946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3

Analysis

max time kernel
151s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20-10-2022 08:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe
Size

124KB
MD5

817737219678764a7fd08f40914d2d51
SHA1

43f8583480b0d101d4068f93b68edff5f61d37fa
SHA256

946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3
SHA512

02c108585f42d19b0dbc0a26ba251acc1d1f15ff9a3de6f6640b935b2d9172e187333ef6969a9b631a71007ba344e610bfa75c151f367cc755fc12d0ab94ee6c
SSDEEP

1536:t5e0OGonYVwR5CiZFjbu+QF0YEF+7oTMrTs5995S+UZZS/zAhkS+yBO5L9FZ9zSM:jeDh2wR5NZ/c7oY+TSJZZS72K3jGiC

Score

8^/10

persistence spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1788	trivax1.Bin.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2784-136-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral2/memory/1788-140-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral2/memory/1788-210-0x0000000000400000-0x0000000000477000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN	trivax1.Bin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\trivax1.Bin.exe = "C:\\trivax1.Bin\\trivax1.Bin.exe"	trivax1.Bin.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\PhishingFilter	trivax1.Bin.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0"	trivax1.Bin.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ShownServiceDownBalloon = "0"	trivax1.Bin.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery	trivax1.Bin.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\ClearBrowsingHistoryOnExit = "0"	trivax1.Bin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe
2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe
2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe
2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe
1788	trivax1.Bin.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe
Token: SeDebugPrivilege	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe
Token: SeDebugPrivilege	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe
Token: SeDebugPrivilege	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe
Token: SeDebugPrivilege	1788	trivax1.Bin.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 900	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	40
PID 2784 wrote to memory of 624	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	3
PID 2784 wrote to memory of 676	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	1
PID 2784 wrote to memory of 784	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	80
PID 2784 wrote to memory of 780	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	79
PID 2784 wrote to memory of 796	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	78
PID 2784 wrote to memory of 908	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	77
PID 2784 wrote to memory of 960	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	76
PID 2784 wrote to memory of 392	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	8
PID 2784 wrote to memory of 496	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	75
PID 2784 wrote to memory of 864	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	74
PID 2784 wrote to memory of 724	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	73
PID 2784 wrote to memory of 1028	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	72
PID 2784 wrote to memory of 1108	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	71
PID 2784 wrote to memory of 1120	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	9
PID 2784 wrote to memory of 1160	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	70
PID 2784 wrote to memory of 1248	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	69
PID 2784 wrote to memory of 1292	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	68
PID 2784 wrote to memory of 1348	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	67
PID 2784 wrote to memory of 1356	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	10
PID 2784 wrote to memory of 1400	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	66
PID 2784 wrote to memory of 1460	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	65
PID 2784 wrote to memory of 1560	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	64
PID 2784 wrote to memory of 1572	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	63
PID 2784 wrote to memory of 1616	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	62
PID 2784 wrote to memory of 1648	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	61
PID 2784 wrote to memory of 1760	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	60
PID 2784 wrote to memory of 1800	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	59
PID 2784 wrote to memory of 1868	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	58
PID 2784 wrote to memory of 1880	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	57
PID 2784 wrote to memory of 1920	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	56
PID 2784 wrote to memory of 1968	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	55
PID 2784 wrote to memory of 2008	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	54
PID 2784 wrote to memory of 1600	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	53
PID 2784 wrote to memory of 1276	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	11
PID 2784 wrote to memory of 2080	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	52
PID 2784 wrote to memory of 2132	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	51
PID 2784 wrote to memory of 2348	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	12
PID 2784 wrote to memory of 2356	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	50
PID 2784 wrote to memory of 2404	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	49
PID 2784 wrote to memory of 2432	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	48
PID 2784 wrote to memory of 2484	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	47
PID 2784 wrote to memory of 2504	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	46
PID 2784 wrote to memory of 2512	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	13
PID 2784 wrote to memory of 2520	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	45
PID 2784 wrote to memory of 2544	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	44
PID 2784 wrote to memory of 2620	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	43
PID 2784 wrote to memory of 2768	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	42
PID 2784 wrote to memory of 900	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	40
PID 2784 wrote to memory of 3080	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	39
PID 2784 wrote to memory of 3288	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	38
PID 2784 wrote to memory of 3376	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	37
PID 2784 wrote to memory of 3444	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	14
PID 2784 wrote to memory of 3548	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	36
PID 2784 wrote to memory of 3704	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	35
PID 2784 wrote to memory of 4416	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	33
PID 2784 wrote to memory of 4652	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	32
PID 2784 wrote to memory of 4532	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	30
PID 2784 wrote to memory of 1476	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	28
PID 2784 wrote to memory of 2604	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	27
PID 2784 wrote to memory of 3468	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	26
PID 2784 wrote to memory of 836	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	25
PID 2784 wrote to memory of 5048	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	24
PID 2784 wrote to memory of 2412	2784	946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe	23

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:676

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:624
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:392
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1120
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:1276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2512

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3444

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2792

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:4992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:2108

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:2056

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:2412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:5048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:836

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:3468

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:2604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:1476

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4532

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4652

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4416

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3704

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3548

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3376

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3080

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:900
- C:\Users\Admin\AppData\Local\Temp\946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe
  "C:\Users\Admin\AppData\Local\Temp\946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\trivax1.Bin\trivax1.Bin.exe
    "C:\trivax1.Bin\trivax1.Bin.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Modifies Internet Explorer Phishing Filter
    - Modifies Internet Explorer settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2620

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2504

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2432

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2356

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2132

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2080

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1600

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1968

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1880

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1868

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1800

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1648

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1400

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1292

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1028

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:724

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:796
- C:\Windows\System32\mousocoreworker.exe
  C:\Windows\System32\mousocoreworker.exe -Embedding
  2⤵
  PID:4684

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:784

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 5bc16881971e99488b2c0e8f0408e7eb aTqyTZTPLkKDtX8qeyfn5g.0.1.0.0.0
1⤵
PID:3264
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:3760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:4292

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:2324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:4440

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\trivax1.Bin\trivax1.Bin.exe

Filesize
124KB

MD5
817737219678764a7fd08f40914d2d51

SHA1
43f8583480b0d101d4068f93b68edff5f61d37fa

SHA256
946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3

SHA512
02c108585f42d19b0dbc0a26ba251acc1d1f15ff9a3de6f6640b935b2d9172e187333ef6969a9b631a71007ba344e610bfa75c151f367cc755fc12d0ab94ee6c

Download Submit
C:\trivax1.Bin\trivax1.Bin.exe

Filesize
124KB

MD5
817737219678764a7fd08f40914d2d51

SHA1
43f8583480b0d101d4068f93b68edff5f61d37fa

SHA256
946c131922e88b7797cf24dd6c61c4dcadbe732b94be1210615cdd7602ebf2e3

SHA512
02c108585f42d19b0dbc0a26ba251acc1d1f15ff9a3de6f6640b935b2d9172e187333ef6969a9b631a71007ba344e610bfa75c151f367cc755fc12d0ab94ee6c

Download Submit
memory/900-141-0x000000000BAD0000-0x000000000BB15000-memory.dmp

Filesize
276KB

Download
memory/900-189-0x000000000BB50000-0x000000000BB9F000-memory.dmp

Filesize
316KB

Download
memory/1788-138-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1788-139-0x00000000020F0000-0x0000000002167000-memory.dmp

Filesize
476KB

Download
memory/1788-140-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1788-208-0x0000000002170000-0x00000000021B5000-memory.dmp

Filesize
276KB

Download
memory/1788-209-0x00000000004F0000-0x00000000004F5000-memory.dmp

Filesize
20KB

Download
memory/1788-210-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1788-214-0x0000000002170000-0x00000000021B5000-memory.dmp

Filesize
276KB

Download
memory/2784-137-0x0000000002090000-0x0000000002107000-memory.dmp

Filesize
476KB

Download
memory/2784-136-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/2784-132-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download