d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 17:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
Size

276KB
MD5

1b4b8ce4f7fce8d8d2fab9f583ce2140
SHA1

555c4e2f30e5f02119b47c0cff8e753404ad4236
SHA256

d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb
SHA512

c9a37b9cf3f29b37681ceae5b17793e4b461527250981faa9e673baebcbb3896ec9f2d20588b8e8440fe694aff7f6113130b690f485a6b43e86c02a6701c9d0b
SSDEEP

3072:go8L5tpV+CSA1AAPoCpxW5ATBfUNjpS1svkTVC9FieYTTLprx/m3qT4S826guKqP:wtpvoCpcNQ1jQdinAl6

Score

10^/10

persistence

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\NeverShowExt = "1"	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1"	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sys = "C:\\WINDOWS\\Fonts\\Fonts.exe"	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\drivers\drivers.cab.exe	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe

Sets file execution options in registry 2 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe\Debugger = "C:\\WINDOWS\\Fonts\\fonts.exe"	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "C:\\WINDOWS\\Fonts\\Fonts.exe"	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\WINDOWS\\Fonts\\tskmgr.exe"	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\auto.exe	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe\Debugger = "C:\\WINDOWS\\system32\\drivers\\drivers.cab.exe"	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\auto.exe\Debugger = "C:\\WINDOWS\\system32\\drivers\\drivers.cab.exe"	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autorun.exe\Debugger = "C:\\WINDOWS\\system32\\drivers\\drivers.cab.exe"	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\WINDOWS\\Media\\rndll32.pif"	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpHost.com"	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autorun.exe	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ = "C:\\WINDOWS\\system32\\dllcache\\Default.exe"	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\WINDOWS\\system\\KEYBOARD.exe"	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ = "C:\\WINDOWS\\system32\\dllcache\\Default.exe"	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\WINDOWS\SysWOW64\dllcache\autorun.inf	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
File created	C:\WINDOWS\SysWOW64\dllcache\autorun.inf	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe

Drops file in System32 directory 19 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
File created	C:\WINDOWS\SysWOW64\dllcache\svchost.exe	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
File opened for modification	C:\WINDOWS\SysWOW64\dllcache\autorun.inf	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
File created	C:\WINDOWS\SysWOW64\dllcache\autorun.inf	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
File opened for modification	C:\WINDOWS\SysWOW64\TASKMGR.EXE	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
File opened for modification	C:\WINDOWS\SysWOW64\dllcache	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
File created	C:\WINDOWS\SysWOW64\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\Global.exe	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
File opened for modification	C:\WINDOWS\SysWOW64\REGEDIT.EXE	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
File created	C:\WINDOWS\SysWOW64\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\svchost.exe	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
File opened for modification	C:\WINDOWS\SysWOW64\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E)\svchost.exe	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
File created	C:\WINDOWS\SysWOW64\dllcache\Default.exe	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
File opened for modification	C:\WINDOWS\SysWOW64\dllcache\	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
File created	C:\WINDOWS\SysWOW64\dllcache\Global.exe	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
File opened for modification	C:\WINDOWS\SysWOW64\regedit.exe	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
File opened for modification	C:\WINDOWS\SysWOW64\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
File created	C:\WINDOWS\SysWOW64\dllcache\tskmgr.exe	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
File opened for modification	C:\WINDOWS\SysWOW64\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\svchost.exe	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
File opened for modification	C:\WINDOWS\SysWOW64\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
File opened for modification	C:\WINDOWS\SysWOW64\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E)\Global.exe	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\WINDOWS\system\KEYBOARD.exe	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
File created	C:\WINDOWS\Media\rndll32.pif	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
File created	C:\WINDOWS\Cursors\Boom.vbs	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
File created	C:\WINDOWS\Fonts\Fonts.exe	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
File created	C:\WINDOWS\pchealth\helpctr\binaries\HelpHost.com	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
File created	C:\WINDOWS\pchealth\Global.exe	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
File created	C:\WINDOWS\Help\microsoft.hlp	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
File created	C:\WINDOWS\Fonts\tskmgr.exe	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
File opened for modification	C:\WINDOWS\Cursors\Boom.vbs	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
File created	C:\WINDOWS\Fonts\wav.wav	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
File opened for modification	C:\WINDOWS\Fonts\wav.wav	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpHost.com"	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\ScreenSaveTimeOut = "30"	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\AutoEndTasks = "1"	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "VBSFile"	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSCFile\Shell\Open\Command	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mscfile\shell\open\command\ = "C:\\WINDOWS\\pchealth\\Global.exe"	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\regfile\Shell\Open\Command	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command\ = "C:\\WINDOWS\\pchealth\\Global.exe"	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mscfile\shell\open\command\ = "C:\\WINDOWS\\Fonts\\Fonts.exe"	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "1"	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\NeverShowExt = "1"	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe

Suspicious behavior: MapViewOfSection 21 IoCs

pid	Process
1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
Token: SeTakeOwnershipPrivilege	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
Token: SeRestorePrivilege	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
Token: SeBackupPrivilege	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
Token: SeChangeNotifyPrivilege	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
Token: SeTakeOwnershipPrivilege	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
Token: SeRestorePrivilege	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
Token: SeBackupPrivilege	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
Token: SeChangeNotifyPrivilege	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 368	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	5
PID 1900 wrote to memory of 368	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	5
PID 1900 wrote to memory of 368	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	5
PID 1900 wrote to memory of 368	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	5
PID 1900 wrote to memory of 368	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	5
PID 1900 wrote to memory of 368	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	5
PID 1900 wrote to memory of 368	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	5
PID 1900 wrote to memory of 376	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	4
PID 1900 wrote to memory of 376	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	4
PID 1900 wrote to memory of 376	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	4
PID 1900 wrote to memory of 376	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	4
PID 1900 wrote to memory of 376	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	4
PID 1900 wrote to memory of 376	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	4
PID 1900 wrote to memory of 376	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	4
PID 1900 wrote to memory of 416	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	3
PID 1900 wrote to memory of 416	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	3
PID 1900 wrote to memory of 416	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	3
PID 1900 wrote to memory of 416	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	3
PID 1900 wrote to memory of 416	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	3
PID 1900 wrote to memory of 416	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	3
PID 1900 wrote to memory of 416	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	3
PID 1900 wrote to memory of 460	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	2
PID 1900 wrote to memory of 460	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	2
PID 1900 wrote to memory of 460	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	2
PID 1900 wrote to memory of 460	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	2
PID 1900 wrote to memory of 460	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	2
PID 1900 wrote to memory of 460	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	2
PID 1900 wrote to memory of 460	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	2
PID 1900 wrote to memory of 476	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	1
PID 1900 wrote to memory of 476	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	1
PID 1900 wrote to memory of 476	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	1
PID 1900 wrote to memory of 476	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	1
PID 1900 wrote to memory of 476	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	1
PID 1900 wrote to memory of 476	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	1
PID 1900 wrote to memory of 476	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	1
PID 1900 wrote to memory of 484	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	8
PID 1900 wrote to memory of 484	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	8
PID 1900 wrote to memory of 484	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	8
PID 1900 wrote to memory of 484	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	8
PID 1900 wrote to memory of 484	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	8
PID 1900 wrote to memory of 484	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	8
PID 1900 wrote to memory of 484	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	8
PID 1900 wrote to memory of 576	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	26
PID 1900 wrote to memory of 576	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	26
PID 1900 wrote to memory of 576	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	26
PID 1900 wrote to memory of 576	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	26
PID 1900 wrote to memory of 576	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	26
PID 1900 wrote to memory of 576	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	26
PID 1900 wrote to memory of 576	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	26
PID 1900 wrote to memory of 652	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	25
PID 1900 wrote to memory of 652	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	25
PID 1900 wrote to memory of 652	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	25
PID 1900 wrote to memory of 652	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	25
PID 1900 wrote to memory of 652	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	25
PID 1900 wrote to memory of 652	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	25
PID 1900 wrote to memory of 652	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	25
PID 1900 wrote to memory of 740	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	24
PID 1900 wrote to memory of 740	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	24
PID 1900 wrote to memory of 740	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	24
PID 1900 wrote to memory of 740	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	24
PID 1900 wrote to memory of 740	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	24
PID 1900 wrote to memory of 740	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	24
PID 1900 wrote to memory of 740	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	24
PID 1900 wrote to memory of 796	1900	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe	23

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableStatusMessages = "1"	d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:476

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:460
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:1584
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:1544
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1244
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:592
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:1008
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:296
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:868
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:824
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:796
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:740
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:652
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:576

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:416

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:376

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:368
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:484

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:1660

C:\Users\Admin\AppData\Local\Temp\d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe
"C:\Users\Admin\AppData\Local\Temp\d552fc1b4c13c929af84c235cbca883b41ef48b6b692e8bbc3bfd975f98fb8fb.exe"
1⤵
- Modifies system executable filetype association
- Adds policy Run key to start application
- Drops file in Drivers directory
- Sets file execution options in registry
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1900

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1412

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1348

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Change Default File Association

T1042

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1900-56-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1900-57-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1900-58-0x00000000742B1000-0x00000000742B3000-memory.dmp

Filesize
8KB

Download
memory/1900-59-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download