07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88

Analysis

max time kernel
178s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 17:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe
Size

271KB
MD5

1e502080294f8d8135580ae31f1b3404
SHA1

4a25854bdf70e7bd408462bbf68e812956fc965f
SHA256

07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88
SHA512

6dca62da72b2ff487e2eec07d1f639f719d4a95b217a6e4c7ac0ea001926800c12280b0c8deee61aad387d6a38d6c43f54708b9788851f4bebc96970841fa63c
SSDEEP

6144:83/4YIJ8m1MxUyRzoVOBlYQflIGU6VtW:8P4BJTM6++OBlYER3t

Score

8^/10

persistence upx

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Ntmssvc\Parameters\ServiceDll = "C:\\Windows\\system32\\Ntmssvc.dll"	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\NWCWorkstation\Parameters\ServiceDll = "C:\\Windows\\system32\\NWCWorkstation.dll"	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Nwsapagent\Parameters\ServiceDll = "C:\\Windows\\system32\\Nwsapagent.dll"	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility.dll"	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Ias\Parameters\ServiceDll = "C:\\Windows\\system32\\Ias.dll"	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Irmon\Parameters\ServiceDll = "C:\\Windows\\system32\\Irmon.dll"	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Nla\Parameters\ServiceDll = "C:\\Windows\\system32\\Nla.dll"	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/564-55-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/564-56-0x0000000000400000-0x0000000000455000-memory.dmp	upx
behavioral1/memory/564-57-0x0000000000400000-0x0000000000455000-memory.dmp	upx
\??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll	upx
\Windows\SysWOW64\FastUserSwitchingCompatibility.dll	upx
\Windows\SysWOW64\FastUserSwitchingCompatibility.dll	upx
\??\c:\windows\SysWOW64\irmon.dll	upx
\Windows\SysWOW64\Irmon.dll	upx
\Windows\SysWOW64\Irmon.dll	upx
\??\c:\windows\SysWOW64\nla.dll	upx
\Windows\SysWOW64\Nla.dll	upx
\Windows\SysWOW64\Nla.dll	upx
\??\c:\windows\SysWOW64\ntmssvc.dll	upx
\Windows\SysWOW64\Ntmssvc.dll	upx
\Windows\SysWOW64\Ntmssvc.dll	upx
\??\c:\windows\SysWOW64\nwcworkstation.dll	upx
\Windows\SysWOW64\NWCWorkstation.dll	upx
\Windows\SysWOW64\NWCWorkstation.dll	upx
\??\c:\windows\SysWOW64\nwsapagent.dll	upx
\Windows\SysWOW64\Nwsapagent.dll	upx
\Windows\SysWOW64\Nwsapagent.dll	upx

Loads dropped DLL 12 IoCs

Processes:

svchost.exesvchost.exesvchost.exesvchost.exesvchost.exe

pid	process
584	svchost.exe
584	svchost.exe
524	svchost.exe
524	svchost.exe
524	svchost.exe
524	svchost.exe
1344	svchost.exe
1344	svchost.exe
1740	svchost.exe
1740	svchost.exe
1748	svchost.exe
1748	svchost.exe

Drops file in System32 directory 7 IoCs

Processes:

07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Ias.dll	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe
File opened for modification	C:\Windows\SysWOW64\Irmon.dll	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe
File opened for modification	C:\Windows\SysWOW64\Nla.dll	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe
File opened for modification	C:\Windows\SysWOW64\Ntmssvc.dll	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe
File opened for modification	C:\Windows\SysWOW64\NWCWorkstation.dll	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe
File opened for modification	C:\Windows\SysWOW64\Nwsapagent.dll	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe

pid	process
564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe
564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe

Suspicious behavior: MapViewOfSection 22 IoCs

Processes:

07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe

pid	process
564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe
564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe
564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe
564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe
564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe
564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe
564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe
564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe
564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe
564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe
564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe
564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe
564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe
564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe
564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe
564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe
564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe
564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe
564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe
564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe
564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe
564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe

description pid process

Token: SeDebugPrivilege 564 07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe

description	pid	process
Token: SeDebugPrivilege	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe

description	pid	process	target process
PID 564 wrote to memory of 368	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	wininit.exe
PID 564 wrote to memory of 368	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	wininit.exe
PID 564 wrote to memory of 368	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	wininit.exe
PID 564 wrote to memory of 368	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	wininit.exe
PID 564 wrote to memory of 368	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	wininit.exe
PID 564 wrote to memory of 368	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	wininit.exe
PID 564 wrote to memory of 368	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	wininit.exe
PID 564 wrote to memory of 384	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	csrss.exe
PID 564 wrote to memory of 384	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	csrss.exe
PID 564 wrote to memory of 384	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	csrss.exe
PID 564 wrote to memory of 384	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	csrss.exe
PID 564 wrote to memory of 384	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	csrss.exe
PID 564 wrote to memory of 384	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	csrss.exe
PID 564 wrote to memory of 384	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	csrss.exe
PID 564 wrote to memory of 420	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	winlogon.exe
PID 564 wrote to memory of 420	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	winlogon.exe
PID 564 wrote to memory of 420	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	winlogon.exe
PID 564 wrote to memory of 420	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	winlogon.exe
PID 564 wrote to memory of 420	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	winlogon.exe
PID 564 wrote to memory of 420	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	winlogon.exe
PID 564 wrote to memory of 420	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	winlogon.exe
PID 564 wrote to memory of 468	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	services.exe
PID 564 wrote to memory of 468	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	services.exe
PID 564 wrote to memory of 468	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	services.exe
PID 564 wrote to memory of 468	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	services.exe
PID 564 wrote to memory of 468	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	services.exe
PID 564 wrote to memory of 468	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	services.exe
PID 564 wrote to memory of 468	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	services.exe
PID 564 wrote to memory of 476	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	lsass.exe
PID 564 wrote to memory of 476	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	lsass.exe
PID 564 wrote to memory of 476	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	lsass.exe
PID 564 wrote to memory of 476	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	lsass.exe
PID 564 wrote to memory of 476	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	lsass.exe
PID 564 wrote to memory of 476	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	lsass.exe
PID 564 wrote to memory of 476	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	lsass.exe
PID 564 wrote to memory of 484	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	lsm.exe
PID 564 wrote to memory of 484	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	lsm.exe
PID 564 wrote to memory of 484	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	lsm.exe
PID 564 wrote to memory of 484	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	lsm.exe
PID 564 wrote to memory of 484	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	lsm.exe
PID 564 wrote to memory of 484	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	lsm.exe
PID 564 wrote to memory of 484	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	lsm.exe
PID 564 wrote to memory of 596	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	svchost.exe
PID 564 wrote to memory of 596	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	svchost.exe
PID 564 wrote to memory of 596	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	svchost.exe
PID 564 wrote to memory of 596	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	svchost.exe
PID 564 wrote to memory of 596	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	svchost.exe
PID 564 wrote to memory of 596	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	svchost.exe
PID 564 wrote to memory of 596	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	svchost.exe
PID 564 wrote to memory of 680	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	svchost.exe
PID 564 wrote to memory of 680	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	svchost.exe
PID 564 wrote to memory of 680	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	svchost.exe
PID 564 wrote to memory of 680	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	svchost.exe
PID 564 wrote to memory of 680	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	svchost.exe
PID 564 wrote to memory of 680	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	svchost.exe
PID 564 wrote to memory of 680	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	svchost.exe
PID 564 wrote to memory of 764	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	svchost.exe
PID 564 wrote to memory of 764	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	svchost.exe
PID 564 wrote to memory of 764	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	svchost.exe
PID 564 wrote to memory of 764	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	svchost.exe
PID 564 wrote to memory of 764	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	svchost.exe
PID 564 wrote to memory of 764	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	svchost.exe
PID 564 wrote to memory of 764	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	svchost.exe
PID 564 wrote to memory of 816	564	07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe	svchost.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:476

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
2⤵
PID:1072

C:\Windows\system32\taskhost.exe
"taskhost.exe"
2⤵
PID:1132

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
2⤵
PID:1320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
2⤵
PID:1092

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
2⤵
PID:456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
2⤵
PID:292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
2⤵
PID:884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
2⤵
PID:860

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
2⤵
PID:816

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
2⤵
PID:764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
2⤵
PID:680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
2⤵
PID:596

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
2⤵
- Loads dropped DLL
PID:584

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
2⤵
- Loads dropped DLL
PID:524

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
2⤵
- Loads dropped DLL
PID:1344

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
2⤵
- Loads dropped DLL
PID:1740

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
2⤵
- Loads dropped DLL
PID:1748

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:368

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
2⤵
PID:484

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:1700

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:2036

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1232

C:\Users\Admin\AppData\Local\Temp\07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe
"C:\Users\Admin\AppData\Local\Temp\07875db1675aba6075917cc58ac432ebf8799ed26ada2d984ab1ace3c1a3ef88.exe"
2⤵
- Sets DLL path for service in the registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:564

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1196

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll
Filesize
271KB

MD5
69c79e8c7bf10597ab7aeed803c76561

SHA1
9a78337619f3f10ca9cb4ab3e0305f11775911a8

SHA256
8c2f5fde0a78650710a09f40aa545f0c8508bce82cbb6cdc0c26481506896681

SHA512
db89c8c1030a35e6295becb6b10ca9f829278ee246faa529a6f892ed6ac477a82f7cb23a9a671530484edf557025f1c19d3f81ed55a096483e149861b88f57b7

Download Submit
\??\c:\windows\SysWOW64\irmon.dll
Filesize
271KB

MD5
69c79e8c7bf10597ab7aeed803c76561

SHA1
9a78337619f3f10ca9cb4ab3e0305f11775911a8

SHA256
8c2f5fde0a78650710a09f40aa545f0c8508bce82cbb6cdc0c26481506896681

SHA512
db89c8c1030a35e6295becb6b10ca9f829278ee246faa529a6f892ed6ac477a82f7cb23a9a671530484edf557025f1c19d3f81ed55a096483e149861b88f57b7

Download Submit
\??\c:\windows\SysWOW64\nla.dll
Filesize
271KB

MD5
69c79e8c7bf10597ab7aeed803c76561

SHA1
9a78337619f3f10ca9cb4ab3e0305f11775911a8

SHA256
8c2f5fde0a78650710a09f40aa545f0c8508bce82cbb6cdc0c26481506896681

SHA512
db89c8c1030a35e6295becb6b10ca9f829278ee246faa529a6f892ed6ac477a82f7cb23a9a671530484edf557025f1c19d3f81ed55a096483e149861b88f57b7

Download Submit
\??\c:\windows\SysWOW64\ntmssvc.dll
Filesize
271KB

MD5
69c79e8c7bf10597ab7aeed803c76561

SHA1
9a78337619f3f10ca9cb4ab3e0305f11775911a8

SHA256
8c2f5fde0a78650710a09f40aa545f0c8508bce82cbb6cdc0c26481506896681

SHA512
db89c8c1030a35e6295becb6b10ca9f829278ee246faa529a6f892ed6ac477a82f7cb23a9a671530484edf557025f1c19d3f81ed55a096483e149861b88f57b7

Download Submit
\??\c:\windows\SysWOW64\nwcworkstation.dll
Filesize
271KB

MD5
69c79e8c7bf10597ab7aeed803c76561

SHA1
9a78337619f3f10ca9cb4ab3e0305f11775911a8

SHA256
8c2f5fde0a78650710a09f40aa545f0c8508bce82cbb6cdc0c26481506896681

SHA512
db89c8c1030a35e6295becb6b10ca9f829278ee246faa529a6f892ed6ac477a82f7cb23a9a671530484edf557025f1c19d3f81ed55a096483e149861b88f57b7

Download Submit
\??\c:\windows\SysWOW64\nwsapagent.dll
Filesize
271KB

MD5
69c79e8c7bf10597ab7aeed803c76561

SHA1
9a78337619f3f10ca9cb4ab3e0305f11775911a8

SHA256
8c2f5fde0a78650710a09f40aa545f0c8508bce82cbb6cdc0c26481506896681

SHA512
db89c8c1030a35e6295becb6b10ca9f829278ee246faa529a6f892ed6ac477a82f7cb23a9a671530484edf557025f1c19d3f81ed55a096483e149861b88f57b7

Download Submit
\Windows\SysWOW64\FastUserSwitchingCompatibility.dll
Filesize
271KB

MD5
69c79e8c7bf10597ab7aeed803c76561

SHA1
9a78337619f3f10ca9cb4ab3e0305f11775911a8

SHA256
8c2f5fde0a78650710a09f40aa545f0c8508bce82cbb6cdc0c26481506896681

SHA512
db89c8c1030a35e6295becb6b10ca9f829278ee246faa529a6f892ed6ac477a82f7cb23a9a671530484edf557025f1c19d3f81ed55a096483e149861b88f57b7

Download Submit
\Windows\SysWOW64\FastUserSwitchingCompatibility.dll
Filesize
271KB

MD5
69c79e8c7bf10597ab7aeed803c76561

SHA1
9a78337619f3f10ca9cb4ab3e0305f11775911a8

SHA256
8c2f5fde0a78650710a09f40aa545f0c8508bce82cbb6cdc0c26481506896681

SHA512
db89c8c1030a35e6295becb6b10ca9f829278ee246faa529a6f892ed6ac477a82f7cb23a9a671530484edf557025f1c19d3f81ed55a096483e149861b88f57b7

Download Submit
\Windows\SysWOW64\Irmon.dll
Filesize
271KB

MD5
69c79e8c7bf10597ab7aeed803c76561

SHA1
9a78337619f3f10ca9cb4ab3e0305f11775911a8

SHA256
8c2f5fde0a78650710a09f40aa545f0c8508bce82cbb6cdc0c26481506896681

SHA512
db89c8c1030a35e6295becb6b10ca9f829278ee246faa529a6f892ed6ac477a82f7cb23a9a671530484edf557025f1c19d3f81ed55a096483e149861b88f57b7

Download Submit
\Windows\SysWOW64\Irmon.dll
Filesize
271KB

MD5
69c79e8c7bf10597ab7aeed803c76561

SHA1
9a78337619f3f10ca9cb4ab3e0305f11775911a8

SHA256
8c2f5fde0a78650710a09f40aa545f0c8508bce82cbb6cdc0c26481506896681

SHA512
db89c8c1030a35e6295becb6b10ca9f829278ee246faa529a6f892ed6ac477a82f7cb23a9a671530484edf557025f1c19d3f81ed55a096483e149861b88f57b7

Download Submit
\Windows\SysWOW64\NWCWorkstation.dll
Filesize
271KB

MD5
69c79e8c7bf10597ab7aeed803c76561

SHA1
9a78337619f3f10ca9cb4ab3e0305f11775911a8

SHA256
8c2f5fde0a78650710a09f40aa545f0c8508bce82cbb6cdc0c26481506896681

SHA512
db89c8c1030a35e6295becb6b10ca9f829278ee246faa529a6f892ed6ac477a82f7cb23a9a671530484edf557025f1c19d3f81ed55a096483e149861b88f57b7

Download Submit
\Windows\SysWOW64\NWCWorkstation.dll
Filesize
271KB

MD5
69c79e8c7bf10597ab7aeed803c76561

SHA1
9a78337619f3f10ca9cb4ab3e0305f11775911a8

SHA256
8c2f5fde0a78650710a09f40aa545f0c8508bce82cbb6cdc0c26481506896681

SHA512
db89c8c1030a35e6295becb6b10ca9f829278ee246faa529a6f892ed6ac477a82f7cb23a9a671530484edf557025f1c19d3f81ed55a096483e149861b88f57b7

Download Submit
\Windows\SysWOW64\Nla.dll
Filesize
271KB

MD5
69c79e8c7bf10597ab7aeed803c76561

SHA1
9a78337619f3f10ca9cb4ab3e0305f11775911a8

SHA256
8c2f5fde0a78650710a09f40aa545f0c8508bce82cbb6cdc0c26481506896681

SHA512
db89c8c1030a35e6295becb6b10ca9f829278ee246faa529a6f892ed6ac477a82f7cb23a9a671530484edf557025f1c19d3f81ed55a096483e149861b88f57b7

Download Submit
\Windows\SysWOW64\Nla.dll
Filesize
271KB

MD5
69c79e8c7bf10597ab7aeed803c76561

SHA1
9a78337619f3f10ca9cb4ab3e0305f11775911a8

SHA256
8c2f5fde0a78650710a09f40aa545f0c8508bce82cbb6cdc0c26481506896681

SHA512
db89c8c1030a35e6295becb6b10ca9f829278ee246faa529a6f892ed6ac477a82f7cb23a9a671530484edf557025f1c19d3f81ed55a096483e149861b88f57b7

Download Submit
\Windows\SysWOW64\Ntmssvc.dll
Filesize
271KB

MD5
69c79e8c7bf10597ab7aeed803c76561

SHA1
9a78337619f3f10ca9cb4ab3e0305f11775911a8

SHA256
8c2f5fde0a78650710a09f40aa545f0c8508bce82cbb6cdc0c26481506896681

SHA512
db89c8c1030a35e6295becb6b10ca9f829278ee246faa529a6f892ed6ac477a82f7cb23a9a671530484edf557025f1c19d3f81ed55a096483e149861b88f57b7

Download Submit
\Windows\SysWOW64\Ntmssvc.dll
Filesize
271KB

MD5
69c79e8c7bf10597ab7aeed803c76561

SHA1
9a78337619f3f10ca9cb4ab3e0305f11775911a8

SHA256
8c2f5fde0a78650710a09f40aa545f0c8508bce82cbb6cdc0c26481506896681

SHA512
db89c8c1030a35e6295becb6b10ca9f829278ee246faa529a6f892ed6ac477a82f7cb23a9a671530484edf557025f1c19d3f81ed55a096483e149861b88f57b7

Download Submit
\Windows\SysWOW64\Nwsapagent.dll
Filesize
271KB

MD5
69c79e8c7bf10597ab7aeed803c76561

SHA1
9a78337619f3f10ca9cb4ab3e0305f11775911a8

SHA256
8c2f5fde0a78650710a09f40aa545f0c8508bce82cbb6cdc0c26481506896681

SHA512
db89c8c1030a35e6295becb6b10ca9f829278ee246faa529a6f892ed6ac477a82f7cb23a9a671530484edf557025f1c19d3f81ed55a096483e149861b88f57b7

Download Submit
\Windows\SysWOW64\Nwsapagent.dll
Filesize
271KB

MD5
69c79e8c7bf10597ab7aeed803c76561

SHA1
9a78337619f3f10ca9cb4ab3e0305f11775911a8

SHA256
8c2f5fde0a78650710a09f40aa545f0c8508bce82cbb6cdc0c26481506896681

SHA512
db89c8c1030a35e6295becb6b10ca9f829278ee246faa529a6f892ed6ac477a82f7cb23a9a671530484edf557025f1c19d3f81ed55a096483e149861b88f57b7

Download Submit
memory/524-71-0x00000000003F0000-0x0000000000445000-memory.dmp

Filesize
340KB

Download
memory/564-58-0x0000000000230000-0x0000000000285000-memory.dmp

Filesize
340KB

Download
memory/564-57-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/564-65-0x0000000001F40000-0x0000000005F40000-memory.dmp

Filesize
64.0MB

Download
memory/564-56-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/564-54-0x00000000754F1000-0x00000000754F3000-memory.dmp

Filesize
8KB

Download
memory/564-64-0x0000000001F40000-0x0000000005F40000-memory.dmp

Filesize
64.0MB

Download
memory/564-55-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download