\RCX794A.tmp	be27c2351c45b75a4226338bf92a8ff9.exe
File opened for modification	C:\Windows\Web\RCX79D7.tmp	be27c2351c45b75a4226338bf92a8ff9.exe
File opened for modification	C:\Windows\Web\RuntimeBroker.exe	be27c2351c45b75a4226338bf92a8ff9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1520	schtasks.exe
4028	schtasks.exe
500	schtasks.exe
3500	schtasks.exe
1996	schtasks.exe
4076	schtasks.exe
4536	schtasks.exe
884	schtasks.exe
4800	schtasks.exe
212	schtasks.exe
1104	schtasks.exe
3132	schtasks.exe
3204	schtasks.exe
1008	schtasks.exe
2032	schtasks.exe
4452	schtasks.exe
4516	schtasks.exe
4412	schtasks.exe
2284	schtasks.exe
2152	schtasks.exe
2288	schtasks.exe
1648	schtasks.exe
3428	schtasks.exe
1780	schtasks.exe
5056	schtasks.exe
4784	schtasks.exe
4836	schtasks.exe
4500	schtasks.exe
4012	schtasks.exe
2316	schtasks.exe
3688	schtasks.exe
1844	schtasks.exe
4548	schtasks.exe
1508	schtasks.exe
4300	schtasks.exe
1868	schtasks.exe
4788	schtasks.exe
4832	schtasks.exe
2180	schtasks.exe
2256	schtasks.exe
3116	schtasks.exe
3860	schtasks.exe
4124	schtasks.exe
4048	schtasks.exe
1972	schtasks.exe
4744	schtasks.exe
4288	schtasks.exe
4916	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	be27c2351c45b75a4226338bf92a8ff9.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
380	be27c2351c45b75a4226338bf92a8ff9.exe
380	be27c2351c45b75a4226338bf92a8ff9.exe
380	be27c2351c45b75a4226338bf92a8ff9.exe
380	be27c2351c45b75a4226338bf92a8ff9.exe
380	be27c2351c45b75a4226338bf92a8ff9.exe
380	be27c2351c45b75a4226338bf92a8ff9.exe
380	be27c2351c45b75a4226338bf92a8ff9.exe
380	be27c2351c45b75a4226338bf92a8ff9.exe
380	be27c2351c45b75a4226338bf92a8ff9.exe
380	be27c2351c45b75a4226338bf92a8ff9.exe
380	be27c2351c45b75a4226338bf92a8ff9.exe
4968	smss.exe
4968	smss.exe
4968	smss.exe
4968	smss.exe
4968	smss.exe
4968	smss.exe
4968	smss.exe
4968	smss.exe
4968	smss.exe
4968	smss.exe
4968	smss.exe
4968	smss.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4968	smss.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	380	be27c2351c45b75a4226338bf92a8ff9.exe
Token: SeDebugPrivilege	4968	smss.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 380 wrote to memory of 4968	380	be27c2351c45b75a4226338bf92a8ff9.exe	128
PID 380 wrote to memory of 4968	380	be27c2351c45b75a4226338bf92a8ff9.exe	128

C:\Users\Admin\AppData\Local\Temp\be27c2351c45b75a4226338bf92a8ff9.exe
"C:\Users\Admin\AppData\Local\Temp\be27c2351c45b75a4226338bf92a8ff9.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:380
- C:\odt\smss.exe
  "C:\odt\smss.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:4968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ssALRuntimeBroker" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "I4hCRuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wlUiRuntimeBroker" /sc ONSTART /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "JOO0SppExtComObj" /sc MINUTE /mo 11 /tr "'C:\odt\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "jwg8SppExtComObj" /sc ONLOGON /tr "'C:\odt\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3RfoSppExtComObj" /sc ONSTART /tr "'C:\odt\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc MINUTE /mo 12 /tr "'C:\odt\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Hcp3smss" /sc MINUTE /mo 10 /tr "'C:\odt\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "FG3ssmss" /sc ONLOGON /tr "'C:\odt\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Ko0lsmss" /sc ONSTART /tr "'C:\odt\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc MINUTE /mo 7 /tr "'C:\odt\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "4kJGRegistry" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\SoftwareDistribution\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "E2DVRegistry" /sc ONLOGON /tr "'C:\Users\All Users\SoftwareDistribution\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3cSnRegistry" /sc ONSTART /tr "'C:\Users\All Users\SoftwareDistribution\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\SoftwareDistribution\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "gPVxspoolsv" /sc MINUTE /mo 8 /tr "'C:\Program Files\VideoLAN\VLC\skins\fonts\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "9n9Fspoolsv" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\skins\fonts\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SRXtspoolsv" /sc ONSTART /tr "'C:\Program Files\VideoLAN\VLC\skins\fonts\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc MINUTE /mo 5 /tr "'C:\Program Files\VideoLAN\VLC\skins\fonts\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "xxC7dwm" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "zlmSdwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "D8jxdwm" /sc ONSTART /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ViLXRuntimeBroker" /sc MINUTE /mo 10 /tr "'C:\Windows\Web\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "k4YmRuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Web\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cobTRuntimeBroker" /sc ONSTART /tr "'C:\Windows\Web\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc MINUTE /mo 8 /tr "'C:\Windows\Web\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "uDfbStartMenuExperienceHost" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "5BVVStartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "GsvuStartMenuExperienceHost" /sc ONSTART /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ByFAbackgroundTaskHost" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "aEMvbackgroundTaskHost" /sc ONLOGON /tr "'C:\Users\Default User\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "mXoHbackgroundTaskHost" /sc ONSTART /tr "'C:\Users\Default User\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "rJN0WmiPrvSE" /sc MINUTE /mo 11 /tr "'C:\odt\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "vK4OWmiPrvSE" /sc ONLOGON /tr "'C:\odt\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ySZuWmiPrvSE" /sc ONSTART /tr "'C:\odt\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc MINUTE /mo 14 /tr "'C:\odt\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "q9YkSystem" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Application Data\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Re0BSystem" /sc ONLOGON /tr "'C:\Users\Default\Application Data\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IKhFSystem" /sc ONSTART /tr "'C:\Users\Default\Application Data\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Application Data\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "bBp9winlogon" /sc MINUTE /mo 6 /tr "'C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "7Yoawinlogon" /sc ONLOGON /tr "'C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "2QYEwinlogon" /sc ONSTART /tr "'C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc MINUTE /mo 9 /tr "'C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1996

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Winlogon Helper DLL

T1004

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

smss.exe

Path C:\odt\smss.exe
Size 1.4MB
SHA256 803197da2fd4e3796b88d5eadd462c9d8378df7a2aab08d705f27e17ff01ffba
MD5 15163320f7b620bfdb683b8995376adc
SHA1 abd716ce015eb69c2729c84103b910bd1e9a385b
SHA512 3ec6867ee66793f1c429a01059c38610a8ec8d48628da0ee61dfbd850087129c72853a71b36d49b8dd727dc517da77a13867843dccd59d97b17672f82445a88d
SSDEEP 24576:AICiUhm9BTWb+y6N6UlEY4JM75ekAypVTKsYqBrSntP0P:EiBIMVyM75ekAUxzSn2
MD5 SHA1 SHA512 SSDEEP

Submit Download

smss.exe

Path C:\odt\smss.exe
Size 1.4MB
SHA256 803197da2fd4e3796b88d5eadd462c9d8378df7a2aab08d705f27e17ff01ffba
MD5 15163320f7b620bfdb683b8995376adc
SHA1 abd716ce015eb69c2729c84103b910bd1e9a385b
SHA512 3ec6867ee66793f1c429a01059c38610a8ec8d48628da0ee61dfbd850087129c72853a71b36d49b8dd727dc517da77a13867843dccd59d97b17672f82445a88d
SSDEEP 24576:AICiUhm9BTWb+y6N6UlEY4JM75ekAypVTKsYqBrSntP0P:EiBIMVyM75ekAUxzSn2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/380-124-0x0000000000490000-0x0000000000600000-memory.dmp

Download

memory/380-125-0x000000001B220000-0x000000001B270000-memory.dmp

Download

memory/380-126-0x00007FF8615C0000-0x00007FF862081000-memory.dmp

Download

memory/380-127-0x00000000026E0000-0x00000000026E2000-memory.dmp

Download

memory/4968-131-0x00000000007E0000-0x0000000000950000-memory.dmp

Download

memory/4968-132-0x00007FF8615C0000-0x00007FF862081000-memory.dmp

Download

memory/4968-133-0x000000001EFB0000-0x000000001F172000-memory.dmp

Download