Analysis
-
max time kernel
140s -
max time network
178s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
15-06-2022 14:57
Static task
static1
Behavioral task
behavioral1
Sample
294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
Resource
win7-20220414-en
General
-
Target
294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe
-
Size
284KB
-
MD5
0c74c898a73adfbfc35975a833186d5b
-
SHA1
ab246c4d8c50385c722215caf2b038bb04a92e74
-
SHA256
294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a
-
SHA512
c80c92797c64f9ba6e1124a1e8cf281d0b8c79231d9e582187ee826280f5024c5e1a6e2addb8b3ed06cf30e8569821665f77b8e3efba06cdd0be3f41b21d1dde
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\fjk6134.tmp acprotect \Windows\Temp\qzkFDA1.tmp acprotect -
Executes dropped EXE 3 IoCs
Processes:
294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686aSrv.exeSystem.exeSystemSrv.exepid process 1352 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686aSrv.exe 1996 System.exe 1764 SystemSrv.exe -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686aSrv.exe upx C:\Users\Admin\AppData\Local\Temp\294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686aSrv.exe upx C:\Users\Admin\AppData\Local\Temp\294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686aSrv.exe upx behavioral1/memory/1352-60-0x0000000000400000-0x000000000042E000-memory.dmp upx C:\WINDOWS\SYSTEMSRV.EXE upx C:\Windows\SystemSrv.exe upx C:\PROGRAM FILES (X86)\MICROSOFT\DESKTOPLAYER.EXE upx behavioral1/memory/1764-77-0x0000000000400000-0x000000000042E000-memory.dmp upx -
Loads dropped DLL 3 IoCs
Processes:
294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exeSystem.exepid process 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe 1996 System.exe -
Drops file in Program Files directory 6 IoCs
Processes:
SystemSrv.exe294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686aSrv.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\pxFE9B.tmp SystemSrv.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\DESKTOPLAYER.EXE SystemSrv.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe SystemSrv.exe File opened for modification C:\Program Files (x86)\Microsoft\px629B.tmp 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686aSrv.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686aSrv.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686aSrv.exe -
Drops file in Windows directory 4 IoCs
Processes:
SystemSrv.exe294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exeSystem.exedescription ioc process File opened for modification C:\WINDOWS\SYSTEMSRV.EXE SystemSrv.exe File created C:\Windows\System.exe 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe File opened for modification C:\Windows\System.exe 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe File created C:\Windows\SystemSrv.exe System.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
System.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 System.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz System.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exeSystem.exepid process 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe 1996 System.exe -
Suspicious behavior: MapViewOfSection 45 IoCs
Processes:
294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exeSystem.exepid process 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe 1996 System.exe 1996 System.exe 1996 System.exe 1996 System.exe 1996 System.exe 1996 System.exe 1996 System.exe 1996 System.exe 1996 System.exe 1996 System.exe 1996 System.exe 1996 System.exe 1996 System.exe 1996 System.exe 1996 System.exe 1996 System.exe 1996 System.exe 1996 System.exe 1996 System.exe 1996 System.exe 1996 System.exe 1996 System.exe 1996 System.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exepid process 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe -
Suspicious use of AdjustPrivilegeToken 22 IoCs
Processes:
294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exeSystem.exeSystemSrv.exedescription pid process Token: SeDebugPrivilege 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe Token: SeDebugPrivilege 1996 System.exe Token: SeTakeOwnershipPrivilege 1764 SystemSrv.exe Token: SeRestorePrivilege 1764 SystemSrv.exe Token: SeBackupPrivilege 1764 SystemSrv.exe Token: SeChangeNotifyPrivilege 1764 SystemSrv.exe Token: SeTakeOwnershipPrivilege 1764 SystemSrv.exe Token: SeRestorePrivilege 1764 SystemSrv.exe Token: SeBackupPrivilege 1764 SystemSrv.exe Token: SeChangeNotifyPrivilege 1764 SystemSrv.exe Token: SeTakeOwnershipPrivilege 1764 SystemSrv.exe Token: SeRestorePrivilege 1764 SystemSrv.exe Token: SeBackupPrivilege 1764 SystemSrv.exe Token: SeChangeNotifyPrivilege 1764 SystemSrv.exe Token: SeTakeOwnershipPrivilege 1764 SystemSrv.exe Token: SeRestorePrivilege 1764 SystemSrv.exe Token: SeBackupPrivilege 1764 SystemSrv.exe Token: SeChangeNotifyPrivilege 1764 SystemSrv.exe Token: SeTakeOwnershipPrivilege 1764 SystemSrv.exe Token: SeRestorePrivilege 1764 SystemSrv.exe Token: SeBackupPrivilege 1764 SystemSrv.exe Token: SeChangeNotifyPrivilege 1764 SystemSrv.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exeSystem.exepid process 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe 1996 System.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exedescription pid process target process PID 1284 wrote to memory of 1352 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686aSrv.exe PID 1284 wrote to memory of 1352 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686aSrv.exe PID 1284 wrote to memory of 1352 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686aSrv.exe PID 1284 wrote to memory of 1352 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686aSrv.exe PID 1284 wrote to memory of 372 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe wininit.exe PID 1284 wrote to memory of 372 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe wininit.exe PID 1284 wrote to memory of 372 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe wininit.exe PID 1284 wrote to memory of 372 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe wininit.exe PID 1284 wrote to memory of 372 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe wininit.exe PID 1284 wrote to memory of 372 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe wininit.exe PID 1284 wrote to memory of 372 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe wininit.exe PID 1284 wrote to memory of 384 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe csrss.exe PID 1284 wrote to memory of 384 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe csrss.exe PID 1284 wrote to memory of 384 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe csrss.exe PID 1284 wrote to memory of 384 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe csrss.exe PID 1284 wrote to memory of 384 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe csrss.exe PID 1284 wrote to memory of 384 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe csrss.exe PID 1284 wrote to memory of 384 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe csrss.exe PID 1284 wrote to memory of 420 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe winlogon.exe PID 1284 wrote to memory of 420 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe winlogon.exe PID 1284 wrote to memory of 420 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe winlogon.exe PID 1284 wrote to memory of 420 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe winlogon.exe PID 1284 wrote to memory of 420 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe winlogon.exe PID 1284 wrote to memory of 420 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe winlogon.exe PID 1284 wrote to memory of 420 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe winlogon.exe PID 1284 wrote to memory of 464 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe services.exe PID 1284 wrote to memory of 464 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe services.exe PID 1284 wrote to memory of 464 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe services.exe PID 1284 wrote to memory of 464 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe services.exe PID 1284 wrote to memory of 464 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe services.exe PID 1284 wrote to memory of 464 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe services.exe PID 1284 wrote to memory of 464 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe services.exe PID 1284 wrote to memory of 480 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe lsass.exe PID 1284 wrote to memory of 480 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe lsass.exe PID 1284 wrote to memory of 480 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe lsass.exe PID 1284 wrote to memory of 480 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe lsass.exe PID 1284 wrote to memory of 480 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe lsass.exe PID 1284 wrote to memory of 480 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe lsass.exe PID 1284 wrote to memory of 480 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe lsass.exe PID 1284 wrote to memory of 488 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe lsm.exe PID 1284 wrote to memory of 488 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe lsm.exe PID 1284 wrote to memory of 488 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe lsm.exe PID 1284 wrote to memory of 488 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe lsm.exe PID 1284 wrote to memory of 488 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe lsm.exe PID 1284 wrote to memory of 488 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe lsm.exe PID 1284 wrote to memory of 488 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe lsm.exe PID 1284 wrote to memory of 600 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe svchost.exe PID 1284 wrote to memory of 600 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe svchost.exe PID 1284 wrote to memory of 600 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe svchost.exe PID 1284 wrote to memory of 600 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe svchost.exe PID 1284 wrote to memory of 600 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe svchost.exe PID 1284 wrote to memory of 600 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe svchost.exe PID 1284 wrote to memory of 600 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe svchost.exe PID 1284 wrote to memory of 676 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe svchost.exe PID 1284 wrote to memory of 676 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe svchost.exe PID 1284 wrote to memory of 676 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe svchost.exe PID 1284 wrote to memory of 676 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe svchost.exe PID 1284 wrote to memory of 676 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe svchost.exe PID 1284 wrote to memory of 676 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe svchost.exe PID 1284 wrote to memory of 676 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe svchost.exe PID 1284 wrote to memory of 760 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe svchost.exe PID 1284 wrote to memory of 760 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe svchost.exe PID 1284 wrote to memory of 760 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe svchost.exe PID 1284 wrote to memory of 760 1284 294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe svchost.exe
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:480
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵PID:464
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵PID:808
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"3⤵PID:1192
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵PID:316
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵PID:1620
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵PID:1128
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵PID:1048
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵PID:984
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵PID:280
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵PID:888
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵PID:844
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵PID:760
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵PID:676
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵PID:600
-
C:\Windows\System.exeC:\Windows\System.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1996 -
C:\Windows\SystemSrv.exeC:\Windows\SystemSrv.exe3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1764
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:420
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:384
-
\\?\C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R1⤵PID:1088
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe"C:\Users\Admin\AppData\Local\Temp\294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a.exe"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686aSrv.exeC:\Users\Admin\AppData\Local\Temp\294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686aSrv.exe3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1352
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe1⤵PID:488
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:372
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\PROGRAM FILES (X86)\MICROSOFT\DESKTOPLAYER.EXEFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Users\Admin\AppData\Local\Temp\294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686aSrv.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Users\Admin\AppData\Local\Temp\294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686aSrv.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\WINDOWS\SYSTEMSRV.EXEFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Windows\System.exeFilesize
284KB
MD50c74c898a73adfbfc35975a833186d5b
SHA1ab246c4d8c50385c722215caf2b038bb04a92e74
SHA256294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a
SHA512c80c92797c64f9ba6e1124a1e8cf281d0b8c79231d9e582187ee826280f5024c5e1a6e2addb8b3ed06cf30e8569821665f77b8e3efba06cdd0be3f41b21d1dde
-
C:\Windows\System.exeFilesize
284KB
MD50c74c898a73adfbfc35975a833186d5b
SHA1ab246c4d8c50385c722215caf2b038bb04a92e74
SHA256294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686a
SHA512c80c92797c64f9ba6e1124a1e8cf281d0b8c79231d9e582187ee826280f5024c5e1a6e2addb8b3ed06cf30e8569821665f77b8e3efba06cdd0be3f41b21d1dde
-
C:\Windows\SystemSrv.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
\Users\Admin\AppData\Local\Temp\294302fb47b5b82ca865cd2d5a8b82ebc02dfbdb91f8d0dee3d3b0159190686aSrv.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
\Users\Admin\AppData\Local\Temp\fjk6134.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
\Windows\Temp\qzkFDA1.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
memory/1284-74-0x000000007EF80000-0x000000007EF8C000-memory.dmpFilesize
48KB
-
memory/1284-73-0x0000000000310000-0x0000000000383000-memory.dmpFilesize
460KB
-
memory/1284-62-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1284-63-0x0000000000310000-0x0000000000383000-memory.dmpFilesize
460KB
-
memory/1284-64-0x0000000000230000-0x000000000025E000-memory.dmpFilesize
184KB
-
memory/1284-71-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1352-56-0x0000000000000000-mapping.dmp
-
memory/1352-61-0x000000007EFA0000-0x000000007EFAC000-memory.dmpFilesize
48KB
-
memory/1352-60-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1352-58-0x0000000075E51000-0x0000000075E53000-memory.dmpFilesize
8KB
-
memory/1764-68-0x0000000000000000-mapping.dmp
-
memory/1764-76-0x000000007EFA0000-0x000000007EFAC000-memory.dmpFilesize
48KB
-
memory/1764-77-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1996-78-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1996-79-0x0000000000220000-0x0000000000293000-memory.dmpFilesize
460KB