6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521

Analysis

max time kernel
26s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 01:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Size

317KB
MD5

25dfa44c9f23557e4e831865e470a080
SHA1

886963a8a22a6fe8c2baf69725051c0a3f45ce07
SHA256

6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521
SHA512

e635a67a228a8dae274e4678107be848ef0b9cd3184c9077075e669d0a768ec4f24dbf653b44bcf8ad01ee4bc6a25f44187ebb288ed9f7d32950971ac874beae
SSDEEP

6144:3KXckL/daY0yFTL4nLLuB4tiUGYxKMe+uCl3s:8EryFTkuYxhHuCl3

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 19 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}\Version = "12,0,7601,17514"	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\ = "Microsoft Windows Media Player 12.0"	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Version = "12,0,7601,17514"	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}\Version = "12,0,7601,17514"	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Active Setup\Installed Components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Active Setup\Installed Components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}\Version = "12,0,7601,17514"	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}\	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Active Setup\Installed Components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Active Setup\Installed Components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}\Version = "12,0,7601,17514"	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}\Version = "12,0,7601,17514"	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Version = "12,0,7601,17514"	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Version = "12,0,7601,17514"	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C}	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220}\Version = "12,0,7601,17514"	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe

Loads dropped DLL 10 IoCs

Processes:

6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe

pid	process
2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe

Drops file in Program Files directory 3 IoCs

Processes:

6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\WI54FB~1\WMPLAYER.EXE	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\SETUP_WM.EXE	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
File opened for modification	C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMPLAYER.EXE	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe

Drops file in Windows directory 1 IoCs

Processes:

6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe

description ioc process

File opened for modification C:\Windows\wmsetup.log 6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\wmsetup.log	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe

Modifies registry class 1 IoCs

Processes:

6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{083863F1-70DE-11d0-BD40-00A0C911CE86}	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe

pid process

2012 6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe

Suspicious behavior: MapViewOfSection 22 IoCs

Processes:

6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe

pid	process
2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

Processes:

6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe

description	pid	process
Token: SeDebugPrivilege	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Token: SeTakeOwnershipPrivilege	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Token: SeRestorePrivilege	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Token: SeBackupPrivilege	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Token: SeChangeNotifyPrivilege	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Token: SeTakeOwnershipPrivilege	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Token: SeRestorePrivilege	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Token: SeBackupPrivilege	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Token: SeChangeNotifyPrivilege	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Token: SeTakeOwnershipPrivilege	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Token: SeRestorePrivilege	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Token: SeBackupPrivilege	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Token: SeChangeNotifyPrivilege	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Token: SeTakeOwnershipPrivilege	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Token: SeRestorePrivilege	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Token: SeBackupPrivilege	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Token: SeChangeNotifyPrivilege	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Token: SeTakeOwnershipPrivilege	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Token: SeRestorePrivilege	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Token: SeBackupPrivilege	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Token: SeChangeNotifyPrivilege	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Token: SeTakeOwnershipPrivilege	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Token: SeRestorePrivilege	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Token: SeBackupPrivilege	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Token: SeChangeNotifyPrivilege	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Token: SeTakeOwnershipPrivilege	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Token: SeRestorePrivilege	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Token: SeBackupPrivilege	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
Token: SeChangeNotifyPrivilege	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe

description	pid	process	target process
PID 2012 wrote to memory of 368	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	wininit.exe
PID 2012 wrote to memory of 368	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	wininit.exe
PID 2012 wrote to memory of 368	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	wininit.exe
PID 2012 wrote to memory of 368	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	wininit.exe
PID 2012 wrote to memory of 368	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	wininit.exe
PID 2012 wrote to memory of 380	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	csrss.exe
PID 2012 wrote to memory of 380	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	csrss.exe
PID 2012 wrote to memory of 380	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	csrss.exe
PID 2012 wrote to memory of 380	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	csrss.exe
PID 2012 wrote to memory of 380	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	csrss.exe
PID 2012 wrote to memory of 416	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	winlogon.exe
PID 2012 wrote to memory of 416	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	winlogon.exe
PID 2012 wrote to memory of 416	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	winlogon.exe
PID 2012 wrote to memory of 416	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	winlogon.exe
PID 2012 wrote to memory of 416	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	winlogon.exe
PID 2012 wrote to memory of 460	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	services.exe
PID 2012 wrote to memory of 460	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	services.exe
PID 2012 wrote to memory of 460	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	services.exe
PID 2012 wrote to memory of 460	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	services.exe
PID 2012 wrote to memory of 460	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	services.exe
PID 2012 wrote to memory of 476	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	lsass.exe
PID 2012 wrote to memory of 476	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	lsass.exe
PID 2012 wrote to memory of 476	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	lsass.exe
PID 2012 wrote to memory of 476	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	lsass.exe
PID 2012 wrote to memory of 476	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	lsass.exe
PID 2012 wrote to memory of 484	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	lsm.exe
PID 2012 wrote to memory of 484	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	lsm.exe
PID 2012 wrote to memory of 484	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	lsm.exe
PID 2012 wrote to memory of 484	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	lsm.exe
PID 2012 wrote to memory of 484	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	lsm.exe
PID 2012 wrote to memory of 596	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	svchost.exe
PID 2012 wrote to memory of 596	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	svchost.exe
PID 2012 wrote to memory of 596	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	svchost.exe
PID 2012 wrote to memory of 596	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	svchost.exe
PID 2012 wrote to memory of 596	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	svchost.exe
PID 2012 wrote to memory of 676	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	svchost.exe
PID 2012 wrote to memory of 676	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	svchost.exe
PID 2012 wrote to memory of 676	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	svchost.exe
PID 2012 wrote to memory of 676	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	svchost.exe
PID 2012 wrote to memory of 676	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	svchost.exe
PID 2012 wrote to memory of 752	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	svchost.exe
PID 2012 wrote to memory of 752	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	svchost.exe
PID 2012 wrote to memory of 752	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	svchost.exe
PID 2012 wrote to memory of 752	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	svchost.exe
PID 2012 wrote to memory of 752	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	svchost.exe
PID 2012 wrote to memory of 808	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	svchost.exe
PID 2012 wrote to memory of 808	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	svchost.exe
PID 2012 wrote to memory of 808	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	svchost.exe
PID 2012 wrote to memory of 808	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	svchost.exe
PID 2012 wrote to memory of 808	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	svchost.exe
PID 2012 wrote to memory of 844	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	svchost.exe
PID 2012 wrote to memory of 844	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	svchost.exe
PID 2012 wrote to memory of 844	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	svchost.exe
PID 2012 wrote to memory of 844	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	svchost.exe
PID 2012 wrote to memory of 844	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	svchost.exe
PID 2012 wrote to memory of 872	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	svchost.exe
PID 2012 wrote to memory of 872	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	svchost.exe
PID 2012 wrote to memory of 872	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	svchost.exe
PID 2012 wrote to memory of 872	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	svchost.exe
PID 2012 wrote to memory of 872	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	svchost.exe
PID 2012 wrote to memory of 240	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	svchost.exe
PID 2012 wrote to memory of 240	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	svchost.exe
PID 2012 wrote to memory of 240	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	svchost.exe
PID 2012 wrote to memory of 240	2012	6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe	svchost.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:476

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
2⤵
PID:872

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
3⤵
PID:2044

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
2⤵
PID:1884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
2⤵
PID:1672

C:\Windows\system32\taskhost.exe
"taskhost.exe"
2⤵
PID:1128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
2⤵
PID:1048

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
2⤵
PID:324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
2⤵
PID:240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
2⤵
PID:844

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
2⤵
PID:808

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
2⤵
PID:752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
2⤵
PID:676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
2⤵
PID:596

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:416

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:380

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:368

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
2⤵
PID:484

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:1160

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1256

C:\Users\Admin\AppData\Local\Temp\6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe
"C:\Users\Admin\AppData\Local\Temp\6d75d69b3290807c1d04089aa89e5610b578464f4556be6c297e7eb73d2ab521.exe"
2⤵
- Modifies Installed Components in the registry
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2012

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1224

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\PROGRA~2\WI54FB~1\setup_wm.exe

Filesize
1.9MB

MD5
40780e853bf26c68b7231f49f2077d83

SHA1
54349a95286d861e67b65825e99c982ce084ee3b

SHA256
6c2048cad5cf2f062cb9ee1226440cc22d9ce229f90db82c612ee85a98ac0083

SHA512
ac79f9a724c47b3aef370298a709fbf2a0f997dd5c49a963754bef27f4dc7ec6dae165c7b65e4ed93fb5011a271c385cd02328b78e02813209071a746af500d8

Download Submit
\PROGRA~2\WI54FB~1\setup_wm.exe

Filesize
1.9MB

MD5
40780e853bf26c68b7231f49f2077d83

SHA1
54349a95286d861e67b65825e99c982ce084ee3b

SHA256
6c2048cad5cf2f062cb9ee1226440cc22d9ce229f90db82c612ee85a98ac0083

SHA512
ac79f9a724c47b3aef370298a709fbf2a0f997dd5c49a963754bef27f4dc7ec6dae165c7b65e4ed93fb5011a271c385cd02328b78e02813209071a746af500d8

Download Submit
\PROGRA~2\WI54FB~1\wmplayer.exe

Filesize
171KB

MD5
74da34293b8a36953d7ddb6637484a36

SHA1
43316b91b39b460a91cd1e88f0a4c06870a28f83

SHA256
734f5536e4dcb9e33035e33c896d3286d460594a1f2ed74f633f5dc3f9098d27

SHA512
b40e52a84080ad647de4525490b2620fd7f627fbdbfe0195cde578553cb1cc6cd5349071c9bc4436f04d6de9cb34d2c213259ebef9b8b73c1e4612992c5032ef

Download Submit
\PROGRA~2\WI54FB~1\wmplayer.exe

Filesize
171KB

MD5
74da34293b8a36953d7ddb6637484a36

SHA1
43316b91b39b460a91cd1e88f0a4c06870a28f83

SHA256
734f5536e4dcb9e33035e33c896d3286d460594a1f2ed74f633f5dc3f9098d27

SHA512
b40e52a84080ad647de4525490b2620fd7f627fbdbfe0195cde578553cb1cc6cd5349071c9bc4436f04d6de9cb34d2c213259ebef9b8b73c1e4612992c5032ef

Download Submit
\PROGRA~2\WI54FB~1\wmplayer.exe

Filesize
203KB

MD5
c54ebc170699eeb04efda7f45e0f6b71

SHA1
ef0eebca2f0614ae48fb27e51435547850d5b343

SHA256
eed825b0f452aad29c5e136fffca7617573d2c427cc932ca1aa0d34424148d74

SHA512
4b9888e7b1483144ffada3f6b1a441093910d029ed137d3a43469a76e27c52c31b2b5f291440731f0d7d460a70e6abcfdc6cb3cc62a0ddb9fb0a82b9ffb47b0e

Download Submit
\PROGRA~2\WI54FB~1\wmplayer.exe

Filesize
203KB

MD5
c54ebc170699eeb04efda7f45e0f6b71

SHA1
ef0eebca2f0614ae48fb27e51435547850d5b343

SHA256
eed825b0f452aad29c5e136fffca7617573d2c427cc932ca1aa0d34424148d74

SHA512
4b9888e7b1483144ffada3f6b1a441093910d029ed137d3a43469a76e27c52c31b2b5f291440731f0d7d460a70e6abcfdc6cb3cc62a0ddb9fb0a82b9ffb47b0e

Download Submit
\PROGRA~2\WI54FB~1\wmplayer.exe

Filesize
203KB

MD5
c54ebc170699eeb04efda7f45e0f6b71

SHA1
ef0eebca2f0614ae48fb27e51435547850d5b343

SHA256
eed825b0f452aad29c5e136fffca7617573d2c427cc932ca1aa0d34424148d74

SHA512
4b9888e7b1483144ffada3f6b1a441093910d029ed137d3a43469a76e27c52c31b2b5f291440731f0d7d460a70e6abcfdc6cb3cc62a0ddb9fb0a82b9ffb47b0e

Download Submit
\PROGRA~2\WI54FB~1\wmplayer.exe

Filesize
203KB

MD5
c54ebc170699eeb04efda7f45e0f6b71

SHA1
ef0eebca2f0614ae48fb27e51435547850d5b343

SHA256
eed825b0f452aad29c5e136fffca7617573d2c427cc932ca1aa0d34424148d74

SHA512
4b9888e7b1483144ffada3f6b1a441093910d029ed137d3a43469a76e27c52c31b2b5f291440731f0d7d460a70e6abcfdc6cb3cc62a0ddb9fb0a82b9ffb47b0e

Download Submit
\Program Files (x86)\Windows Media Player\wmplayer.exe

Filesize
203KB

MD5
c54ebc170699eeb04efda7f45e0f6b71

SHA1
ef0eebca2f0614ae48fb27e51435547850d5b343

SHA256
eed825b0f452aad29c5e136fffca7617573d2c427cc932ca1aa0d34424148d74

SHA512
4b9888e7b1483144ffada3f6b1a441093910d029ed137d3a43469a76e27c52c31b2b5f291440731f0d7d460a70e6abcfdc6cb3cc62a0ddb9fb0a82b9ffb47b0e

Download Submit
\Program Files (x86)\Windows Media Player\wmplayer.exe

Filesize
203KB

MD5
c54ebc170699eeb04efda7f45e0f6b71

SHA1
ef0eebca2f0614ae48fb27e51435547850d5b343

SHA256
eed825b0f452aad29c5e136fffca7617573d2c427cc932ca1aa0d34424148d74

SHA512
4b9888e7b1483144ffada3f6b1a441093910d029ed137d3a43469a76e27c52c31b2b5f291440731f0d7d460a70e6abcfdc6cb3cc62a0ddb9fb0a82b9ffb47b0e

Download Submit
memory/2012-54-0x00000000758C1000-0x00000000758C3000-memory.dmp

Filesize
8KB

Download
memory/2012-65-0x00000000009D0000-0x0000000000A2A000-memory.dmp

Filesize
360KB

Download
memory/2012-66-0x0000000001FC0000-0x00000000021B7000-memory.dmp

Filesize
2.0MB

Download