Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06/11/2022, 17:40
Static task
static1
Behavioral task
behavioral1
Sample
6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe
Resource
win7-20220812-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe
-
Size
825KB
-
MD5
09cc392a209f7926599cbaf81f074b3d
-
SHA1
99db65c558635987d6794ab8373ac20c18fe968b
-
SHA256
6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b
-
SHA512
1777a7ccbc61b7f2f22048d588e8dec6d59ef91efd834b4f4667bc2f66df82ca6597c02601c2805c5d605b8f4f00e06e0e423cb84f28bd985fe08c8954beed67
-
SSDEEP
6144:iO67wjsJHnPyNmeAJg57xoP3yf1UHmUwPSWjg2f82P6Fftk9Lt6VVqB:n67jqNmev57xoPifrPSYg2v6FfuR2k
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe scvhost.exe" 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Windows\\system32\\scvhost.exe" 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\a: 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe File opened (read-only) \??\f: 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe File opened (read-only) \??\n: 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe File opened (read-only) \??\p: 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe File opened (read-only) \??\u: 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe File opened (read-only) \??\v: 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe File opened (read-only) \??\w: 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe File opened (read-only) \??\l: 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe File opened (read-only) \??\m: 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe File opened (read-only) \??\g: 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe File opened (read-only) \??\r: 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe File opened (read-only) \??\s: 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe File opened (read-only) \??\x: 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe File opened (read-only) \??\y: 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe File opened (read-only) \??\z: 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe File opened (read-only) \??\b: 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe File opened (read-only) \??\e: 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe File opened (read-only) \??\j: 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe File opened (read-only) \??\k: 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe File opened (read-only) \??\o: 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe File opened (read-only) \??\q: 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe File opened (read-only) \??\t: 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe File opened (read-only) \??\h: 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe File opened (read-only) \??\i: 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\scvhost.exe 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe File opened for modification C:\Windows\SysWOW64\scvhost.exe 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe File opened for modification C:\Windows\SysWOW64\SCVHOST.EXE 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe File opened for modification C:\Windows\SysWOW64\autorun.ini 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\scvhost.exe 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe File opened for modification C:\Windows\SCVHOST.EXE 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe File opened for modification C:\Windows\scvhost.exe 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe -
Suspicious behavior: MapViewOfSection 22 IoCs
pid Process 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeDebugPrivilege 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe Token: SeTakeOwnershipPrivilege 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe Token: SeRestorePrivilege 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe Token: SeBackupPrivilege 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe Token: SeChangeNotifyPrivilege 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe Token: SeTakeOwnershipPrivilege 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe Token: SeRestorePrivilege 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe Token: SeBackupPrivilege 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe Token: SeChangeNotifyPrivilege 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe Token: SeTakeOwnershipPrivilege 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe Token: SeRestorePrivilege 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe Token: SeBackupPrivilege 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe Token: SeChangeNotifyPrivilege 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe Token: SeTakeOwnershipPrivilege 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe Token: SeRestorePrivilege 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe Token: SeBackupPrivilege 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe Token: SeChangeNotifyPrivilege 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 896 wrote to memory of 368 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 5 PID 896 wrote to memory of 368 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 5 PID 896 wrote to memory of 368 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 5 PID 896 wrote to memory of 368 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 5 PID 896 wrote to memory of 368 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 5 PID 896 wrote to memory of 368 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 5 PID 896 wrote to memory of 368 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 5 PID 896 wrote to memory of 376 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 4 PID 896 wrote to memory of 376 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 4 PID 896 wrote to memory of 376 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 4 PID 896 wrote to memory of 376 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 4 PID 896 wrote to memory of 376 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 4 PID 896 wrote to memory of 376 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 4 PID 896 wrote to memory of 376 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 4 PID 896 wrote to memory of 416 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 3 PID 896 wrote to memory of 416 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 3 PID 896 wrote to memory of 416 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 3 PID 896 wrote to memory of 416 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 3 PID 896 wrote to memory of 416 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 3 PID 896 wrote to memory of 416 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 3 PID 896 wrote to memory of 416 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 3 PID 896 wrote to memory of 460 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 2 PID 896 wrote to memory of 460 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 2 PID 896 wrote to memory of 460 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 2 PID 896 wrote to memory of 460 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 2 PID 896 wrote to memory of 460 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 2 PID 896 wrote to memory of 460 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 2 PID 896 wrote to memory of 460 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 2 PID 896 wrote to memory of 476 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 1 PID 896 wrote to memory of 476 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 1 PID 896 wrote to memory of 476 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 1 PID 896 wrote to memory of 476 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 1 PID 896 wrote to memory of 476 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 1 PID 896 wrote to memory of 476 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 1 PID 896 wrote to memory of 476 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 1 PID 896 wrote to memory of 484 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 7 PID 896 wrote to memory of 484 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 7 PID 896 wrote to memory of 484 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 7 PID 896 wrote to memory of 484 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 7 PID 896 wrote to memory of 484 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 7 PID 896 wrote to memory of 484 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 7 PID 896 wrote to memory of 484 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 7 PID 896 wrote to memory of 588 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 25 PID 896 wrote to memory of 588 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 25 PID 896 wrote to memory of 588 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 25 PID 896 wrote to memory of 588 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 25 PID 896 wrote to memory of 588 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 25 PID 896 wrote to memory of 588 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 25 PID 896 wrote to memory of 588 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 25 PID 896 wrote to memory of 664 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 24 PID 896 wrote to memory of 664 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 24 PID 896 wrote to memory of 664 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 24 PID 896 wrote to memory of 664 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 24 PID 896 wrote to memory of 664 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 24 PID 896 wrote to memory of 664 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 24 PID 896 wrote to memory of 664 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 24 PID 896 wrote to memory of 740 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 23 PID 896 wrote to memory of 740 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 23 PID 896 wrote to memory of 740 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 23 PID 896 wrote to memory of 740 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 23 PID 896 wrote to memory of 740 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 23 PID 896 wrote to memory of 740 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 23 PID 896 wrote to memory of 740 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 23 PID 896 wrote to memory of 796 896 6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe 22
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:476
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵PID:460
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵PID:872
-
\\?\C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R3⤵PID:1956
-
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵PID:1804
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵PID:1604
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵PID:1108
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵PID:1100
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵PID:1028
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵PID:300
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵PID:836
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵PID:796
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵PID:740
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵PID:664
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵PID:588
-
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:416
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:376
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:484
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:368
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1184
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe1⤵PID:1664
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe"C:\Users\Admin\AppData\Local\Temp\6197863afb1384802a078201f1191819aba45969588019509c3e8b926f39f47b.exe"2⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:896
-