Analysis
-
max time kernel
183s -
max time network
192s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
21/10/2022, 01:48
Static task
static1
Behavioral task
behavioral1
Sample
567e0d50c4da1225d9512eae64286df27ea180081f6f3a48c8ef861db9ce7e73.exe
Resource
win7-20220812-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
567e0d50c4da1225d9512eae64286df27ea180081f6f3a48c8ef861db9ce7e73.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
19 signatures
150 seconds
General
-
Target
567e0d50c4da1225d9512eae64286df27ea180081f6f3a48c8ef861db9ce7e73.exe
-
Size
196KB
-
MD5
611e2a808f54ea75760c59d4fa414570
-
SHA1
100d74711ce6560347f37106ef9aa07c23914dbf
-
SHA256
567e0d50c4da1225d9512eae64286df27ea180081f6f3a48c8ef861db9ce7e73
-
SHA512
637d234227c059ecff96a059950a7e84a02b12269dca8f26472c25cd97b584f6146e8ff1638d8107e7246b0b2f678415be37ab2b9d184d462975f12835e83696
-
SSDEEP
1536:OUaDbmpjK86rbrADTIXJzS+lfSBQk2WXhMdkR6NJvCXvPTE/txDDdi1+H:Ss44IXcYfSiKPP1+H
Score
10/10
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" svchost.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3" svchost.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1" svchost.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" svchost.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 1700 winlogon.exe -
Sets file execution options in registry 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cwntdwmo.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ndd32.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scvhosl.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sweepnet.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tc.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avxmonitor9x.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mghtml.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\neomonitor.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\portdetective.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safeweb.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sharedaccess.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vcsetup.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav8.0.0.357es.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avsched32.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Filemon.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tmntsrv.exe svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tracerpt.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wink.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fa-setup.exe svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nav80try.exe svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winservices.exe svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgserv9.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icsupp.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\schedapp.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vcleaner.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vcleaner.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\exantivirus-cnet.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Safari.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\escanv95.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navapsvc.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npscheck.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcc2002s902.exe svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xscan.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HJTInstall.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dvp95_0.exe svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icsupp.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srwatch.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\doors.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netinfo.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pfwadmin.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdclt.exe svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fwinstall.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsched.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ldpromenu.exe svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xpf202en.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hwpe.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpf.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pavproxy.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pcscan.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pf2.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FPAVServer.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avp32.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gibe.exe svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nai_vs_stat.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vpc42.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winppr32.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\f-agnt95.exe svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpfagent.exe svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mssmmc32.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trjscan.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vscenu6.02d30.exe svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zapro.exe svchost.exe -
resource yara_rule behavioral1/memory/1052-66-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/1052-69-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/1052-73-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/1008-80-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/1052-82-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/1052-83-0x0000000000400000-0x000000000041E000-memory.dmp upx -
Loads dropped DLL 2 IoCs
pid Process 976 567e0d50c4da1225d9512eae64286df27ea180081f6f3a48c8ef861db9ce7e73.exe 976 567e0d50c4da1225d9512eae64286df27ea180081f6f3a48c8ef861db9ce7e73.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\NVIDIA Media Center Library = "C:\\Users\\Admin\\Admin1\\winlogon.exe" svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NVIDIA Media Center Library = "C:\\Users\\Admin\\Admin1\\winlogon.exe" svchost.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run svchost.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1700 set thread context of 1052 1700 winlogon.exe 29 PID 1700 set thread context of 1008 1700 winlogon.exe 30 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Local Page = "http://1.-e-.a-l-v-d-z-o0-n-x-6-v-0-q-q-m-7-g-d-z-7-7-o-b-m-7-z-4-a-q-0.info" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Local Page = "http://3-2-x-1-w-1-w-7-f-9-7.-a-f-6-u-6-v-9-v-s-.j-z-0-3-0-u-u-x-f-1l-3-l-h-w-b-q-z-u-5-n-l-l-m-s-5-v-s-z-g.info" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://9-6.-j-y-.a-l-v-d-z-o0-n-x-6-v-0-q-q-m-7-g-d-z-7-7-o-b-m-7-z-4-a-q-0.info" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL = "http://s-8-a-1-5-h-e-5-5-4-b-l-u-0-k-z-5-o-.8-v-.5-b-e-n-t-f-p-p-7-1-1-0-7-c-q-0-3-00-6-u-7-t-1-n-y-q-u-f-u.info" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://f-7-8.-u-9-b-.i-k-r-g-1-0-u-5-1-f-3-g-li-9-p-1-x-t-6-g-l-8-m-q-y-s-k-6-l.info" svchost.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page = "http://8-9-1-.9-i-.i-k-r-g-1-0-u-5-1-f-3-g-li-9-p-1-x-t-6-g-l-8-m-q-y-s-k-6-l.info" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://0-z-i-2-b-.z-.u-l-c-6-e-p-a-a-0-z-m-s-m-00-v-2-i-7-5-f-l-7-7-l-t-j-h-h-9.info" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://l.-.j-z-0-3-0-u-u-x-f-1l-3-l-h-w-b-q-z-u-5-n-l-l-m-s-5-v-s-z-g.info" svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main svchost.exe -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://7.-h-x-r-g-1-2-.u-l-c-6-e-p-a-a-0-z-m-s-m-00-v-2-i-7-5-f-l-7-7-l-t-j-h-h-9.info" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://p.-.a-l-v-d-z-o0-n-x-6-v-0-q-q-m-7-g-d-z-7-7-o-b-m-7-z-4-a-q-0.info" svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe 1052 svchost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeBackupPrivilege 1052 svchost.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 976 567e0d50c4da1225d9512eae64286df27ea180081f6f3a48c8ef861db9ce7e73.exe 1700 winlogon.exe 1052 svchost.exe 1008 svchost.exe 1052 svchost.exe 1052 svchost.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 976 wrote to memory of 1700 976 567e0d50c4da1225d9512eae64286df27ea180081f6f3a48c8ef861db9ce7e73.exe 28 PID 976 wrote to memory of 1700 976 567e0d50c4da1225d9512eae64286df27ea180081f6f3a48c8ef861db9ce7e73.exe 28 PID 976 wrote to memory of 1700 976 567e0d50c4da1225d9512eae64286df27ea180081f6f3a48c8ef861db9ce7e73.exe 28 PID 976 wrote to memory of 1700 976 567e0d50c4da1225d9512eae64286df27ea180081f6f3a48c8ef861db9ce7e73.exe 28 PID 1700 wrote to memory of 1052 1700 winlogon.exe 29 PID 1700 wrote to memory of 1052 1700 winlogon.exe 29 PID 1700 wrote to memory of 1052 1700 winlogon.exe 29 PID 1700 wrote to memory of 1052 1700 winlogon.exe 29 PID 1700 wrote to memory of 1052 1700 winlogon.exe 29 PID 1700 wrote to memory of 1052 1700 winlogon.exe 29 PID 1700 wrote to memory of 1052 1700 winlogon.exe 29 PID 1700 wrote to memory of 1052 1700 winlogon.exe 29 PID 1700 wrote to memory of 1052 1700 winlogon.exe 29 PID 1700 wrote to memory of 1008 1700 winlogon.exe 30 PID 1700 wrote to memory of 1008 1700 winlogon.exe 30 PID 1700 wrote to memory of 1008 1700 winlogon.exe 30 PID 1700 wrote to memory of 1008 1700 winlogon.exe 30 PID 1700 wrote to memory of 1008 1700 winlogon.exe 30 PID 1700 wrote to memory of 1008 1700 winlogon.exe 30 PID 1700 wrote to memory of 1008 1700 winlogon.exe 30 PID 1700 wrote to memory of 1008 1700 winlogon.exe 30 PID 1700 wrote to memory of 1008 1700 winlogon.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\567e0d50c4da1225d9512eae64286df27ea180081f6f3a48c8ef861db9ce7e73.exe"C:\Users\Admin\AppData\Local\Temp\567e0d50c4da1225d9512eae64286df27ea180081f6f3a48c8ef861db9ce7e73.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Users\Admin\Admin1\winlogon.exe"C:\Users\Admin\Admin1\winlogon.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\SysWOW64\svchost.exe03⤵
- Modifies security service
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Windows security bypass
- Drops file in Drivers directory
- Sets file execution options in registry
- Adds Run key to start application
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1052
-
-
C:\Windows\SysWOW64\svchost.exe03⤵
- Suspicious use of SetWindowsHookEx
PID:1008
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
196KB
MD5611e2a808f54ea75760c59d4fa414570
SHA1100d74711ce6560347f37106ef9aa07c23914dbf
SHA256567e0d50c4da1225d9512eae64286df27ea180081f6f3a48c8ef861db9ce7e73
SHA512637d234227c059ecff96a059950a7e84a02b12269dca8f26472c25cd97b584f6146e8ff1638d8107e7246b0b2f678415be37ab2b9d184d462975f12835e83696
-
Filesize
196KB
MD5611e2a808f54ea75760c59d4fa414570
SHA1100d74711ce6560347f37106ef9aa07c23914dbf
SHA256567e0d50c4da1225d9512eae64286df27ea180081f6f3a48c8ef861db9ce7e73
SHA512637d234227c059ecff96a059950a7e84a02b12269dca8f26472c25cd97b584f6146e8ff1638d8107e7246b0b2f678415be37ab2b9d184d462975f12835e83696
-
Filesize
196KB
MD5611e2a808f54ea75760c59d4fa414570
SHA1100d74711ce6560347f37106ef9aa07c23914dbf
SHA256567e0d50c4da1225d9512eae64286df27ea180081f6f3a48c8ef861db9ce7e73
SHA512637d234227c059ecff96a059950a7e84a02b12269dca8f26472c25cd97b584f6146e8ff1638d8107e7246b0b2f678415be37ab2b9d184d462975f12835e83696