a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac

Analysis

max time kernel
163s
max time network
180s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20-10-2022 02:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
Size

404KB
MD5

49ab5274566c34cad4bcd405c5348486
SHA1

448c4042a27dc42db26fe1e8f818fd7f5868875b
SHA256

a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac
SHA512

d4de90bce42049119ad1ac3f848ba949a3d0813ab250b7d692c1550bf86c98ffe3ef19c115defcc7ce9610379821991516c6759e6865af21fbfcaf0a35e22ead
SSDEEP

3072:P0E93VChT34Sc+tO6b4QksbOlw+GjpbLnpfSb:PR

Score

8^/10

persistence upx

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cvugenral = "C:\\Program Files (x86)\\Windowd UN\\svchosty.exe"	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cvugenral = "C:\\Program Files (x86)\\Windowd UN\\svchosty.exe"	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe

Executes dropped EXE 3 IoCs

pid	Process
956	svchosty.exe
620	svchosty.exe
1756	svchosty.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{6AKCS228-7RSP-82BB-FN67-6EOJS5I2UPFD}	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6AKCS228-7RSP-82BB-FN67-6EOJS5I2UPFD}\StubPath = "C:\\Program Files (x86)\\Windowd UN\\svchosty.exe Restart"	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{6AKCS228-7RSP-82BB-FN67-6EOJS5I2UPFD}	svchosty.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6AKCS228-7RSP-82BB-FN67-6EOJS5I2UPFD}\StubPath = "C:\\Program Files (x86)\\Windowd UN\\svchosty.exe Restart"	svchosty.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1696-56-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral1/memory/1696-60-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral1/memory/1696-61-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral1/memory/1696-62-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral1/memory/1696-239-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral1/memory/1696-293-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral1/memory/1580-295-0x0000000010580000-0x00000000105B6000-memory.dmp	upx
behavioral1/memory/620-310-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral1/memory/620-451-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral1/memory/620-496-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral1/memory/1756-498-0x0000000010590000-0x00000000105C6000-memory.dmp	upx
behavioral1/memory/1756-499-0x0000000010590000-0x00000000105C6000-memory.dmp	upx

Loads dropped DLL 2 IoCs

pid	Process
1580	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
1580	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cvugenral = "C:\\Program Files (x86)\\Windowd UN\\svchosty.exe"	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\cvugenral = "C:\\Program Files (x86)\\Windowd UN\\svchosty.exe"	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 548 set thread context of 1696	548	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	27
PID 548 set thread context of 0	548	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
PID 956 set thread context of 620	956	svchosty.exe	30
PID 956 set thread context of 0	956	svchosty.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windowd UN\svchosty.exe	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
File opened for modification	C:\Program Files (x86)\Windowd UN\svchosty.exe	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
File opened for modification	C:\Program Files (x86)\Windowd UN\plugin.dat	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
File opened for modification	C:\Program Files (x86)\Windowd UN\	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
File created	C:\Program Files (x86)\Windowd UN\logs.dat	svchosty.exe
File opened for modification	C:\Program Files (x86)\Windowd UN\logs.dat	svchosty.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
620	svchosty.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1756	svchosty.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
Token: SeDebugPrivilege	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
Token: SeDebugPrivilege	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
Token: SeDebugPrivilege	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
Token: SeDebugPrivilege	620	svchosty.exe
Token: SeDebugPrivilege	620	svchosty.exe
Token: SeDebugPrivilege	620	svchosty.exe
Token: SeDebugPrivilege	620	svchosty.exe
Token: SeDebugPrivilege	1756	svchosty.exe
Token: SeDebugPrivilege	1756	svchosty.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
548	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
956	svchosty.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 1696	548	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	27
PID 548 wrote to memory of 1696	548	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	27
PID 548 wrote to memory of 1696	548	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	27
PID 548 wrote to memory of 1696	548	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	27
PID 548 wrote to memory of 1696	548	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	27
PID 548 wrote to memory of 1696	548	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	27
PID 548 wrote to memory of 1696	548	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	27
PID 548 wrote to memory of 1696	548	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	27
PID 548 wrote to memory of 1696	548	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	27
PID 548 wrote to memory of 0	548	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
PID 548 wrote to memory of 0	548	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
PID 548 wrote to memory of 0	548	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
PID 548 wrote to memory of 0	548	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
PID 548 wrote to memory of 0	548	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1
PID 1696 wrote to memory of 260	1696	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	1

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:260

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:372
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:480
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:464
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1084
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:1680
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:1052
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1104
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:276
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:284
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:884
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:844
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:808
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:748
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:664
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:584
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:488

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:332

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:2036

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1216
- C:\Users\Admin\AppData\Local\Temp\a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
  "C:\Users\Admin\AppData\Local\Temp\a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:548
- - C:\Users\Admin\AppData\Local\Temp\a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
    C:\Users\Admin\AppData\Local\Temp\a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1696
  - - C:\Users\Admin\AppData\Local\Temp\a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
      C:\Users\Admin\AppData\Local\Temp\a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
      4⤵
      Adds policy Run key to start application
      Modifies Installed Components in the registry
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Program Files directory
      PID:1580
    - - C:\Program Files (x86)\Windowd UN\svchosty.exe
        
        "C:\Program Files (x86)\Windowd UN\svchosty.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:956
      - C:\Program Files (x86)\Windowd UN\svchosty.exe
        
        "C:\Program Files (x86)\Windowd UN\svchosty.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:620
        
        C:\Program Files (x86)\Windowd UN\svchosty.exe
        
        "C:\Program Files (x86)\Windowd UN\svchosty.exe"
        7⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Drops file in Program Files directory
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:1756

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1184

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windowd UN\svchosty.exe

Filesize
404KB

MD5
49ab5274566c34cad4bcd405c5348486

SHA1
448c4042a27dc42db26fe1e8f818fd7f5868875b

SHA256
a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac

SHA512
d4de90bce42049119ad1ac3f848ba949a3d0813ab250b7d692c1550bf86c98ffe3ef19c115defcc7ce9610379821991516c6759e6865af21fbfcaf0a35e22ead

Download Submit
C:\Program Files (x86)\Windowd UN\svchosty.exe

Filesize
404KB

MD5
49ab5274566c34cad4bcd405c5348486

SHA1
448c4042a27dc42db26fe1e8f818fd7f5868875b

SHA256
a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac

SHA512
d4de90bce42049119ad1ac3f848ba949a3d0813ab250b7d692c1550bf86c98ffe3ef19c115defcc7ce9610379821991516c6759e6865af21fbfcaf0a35e22ead

Download Submit
C:\Program Files (x86)\Windowd UN\svchosty.exe

Filesize
404KB

MD5
49ab5274566c34cad4bcd405c5348486

SHA1
448c4042a27dc42db26fe1e8f818fd7f5868875b

SHA256
a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac

SHA512
d4de90bce42049119ad1ac3f848ba949a3d0813ab250b7d692c1550bf86c98ffe3ef19c115defcc7ce9610379821991516c6759e6865af21fbfcaf0a35e22ead

Download Submit
C:\Program Files (x86)\Windowd UN\svchosty.exe

Filesize
404KB

MD5
49ab5274566c34cad4bcd405c5348486

SHA1
448c4042a27dc42db26fe1e8f818fd7f5868875b

SHA256
a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac

SHA512
d4de90bce42049119ad1ac3f848ba949a3d0813ab250b7d692c1550bf86c98ffe3ef19c115defcc7ce9610379821991516c6759e6865af21fbfcaf0a35e22ead

Download Submit
\Program Files (x86)\Windowd UN\svchosty.exe

Filesize
404KB

MD5
49ab5274566c34cad4bcd405c5348486

SHA1
448c4042a27dc42db26fe1e8f818fd7f5868875b

SHA256
a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac

SHA512
d4de90bce42049119ad1ac3f848ba949a3d0813ab250b7d692c1550bf86c98ffe3ef19c115defcc7ce9610379821991516c6759e6865af21fbfcaf0a35e22ead

Download Submit
\Program Files (x86)\Windowd UN\svchosty.exe

Filesize
404KB

MD5
49ab5274566c34cad4bcd405c5348486

SHA1
448c4042a27dc42db26fe1e8f818fd7f5868875b

SHA256
a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac

SHA512
d4de90bce42049119ad1ac3f848ba949a3d0813ab250b7d692c1550bf86c98ffe3ef19c115defcc7ce9610379821991516c6759e6865af21fbfcaf0a35e22ead

Download Submit
memory/260-84-0x0000000010410000-0x000000001041A000-memory.dmp

Filesize
40KB

Download
memory/620-496-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/620-451-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/620-310-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1580-295-0x0000000010580000-0x00000000105B6000-memory.dmp

Filesize
216KB

Download
memory/1696-239-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1696-60-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1696-293-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1696-123-0x0000000010460000-0x000000001046A000-memory.dmp

Filesize
40KB

Download
memory/1696-71-0x0000000000270000-0x000000000027A000-memory.dmp

Filesize
40KB

Download
memory/1696-114-0x0000000010450000-0x000000001045A000-memory.dmp

Filesize
40KB

Download
memory/1696-64-0x0000000000260000-0x000000000026A000-memory.dmp

Filesize
40KB

Download
memory/1696-62-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1696-61-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1696-78-0x0000000010410000-0x000000001041A000-memory.dmp

Filesize
40KB

Download
memory/1696-56-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1696-105-0x0000000010440000-0x000000001044A000-memory.dmp

Filesize
40KB

Download
memory/1696-96-0x0000000010430000-0x000000001043A000-memory.dmp

Filesize
40KB

Download
memory/1696-87-0x0000000010420000-0x000000001042A000-memory.dmp

Filesize
40KB

Download
memory/1756-498-0x0000000010590000-0x00000000105C6000-memory.dmp

Filesize
216KB

Download
memory/1756-499-0x0000000010590000-0x00000000105C6000-memory.dmp

Filesize
216KB

Download