Analysis
-
max time kernel
153s -
max time network
160s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 21:21
Static task
static1
Behavioral task
behavioral1
Sample
71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
Resource
win7-20220812-en
General
-
Target
71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe
-
Size
816KB
-
MD5
595bcf0e9eda86a1625dcd4bc61d3257
-
SHA1
f9aef65ee80a7837d7db6794c8285f99107e62fe
-
SHA256
71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca
-
SHA512
d9db455af3e4baf9d6c1760636fda674ccdedd14f2b014d66ff79bd5513db2f94f934f13ecb2563907bb187f02d3fe4a56be66c4c836209e7e6347a2bca9b889
-
SSDEEP
12288:Rs0AhHtn1bvzSP6iTn1UserksHkU5KrVclb6ajydnlJj/IiLmqU2zYHp7D0xBm:RsdhHLvmP6+19egRG10nlJjp/U20x+s
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\qkk6CA9.tmp acprotect -
Executes dropped EXE 2 IoCs
Processes:
71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exesvchost.exepid process 1340 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe 984 svchost.exe -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe upx C:\Users\Admin\AppData\Local\Temp\71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe upx C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\71834849CC7C27BBB53EB9316833D0C5665F7F7D322E06D0625212DAAAA8D8CASRV.EXE upx behavioral1/memory/1340-63-0x0000000000400000-0x000000000042E000-memory.dmp upx -
Loads dropped DLL 2 IoCs
Processes:
71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exepid process 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe -
Drops file in Program Files directory 8 IoCs
Processes:
svchost.exe71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exedescription ioc process File opened for modification C:\Program Files\DbProtectSupport\fake.cfg svchost.exe File created C:\Program Files\DbProtectSupport\fake.cfg svchost.exe File created C:\Program Files\DbProtectSupport\svchost.exe.bak 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe File created C:\Program Files\DbProtectSupport\svchost.exe 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe File opened for modification C:\Program Files\DbProtectSupport\svchost.exe 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe File opened for modification C:\Program Files (x86)\Microsoft\px7C04.tmp 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 svchost.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exepid process 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe -
Suspicious behavior: MapViewOfSection 21 IoCs
Processes:
71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exepid process 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
Processes:
71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exedescription pid process Token: SeDebugPrivilege 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe Token: SeTakeOwnershipPrivilege 1340 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe Token: SeRestorePrivilege 1340 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe Token: SeBackupPrivilege 1340 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe Token: SeChangeNotifyPrivilege 1340 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe Token: SeTakeOwnershipPrivilege 1340 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe Token: SeRestorePrivilege 1340 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe Token: SeBackupPrivilege 1340 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe Token: SeChangeNotifyPrivilege 1340 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe Token: SeTakeOwnershipPrivilege 1340 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe Token: SeRestorePrivilege 1340 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe Token: SeBackupPrivilege 1340 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe Token: SeChangeNotifyPrivilege 1340 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe Token: SeTakeOwnershipPrivilege 1340 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe Token: SeRestorePrivilege 1340 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe Token: SeBackupPrivilege 1340 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe Token: SeChangeNotifyPrivilege 1340 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe Token: SeTakeOwnershipPrivilege 1340 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe Token: SeRestorePrivilege 1340 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe Token: SeBackupPrivilege 1340 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe Token: SeChangeNotifyPrivilege 1340 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exepid process 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exedescription pid process target process PID 2036 wrote to memory of 1340 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe PID 2036 wrote to memory of 1340 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe PID 2036 wrote to memory of 1340 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe PID 2036 wrote to memory of 1340 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe PID 2036 wrote to memory of 368 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe wininit.exe PID 2036 wrote to memory of 368 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe wininit.exe PID 2036 wrote to memory of 368 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe wininit.exe PID 2036 wrote to memory of 368 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe wininit.exe PID 2036 wrote to memory of 368 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe wininit.exe PID 2036 wrote to memory of 368 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe wininit.exe PID 2036 wrote to memory of 368 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe wininit.exe PID 2036 wrote to memory of 376 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe csrss.exe PID 2036 wrote to memory of 376 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe csrss.exe PID 2036 wrote to memory of 376 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe csrss.exe PID 2036 wrote to memory of 376 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe csrss.exe PID 2036 wrote to memory of 376 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe csrss.exe PID 2036 wrote to memory of 376 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe csrss.exe PID 2036 wrote to memory of 376 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe csrss.exe PID 2036 wrote to memory of 416 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe winlogon.exe PID 2036 wrote to memory of 416 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe winlogon.exe PID 2036 wrote to memory of 416 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe winlogon.exe PID 2036 wrote to memory of 416 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe winlogon.exe PID 2036 wrote to memory of 416 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe winlogon.exe PID 2036 wrote to memory of 416 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe winlogon.exe PID 2036 wrote to memory of 416 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe winlogon.exe PID 2036 wrote to memory of 460 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe services.exe PID 2036 wrote to memory of 460 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe services.exe PID 2036 wrote to memory of 460 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe services.exe PID 2036 wrote to memory of 460 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe services.exe PID 2036 wrote to memory of 460 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe services.exe PID 2036 wrote to memory of 460 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe services.exe PID 2036 wrote to memory of 460 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe services.exe PID 2036 wrote to memory of 476 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe lsass.exe PID 2036 wrote to memory of 476 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe lsass.exe PID 2036 wrote to memory of 476 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe lsass.exe PID 2036 wrote to memory of 476 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe lsass.exe PID 2036 wrote to memory of 476 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe lsass.exe PID 2036 wrote to memory of 476 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe lsass.exe PID 2036 wrote to memory of 476 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe lsass.exe PID 2036 wrote to memory of 484 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe lsm.exe PID 2036 wrote to memory of 484 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe lsm.exe PID 2036 wrote to memory of 484 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe lsm.exe PID 2036 wrote to memory of 484 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe lsm.exe PID 2036 wrote to memory of 484 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe lsm.exe PID 2036 wrote to memory of 484 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe lsm.exe PID 2036 wrote to memory of 484 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe lsm.exe PID 2036 wrote to memory of 588 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe svchost.exe PID 2036 wrote to memory of 588 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe svchost.exe PID 2036 wrote to memory of 588 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe svchost.exe PID 2036 wrote to memory of 588 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe svchost.exe PID 2036 wrote to memory of 588 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe svchost.exe PID 2036 wrote to memory of 588 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe svchost.exe PID 2036 wrote to memory of 588 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe svchost.exe PID 2036 wrote to memory of 664 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe svchost.exe PID 2036 wrote to memory of 664 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe svchost.exe PID 2036 wrote to memory of 664 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe svchost.exe PID 2036 wrote to memory of 664 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe svchost.exe PID 2036 wrote to memory of 664 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe svchost.exe PID 2036 wrote to memory of 664 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe svchost.exe PID 2036 wrote to memory of 664 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe svchost.exe PID 2036 wrote to memory of 724 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe svchost.exe PID 2036 wrote to memory of 724 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe svchost.exe PID 2036 wrote to memory of 724 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe svchost.exe PID 2036 wrote to memory of 724 2036 71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe svchost.exe
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵
-
C:\Program Files\DbProtectSupport\svchost.exe"C:\Program Files\DbProtectSupport\svchost.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Checks processor information in registry
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\wininit.exewininit.exe1⤵
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe"C:\Users\Admin\AppData\Local\Temp\71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca.exe"2⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exeC:\Users\Admin\AppData\Local\Temp\71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exe3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\DbProtectSupport\svchost.exeFilesize
281KB
MD58848a7e40531659fda06d797148d5295
SHA1444c96dcd60867fe6129ca38cfc2192a4936381d
SHA256fa5fb40eed018ecfea6a3dbf633d1afa4b8f8a6593471804f43b79869d03007f
SHA512c9d25e0b07a1f6a52c08093a82e42d11165c85e5efbdd821c40f233ed68b91471c786ecfc27e841656486da29d989b466face92433526a7c7335bd428ef31f92
-
C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\71834849CC7C27BBB53EB9316833D0C5665F7F7D322E06D0625212DAAAA8D8CASRV.EXEFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Users\Admin\AppData\Local\Temp\71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
\Users\Admin\AppData\Local\Temp\71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8caSrv.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
\Users\Admin\AppData\Local\Temp\qkk6CA9.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
memory/1340-65-0x0000000000230000-0x000000000023F000-memory.dmpFilesize
60KB
-
memory/1340-60-0x0000000076151000-0x0000000076153000-memory.dmpFilesize
8KB
-
memory/1340-58-0x0000000000000000-mapping.dmp
-
memory/1340-64-0x000000007EFA0000-0x000000007EFAC000-memory.dmpFilesize
48KB
-
memory/1340-63-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1340-66-0x000000007EFA0000-0x000000007EFAC000-memory.dmpFilesize
48KB
-
memory/2036-54-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/2036-62-0x0000000000240000-0x000000000026E000-memory.dmpFilesize
184KB
-
memory/2036-56-0x0000000000360000-0x00000000003D3000-memory.dmpFilesize
460KB
-
memory/2036-68-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/2036-69-0x0000000000360000-0x00000000003D3000-memory.dmpFilesize
460KB