a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 02:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
Size

404KB
MD5

49ab5274566c34cad4bcd405c5348486
SHA1

448c4042a27dc42db26fe1e8f818fd7f5868875b
SHA256

a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac
SHA512

d4de90bce42049119ad1ac3f848ba949a3d0813ab250b7d692c1550bf86c98ffe3ef19c115defcc7ce9610379821991516c6759e6865af21fbfcaf0a35e22ead
SSDEEP

3072:P0E93VChT34Sc+tO6b4QksbOlw+GjpbLnpfSb:PR

Score

8^/10

persistence upx

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cvugenral = "C:\\Program Files (x86)\\Windowd UN\\svchosty.exe"	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cvugenral = "C:\\Program Files (x86)\\Windowd UN\\svchosty.exe"	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe

Executes dropped EXE 3 IoCs

pid	Process
3916	svchosty.exe
544	svchosty.exe
992	svchosty.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{6AKCS228-7RSP-82BB-FN67-6EOJS5I2UPFD}	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6AKCS228-7RSP-82BB-FN67-6EOJS5I2UPFD}\StubPath = "C:\\Program Files (x86)\\Windowd UN\\svchosty.exe Restart"	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{6AKCS228-7RSP-82BB-FN67-6EOJS5I2UPFD}	svchosty.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6AKCS228-7RSP-82BB-FN67-6EOJS5I2UPFD}\StubPath = "C:\\Program Files (x86)\\Windowd UN\\svchosty.exe Restart"	svchosty.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2384-135-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral2/memory/2384-138-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral2/memory/2384-139-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral2/memory/2384-147-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral2/memory/2384-549-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral2/memory/5076-550-0x0000000010850000-0x0000000010886000-memory.dmp	upx
behavioral2/memory/5076-554-0x0000000010850000-0x0000000010886000-memory.dmp	upx
behavioral2/memory/544-564-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral2/memory/544-971-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral2/memory/544-975-0x0000000000400000-0x0000000000428000-memory.dmp	upx
behavioral2/memory/992-976-0x0000000010890000-0x00000000108C6000-memory.dmp	upx
behavioral2/memory/992-977-0x0000000010890000-0x00000000108C6000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cvugenral = "C:\\Program Files (x86)\\Windowd UN\\svchosty.exe"	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cvugenral = "C:\\Program Files (x86)\\Windowd UN\\svchosty.exe"	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3044 set thread context of 2384	3044	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	85
PID 3044 set thread context of 0	3044	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
PID 3916 set thread context of 544	3916	svchosty.exe	94
PID 3916 set thread context of 0	3916	svchosty.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windowd UN\logs.dat	svchosty.exe
File created	C:\Program Files (x86)\Windowd UN\svchosty.exe	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
File opened for modification	C:\Program Files (x86)\Windowd UN\svchosty.exe	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
File opened for modification	C:\Program Files (x86)\Windowd UN\plugin.dat	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
File opened for modification	C:\Program Files (x86)\Windowd UN\	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
File created	C:\Program Files (x86)\Windowd UN\logs.dat	svchosty.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
544	svchosty.exe
544	svchosty.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
992	svchosty.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
Token: SeDebugPrivilege	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
Token: SeDebugPrivilege	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
Token: SeDebugPrivilege	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
Token: SeDebugPrivilege	544	svchosty.exe
Token: SeDebugPrivilege	544	svchosty.exe
Token: SeDebugPrivilege	544	svchosty.exe
Token: SeDebugPrivilege	544	svchosty.exe
Token: SeDebugPrivilege	992	svchosty.exe
Token: SeDebugPrivilege	992	svchosty.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3044	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
3916	svchosty.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2384	3044	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	85
PID 3044 wrote to memory of 2384	3044	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	85
PID 3044 wrote to memory of 2384	3044	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	85
PID 3044 wrote to memory of 2384	3044	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	85
PID 3044 wrote to memory of 2384	3044	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	85
PID 3044 wrote to memory of 2384	3044	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	85
PID 3044 wrote to memory of 2384	3044	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	85
PID 3044 wrote to memory of 2384	3044	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	85
PID 3044 wrote to memory of 0	3044	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
PID 3044 wrote to memory of 0	3044	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
PID 3044 wrote to memory of 0	3044	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
PID 3044 wrote to memory of 0	3044	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
PID 3044 wrote to memory of 0	3044	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4
PID 2384 wrote to memory of 608	2384	a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe	4

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:676

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:608
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:312
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1132
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1176

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1232

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1864

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2268

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2088

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1764

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1000

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:1960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1912

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2712

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3360

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3456

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3300

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4412

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3692

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4960

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:684

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3004
- C:\Users\Admin\AppData\Local\Temp\a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
  "C:\Users\Admin\AppData\Local\Temp\a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Users\Admin\AppData\Local\Temp\a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
    C:\Users\Admin\AppData\Local\Temp\a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2384
  - - C:\Users\Admin\AppData\Local\Temp\a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
      C:\Users\Admin\AppData\Local\Temp\a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac.exe
      4⤵
      Adds policy Run key to start application
      Modifies Installed Components in the registry
      Checks computer location settings
      Adds Run key to start application
      Drops file in Program Files directory
      Modifies registry class
      PID:5076
    - - C:\Program Files (x86)\Windowd UN\svchosty.exe
        
        "C:\Program Files (x86)\Windowd UN\svchosty.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3916
      - C:\Program Files (x86)\Windowd UN\svchosty.exe
        
        "C:\Program Files (x86)\Windowd UN\svchosty.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:544
        
        C:\Program Files (x86)\Windowd UN\svchosty.exe
        
        "C:\Program Files (x86)\Windowd UN\svchosty.exe"
        7⤵
        Executes dropped EXE
        Modifies Installed Components in the registry
        Drops file in Program Files directory
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2720

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2688

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1892

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1752

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1648

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:1488

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1316

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1280

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:784
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe
  2⤵
  PID:1288
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:4196
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4024
- C:\Windows\System32\mousocoreworker.exe
  C:\Windows\System32\mousocoreworker.exe -Embedding
  2⤵
  PID:4608

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:760

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:3312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4548

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:4496

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:3384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:988

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:2828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:2564

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:2116

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windowd UN\svchosty.exe

Filesize
404KB

MD5
49ab5274566c34cad4bcd405c5348486

SHA1
448c4042a27dc42db26fe1e8f818fd7f5868875b

SHA256
a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac

SHA512
d4de90bce42049119ad1ac3f848ba949a3d0813ab250b7d692c1550bf86c98ffe3ef19c115defcc7ce9610379821991516c6759e6865af21fbfcaf0a35e22ead

Download Submit
C:\Program Files (x86)\Windowd UN\svchosty.exe

Filesize
404KB

MD5
49ab5274566c34cad4bcd405c5348486

SHA1
448c4042a27dc42db26fe1e8f818fd7f5868875b

SHA256
a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac

SHA512
d4de90bce42049119ad1ac3f848ba949a3d0813ab250b7d692c1550bf86c98ffe3ef19c115defcc7ce9610379821991516c6759e6865af21fbfcaf0a35e22ead

Download Submit
C:\Program Files (x86)\Windowd UN\svchosty.exe

Filesize
404KB

MD5
49ab5274566c34cad4bcd405c5348486

SHA1
448c4042a27dc42db26fe1e8f818fd7f5868875b

SHA256
a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac

SHA512
d4de90bce42049119ad1ac3f848ba949a3d0813ab250b7d692c1550bf86c98ffe3ef19c115defcc7ce9610379821991516c6759e6865af21fbfcaf0a35e22ead

Download Submit
C:\Program Files (x86)\Windowd UN\svchosty.exe

Filesize
404KB

MD5
49ab5274566c34cad4bcd405c5348486

SHA1
448c4042a27dc42db26fe1e8f818fd7f5868875b

SHA256
a37f825529e32e266da351c72866b5f8c6f93e08c2f51728bc467d9b778cd5ac

SHA512
d4de90bce42049119ad1ac3f848ba949a3d0813ab250b7d692c1550bf86c98ffe3ef19c115defcc7ce9610379821991516c6759e6865af21fbfcaf0a35e22ead

Download Submit
memory/544-975-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/544-971-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/544-564-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/992-977-0x0000000010890000-0x00000000108C6000-memory.dmp

Filesize
216KB

Download
memory/992-976-0x0000000010890000-0x00000000108C6000-memory.dmp

Filesize
216KB

Download
memory/2384-205-0x0000000010420000-0x000000001042A000-memory.dmp

Filesize
40KB

Download
memory/2384-177-0x0000000000A70000-0x0000000000A7A000-memory.dmp

Filesize
40KB

Download
memory/2384-198-0x0000000000A90000-0x0000000000A9A000-memory.dmp

Filesize
40KB

Download
memory/2384-135-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2384-549-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2384-138-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2384-139-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2384-184-0x0000000000A80000-0x0000000000A8A000-memory.dmp

Filesize
40KB

Download
memory/2384-191-0x0000000010410000-0x000000001041A000-memory.dmp

Filesize
40KB

Download
memory/2384-141-0x00000000004B0000-0x00000000004BA000-memory.dmp

Filesize
40KB

Download
memory/2384-170-0x0000000000A60000-0x0000000000A6A000-memory.dmp

Filesize
40KB

Download
memory/2384-163-0x0000000000A50000-0x0000000000A5A000-memory.dmp

Filesize
40KB

Download
memory/2384-156-0x00000000004E0000-0x00000000004EA000-memory.dmp

Filesize
40KB

Download
memory/2384-149-0x00000000004D0000-0x00000000004DA000-memory.dmp

Filesize
40KB

Download
memory/2384-147-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/5076-554-0x0000000010850000-0x0000000010886000-memory.dmp

Filesize
216KB

Download
memory/5076-550-0x0000000010850000-0x0000000010886000-memory.dmp

Filesize
216KB

Download