Overview
overview
10Static
static
XISE WBMS ...��.exe
windows7-x64
10XISE WBMS ...��.exe
windows10-2004-x64
10fz.dll
windows7-x64
3fz.dll
windows10-2004-x64
3jiaoben/zhu/asp/1.asp
windows7-x64
3jiaoben/zhu/asp/1.asp
windows10-2004-x64
3xise/XISE ....9.exe
windows7-x64
10xise/XISE ....9.exe
windows10-2004-x64
10xise/jiaob...se.vbs
windows7-x64
1xise/jiaob...se.vbs
windows10-2004-x64
1xise/jsc.dll
windows7-x64
3xise/jsc.dll
windows10-2004-x64
3Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
18-09-2022 01:45
Static task
static1
Behavioral task
behavioral1
Sample
XISE WBMS 2020官方正版.exe
Resource
win7-20220812-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
XISE WBMS 2020官方正版.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral3
Sample
fz.dll
Resource
win7-20220812-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
fz.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
jiaoben/zhu/asp/1.asp
Resource
win7-20220901-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
jiaoben/zhu/asp/1.asp
Resource
win10v2004-20220812-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
xise/XISE 菜刀管理7.9.exe
Resource
win7-20220812-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral8
Sample
xise/XISE 菜刀管理7.9.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral9
Sample
xise/jiaoben/ASPhorse.vbs
Resource
win7-20220901-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
xise/jiaoben/ASPhorse.vbs
Resource
win10v2004-20220812-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
xise/jsc.dll
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
xise/jsc.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
XISE WBMS 2020官方正版.exe
-
Size
4.0MB
-
MD5
a47caab73754524cc784192093c20e29
-
SHA1
e51864c3b164629bc1fc37b45fee5681dc8acacb
-
SHA256
aac091f5d270dc494cb1730c74d6568a3bc4eef593f7de539bf258acebaa46d0
-
SHA512
b6e06a55208fbeb74fa281666366bd88a2c62a52fa501e08d8deeed16ecf9c703fee477a9920da05e38be6a8946045024a4d398135fcc986a5294690cfef2292
-
SSDEEP
98304:Hnsmtk2aakvWib3jEvh6TnA20+eYiwgyvraKFt:HLab3o56TA20nAdu8t
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 7 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" XISE WBMS 2020官方正版.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" XISE WBMS 2020官方正版.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List XISE WBMS 2020官方正版.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile XISE WBMS 2020官方正版.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications XISE WBMS 2020官方正版.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\XISE WBMS 2020????.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XISE WBMS 2020????.exe:*:enabled:@shell32.dll,-1" XISE WBMS 2020官方正版.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" XISE WBMS 2020官方正版.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" XISE WBMS 2020官方正版.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" XISE WBMS 2020官方正版.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" XISE WBMS 2020官方正版.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" XISE WBMS 2020官方正版.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" XISE WBMS 2020官方正版.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" XISE WBMS 2020官方正版.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" XISE WBMS 2020官方正版.exe -
resource yara_rule behavioral2/memory/4128-132-0x0000000002770000-0x00000000037FE000-memory.dmp upx behavioral2/memory/4128-133-0x0000000002770000-0x00000000037FE000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" XISE WBMS 2020官方正版.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc XISE WBMS 2020官方正版.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" XISE WBMS 2020官方正版.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" XISE WBMS 2020官方正版.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" XISE WBMS 2020官方正版.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" XISE WBMS 2020官方正版.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" XISE WBMS 2020官方正版.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" XISE WBMS 2020官方正版.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" XISE WBMS 2020官方正版.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: XISE WBMS 2020官方正版.exe File opened (read-only) \??\Q: XISE WBMS 2020官方正版.exe File opened (read-only) \??\T: XISE WBMS 2020官方正版.exe File opened (read-only) \??\Z: XISE WBMS 2020官方正版.exe File opened (read-only) \??\G: XISE WBMS 2020官方正版.exe File opened (read-only) \??\J: XISE WBMS 2020官方正版.exe File opened (read-only) \??\M: XISE WBMS 2020官方正版.exe File opened (read-only) \??\O: XISE WBMS 2020官方正版.exe File opened (read-only) \??\U: XISE WBMS 2020官方正版.exe File opened (read-only) \??\W: XISE WBMS 2020官方正版.exe File opened (read-only) \??\Y: XISE WBMS 2020官方正版.exe File opened (read-only) \??\E: XISE WBMS 2020官方正版.exe File opened (read-only) \??\F: XISE WBMS 2020官方正版.exe File opened (read-only) \??\I: XISE WBMS 2020官方正版.exe File opened (read-only) \??\S: XISE WBMS 2020官方正版.exe File opened (read-only) \??\V: XISE WBMS 2020官方正版.exe File opened (read-only) \??\H: XISE WBMS 2020官方正版.exe File opened (read-only) \??\L: XISE WBMS 2020官方正版.exe File opened (read-only) \??\R: XISE WBMS 2020官方正版.exe File opened (read-only) \??\K: XISE WBMS 2020官方正版.exe File opened (read-only) \??\P: XISE WBMS 2020官方正版.exe File opened (read-only) \??\X: XISE WBMS 2020官方正版.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf XISE WBMS 2020官方正版.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\7-ZIP\7ZG.EXE XISE WBMS 2020官方正版.exe File opened for modification C:\PROGRAM FILES\7-ZIP\UNINSTALL.EXE XISE WBMS 2020官方正版.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe XISE WBMS 2020官方正版.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe XISE WBMS 2020官方正版.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe XISE WBMS 2020官方正版.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe XISE WBMS 2020官方正版.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe XISE WBMS 2020官方正版.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7Z.EXE XISE WBMS 2020官方正版.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7ZFM.EXE XISE WBMS 2020官方正版.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe XISE WBMS 2020官方正版.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe XISE WBMS 2020官方正版.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe XISE WBMS 2020官方正版.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe XISE WBMS 2020官方正版.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe XISE WBMS 2020官方正版.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe XISE WBMS 2020官方正版.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI XISE WBMS 2020官方正版.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe -
Suspicious behavior: MapViewOfSection 64 IoCs
pid Process 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe 4128 XISE WBMS 2020官方正版.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe Token: SeDebugPrivilege 4128 XISE WBMS 2020官方正版.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4128 wrote to memory of 616 4128 XISE WBMS 2020官方正版.exe 3 PID 4128 wrote to memory of 616 4128 XISE WBMS 2020官方正版.exe 3 PID 4128 wrote to memory of 616 4128 XISE WBMS 2020官方正版.exe 3 PID 4128 wrote to memory of 616 4128 XISE WBMS 2020官方正版.exe 3 PID 4128 wrote to memory of 616 4128 XISE WBMS 2020官方正版.exe 3 PID 4128 wrote to memory of 616 4128 XISE WBMS 2020官方正版.exe 3 PID 4128 wrote to memory of 680 4128 XISE WBMS 2020官方正版.exe 1 PID 4128 wrote to memory of 680 4128 XISE WBMS 2020官方正版.exe 1 PID 4128 wrote to memory of 680 4128 XISE WBMS 2020官方正版.exe 1 PID 4128 wrote to memory of 680 4128 XISE WBMS 2020官方正版.exe 1 PID 4128 wrote to memory of 680 4128 XISE WBMS 2020官方正版.exe 1 PID 4128 wrote to memory of 680 4128 XISE WBMS 2020官方正版.exe 1 PID 4128 wrote to memory of 788 4128 XISE WBMS 2020官方正版.exe 80 PID 4128 wrote to memory of 788 4128 XISE WBMS 2020官方正版.exe 80 PID 4128 wrote to memory of 788 4128 XISE WBMS 2020官方正版.exe 80 PID 4128 wrote to memory of 788 4128 XISE WBMS 2020官方正版.exe 80 PID 4128 wrote to memory of 788 4128 XISE WBMS 2020官方正版.exe 80 PID 4128 wrote to memory of 788 4128 XISE WBMS 2020官方正版.exe 80 PID 4128 wrote to memory of 800 4128 XISE WBMS 2020官方正版.exe 8 PID 4128 wrote to memory of 800 4128 XISE WBMS 2020官方正版.exe 8 PID 4128 wrote to memory of 800 4128 XISE WBMS 2020官方正版.exe 8 PID 4128 wrote to memory of 800 4128 XISE WBMS 2020官方正版.exe 8 PID 4128 wrote to memory of 800 4128 XISE WBMS 2020官方正版.exe 8 PID 4128 wrote to memory of 800 4128 XISE WBMS 2020官方正版.exe 8 PID 4128 wrote to memory of 808 4128 XISE WBMS 2020官方正版.exe 79 PID 4128 wrote to memory of 808 4128 XISE WBMS 2020官方正版.exe 79 PID 4128 wrote to memory of 808 4128 XISE WBMS 2020官方正版.exe 79 PID 4128 wrote to memory of 808 4128 XISE WBMS 2020官方正版.exe 79 PID 4128 wrote to memory of 808 4128 XISE WBMS 2020官方正版.exe 79 PID 4128 wrote to memory of 808 4128 XISE WBMS 2020官方正版.exe 79 PID 4128 wrote to memory of 912 4128 XISE WBMS 2020官方正版.exe 9 PID 4128 wrote to memory of 912 4128 XISE WBMS 2020官方正版.exe 9 PID 4128 wrote to memory of 912 4128 XISE WBMS 2020官方正版.exe 9 PID 4128 wrote to memory of 912 4128 XISE WBMS 2020官方正版.exe 9 PID 4128 wrote to memory of 912 4128 XISE WBMS 2020官方正版.exe 9 PID 4128 wrote to memory of 912 4128 XISE WBMS 2020官方正版.exe 9 PID 4128 wrote to memory of 960 4128 XISE WBMS 2020官方正版.exe 78 PID 4128 wrote to memory of 960 4128 XISE WBMS 2020官方正版.exe 78 PID 4128 wrote to memory of 960 4128 XISE WBMS 2020官方正版.exe 78 PID 4128 wrote to memory of 960 4128 XISE WBMS 2020官方正版.exe 78 PID 4128 wrote to memory of 960 4128 XISE WBMS 2020官方正版.exe 78 PID 4128 wrote to memory of 960 4128 XISE WBMS 2020官方正版.exe 78 PID 4128 wrote to memory of 376 4128 XISE WBMS 2020官方正版.exe 10 PID 4128 wrote to memory of 376 4128 XISE WBMS 2020官方正版.exe 10 PID 4128 wrote to memory of 376 4128 XISE WBMS 2020官方正版.exe 10 PID 4128 wrote to memory of 376 4128 XISE WBMS 2020官方正版.exe 10 PID 4128 wrote to memory of 376 4128 XISE WBMS 2020官方正版.exe 10 PID 4128 wrote to memory of 376 4128 XISE WBMS 2020官方正版.exe 10 PID 4128 wrote to memory of 388 4128 XISE WBMS 2020官方正版.exe 77 PID 4128 wrote to memory of 388 4128 XISE WBMS 2020官方正版.exe 77 PID 4128 wrote to memory of 388 4128 XISE WBMS 2020官方正版.exe 77 PID 4128 wrote to memory of 388 4128 XISE WBMS 2020官方正版.exe 77 PID 4128 wrote to memory of 388 4128 XISE WBMS 2020官方正版.exe 77 PID 4128 wrote to memory of 388 4128 XISE WBMS 2020官方正版.exe 77 PID 4128 wrote to memory of 664 4128 XISE WBMS 2020官方正版.exe 11 PID 4128 wrote to memory of 664 4128 XISE WBMS 2020官方正版.exe 11 PID 4128 wrote to memory of 664 4128 XISE WBMS 2020官方正版.exe 11 PID 4128 wrote to memory of 664 4128 XISE WBMS 2020官方正版.exe 11 PID 4128 wrote to memory of 664 4128 XISE WBMS 2020官方正版.exe 11 PID 4128 wrote to memory of 664 4128 XISE WBMS 2020官方正版.exe 11 PID 4128 wrote to memory of 632 4128 XISE WBMS 2020官方正版.exe 76 PID 4128 wrote to memory of 632 4128 XISE WBMS 2020官方正版.exe 76 PID 4128 wrote to memory of 632 4128 XISE WBMS 2020官方正版.exe 76 PID 4128 wrote to memory of 632 4128 XISE WBMS 2020官方正版.exe 76 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" XISE WBMS 2020官方正版.exe
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:680
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:616
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"2⤵PID:800
-
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:376
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵PID:912
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:664
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1136
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵PID:2460
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1400
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s FontCache1⤵PID:1672
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1824
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:2060
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2372
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2452
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2700
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\XISE WBMS 2020官方正版.exe"C:\Users\Admin\AppData\Local\Temp\XISE WBMS 2020官方正版.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4128
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3644
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3468
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3872
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵PID:4696
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:1764
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵PID:2396
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:2732
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵PID:2776
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca1⤵PID:3924
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time1⤵PID:2672
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵PID:1532
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe1⤵PID:4732
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:4640
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:3148
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4796
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:4564
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3724
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3380
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3196
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2716
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵PID:2692
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵PID:2680
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:2620
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵PID:2604
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2444
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2408
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2180
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2164
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵PID:2120
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:2020
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:1988
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1936
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:1916
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1800
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1700
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1680
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1600
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1488
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1416
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1364
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1356
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1332
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1196
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵PID:1188
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵PID:1084
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1032
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:632
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:388
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:960
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:808
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵PID:788