df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb | Triage

Analysis

max time kernel
103s
max time network
195s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 01:13

Sharing

Report Analysis Logs

General

Target

df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
Size

1.2MB
MD5

2a8d83e32a5121cfa09162ac404e3cb0
SHA1

7a0a4c67de5f3e075a0056a0bca70a38c1d948c4
SHA256

df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb
SHA512

d61f8319cf3c35879c991a90c6921da38b788276d8a81099388a47e63f6c7f8090b351bb84acba8ed616528a6a217e99f4195944c16460cc8096a9b616567e08
SSDEEP

24576:eBZsgsikjQ3l7jp/HTan8b8tiHlBqTXABN0XGVHlo:ekbikk37/HTw08tglBqTwBqWN

Score

7^/10

bootkit persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe

pid process

1332 df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe

description ioc process

File opened for modification \??\PhysicalDrive0 df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

Modify Registry

Processes:

df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe

pid	process
1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe

Suspicious behavior: MapViewOfSection 22 IoCs

Processes:

df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe

pid	process
1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

Processes:

df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe

description	pid	process
Token: SeDebugPrivilege	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
Token: SeDebugPrivilege	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
Token: SeTakeOwnershipPrivilege	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
Token: SeRestorePrivilege	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
Token: SeBackupPrivilege	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
Token: SeChangeNotifyPrivilege	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
Token: SeTakeOwnershipPrivilege	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
Token: SeRestorePrivilege	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
Token: SeBackupPrivilege	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
Token: SeChangeNotifyPrivilege	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
Token: SeTakeOwnershipPrivilege	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
Token: SeRestorePrivilege	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
Token: SeBackupPrivilege	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
Token: SeChangeNotifyPrivilege	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
Token: SeTakeOwnershipPrivilege	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
Token: SeRestorePrivilege	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
Token: SeBackupPrivilege	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
Token: SeChangeNotifyPrivilege	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
Token: SeTakeOwnershipPrivilege	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
Token: SeRestorePrivilege	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
Token: SeBackupPrivilege	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
Token: SeChangeNotifyPrivilege	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
Token: SeTakeOwnershipPrivilege	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
Token: SeRestorePrivilege	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
Token: SeBackupPrivilege	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
Token: SeChangeNotifyPrivilege	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
Token: SeTakeOwnershipPrivilege	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
Token: SeRestorePrivilege	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
Token: SeBackupPrivilege	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
Token: SeChangeNotifyPrivilege	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe

description	pid	process	target process
PID 1332 wrote to memory of 368	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	csrss.exe
PID 1332 wrote to memory of 368	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	csrss.exe
PID 1332 wrote to memory of 368	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	csrss.exe
PID 1332 wrote to memory of 368	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	csrss.exe
PID 1332 wrote to memory of 368	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	csrss.exe
PID 1332 wrote to memory of 376	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	wininit.exe
PID 1332 wrote to memory of 376	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	wininit.exe
PID 1332 wrote to memory of 376	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	wininit.exe
PID 1332 wrote to memory of 376	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	wininit.exe
PID 1332 wrote to memory of 376	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	wininit.exe
PID 1332 wrote to memory of 416	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	winlogon.exe
PID 1332 wrote to memory of 416	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	winlogon.exe
PID 1332 wrote to memory of 416	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	winlogon.exe
PID 1332 wrote to memory of 416	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	winlogon.exe
PID 1332 wrote to memory of 416	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	winlogon.exe
PID 1332 wrote to memory of 460	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	services.exe
PID 1332 wrote to memory of 460	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	services.exe
PID 1332 wrote to memory of 460	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	services.exe
PID 1332 wrote to memory of 460	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	services.exe
PID 1332 wrote to memory of 460	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	services.exe
PID 1332 wrote to memory of 476	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	lsass.exe
PID 1332 wrote to memory of 476	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	lsass.exe
PID 1332 wrote to memory of 476	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	lsass.exe
PID 1332 wrote to memory of 476	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	lsass.exe
PID 1332 wrote to memory of 476	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	lsass.exe
PID 1332 wrote to memory of 484	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	lsm.exe
PID 1332 wrote to memory of 484	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	lsm.exe
PID 1332 wrote to memory of 484	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	lsm.exe
PID 1332 wrote to memory of 484	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	lsm.exe
PID 1332 wrote to memory of 484	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	lsm.exe
PID 1332 wrote to memory of 580	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	svchost.exe
PID 1332 wrote to memory of 580	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	svchost.exe
PID 1332 wrote to memory of 580	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	svchost.exe
PID 1332 wrote to memory of 580	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	svchost.exe
PID 1332 wrote to memory of 580	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	svchost.exe
PID 1332 wrote to memory of 656	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	svchost.exe
PID 1332 wrote to memory of 656	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	svchost.exe
PID 1332 wrote to memory of 656	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	svchost.exe
PID 1332 wrote to memory of 656	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	svchost.exe
PID 1332 wrote to memory of 656	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	svchost.exe
PID 1332 wrote to memory of 728	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	svchost.exe
PID 1332 wrote to memory of 728	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	svchost.exe
PID 1332 wrote to memory of 728	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	svchost.exe
PID 1332 wrote to memory of 728	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	svchost.exe
PID 1332 wrote to memory of 728	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	svchost.exe
PID 1332 wrote to memory of 788	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	svchost.exe
PID 1332 wrote to memory of 788	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	svchost.exe
PID 1332 wrote to memory of 788	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	svchost.exe
PID 1332 wrote to memory of 788	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	svchost.exe
PID 1332 wrote to memory of 788	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	svchost.exe
PID 1332 wrote to memory of 832	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	svchost.exe
PID 1332 wrote to memory of 832	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	svchost.exe
PID 1332 wrote to memory of 832	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	svchost.exe
PID 1332 wrote to memory of 832	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	svchost.exe
PID 1332 wrote to memory of 832	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	svchost.exe
PID 1332 wrote to memory of 856	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	svchost.exe
PID 1332 wrote to memory of 856	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	svchost.exe
PID 1332 wrote to memory of 856	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	svchost.exe
PID 1332 wrote to memory of 856	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	svchost.exe
PID 1332 wrote to memory of 856	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	svchost.exe
PID 1332 wrote to memory of 240	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	svchost.exe
PID 1332 wrote to memory of 240	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	svchost.exe
PID 1332 wrote to memory of 240	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	svchost.exe
PID 1332 wrote to memory of 240	1332	df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe	svchost.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:476

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
2⤵
PID:1040

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
2⤵
PID:1072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
2⤵
PID:1260

C:\Windows\system32\taskhost.exe
"taskhost.exe"
2⤵
PID:1116

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
2⤵
PID:328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
2⤵
PID:240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
2⤵
PID:856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
2⤵
PID:832

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
2⤵
PID:788

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
2⤵
PID:728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
2⤵
PID:656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
2⤵
PID:580

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:416

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:2032

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:1980

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1196

C:\Users\Admin\AppData\Local\Temp\df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe
"C:\Users\Admin\AppData\Local\Temp\df0982d6e87795a4d01dae1f615651eb9e04ac8d85fa391e5c93dd9ef2b357cb.exe"
2⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1332

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1172

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:484

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:376

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:368

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\UNI992.tmp\dr.dll

Filesize
77KB

MD5
72c4db10800693ae560cc910310b4946

SHA1
c1e660c604d8aabfc9fc64366732d37a93f42efe

SHA256
ed768744da837a0db017247f6a3681325b3726fdd74301708d364e05063cd685

SHA512
fcc30936ace19cd88f87e05b477d14e67a0af356a3b032de74a2b98aebf3fb87a10ee33ac13e34578ad1bf9c736e25d5c87289bd2bb71d2c7c124989d8b69254

Download Submit
memory/1332-54-0x0000000074FD1000-0x0000000074FD3000-memory.dmp

Filesize
8KB

Download
memory/1332-56-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/1332-57-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download