Analysis
-
max time kernel
153s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 21:11
Behavioral task
behavioral1
Sample
398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe
Resource
win10v2004-20221111-en
General
-
Target
398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe
-
Size
1.4MB
-
MD5
12a328ce6651249030f5370f255ca63e
-
SHA1
a8048a259c2aeb4bee82eea524e402add040aa35
-
SHA256
398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72
-
SHA512
ae03500bd52eff224135ffa4ac5030b6d24538b07e8a01db0cd2ffa5a3ba5202c4eb61fd53722886610299d0994895d6fce7538bf6735f4b348d9c47ef0668b0
-
SSDEEP
24576:z9WQitvyUilzOUxaOWk01G4fbu/F41jen6KXYzkEEknJS7DFN4L3GmPA705sCvsF:z9WDAUozOUxaOyGau6I6WPDvlAAoefk1
Malware Config
Signatures
-
Detected Xorist Ransomware 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2036-55-0x0000000000400000-0x0000000000560000-memory.dmp family_xorist behavioral1/memory/2036-56-0x0000000000400000-0x0000000000560000-memory.dmp family_xorist -
Xorist Ransomware
Xorist is a ransomware first seen in 2020.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\w8i9eHkHOwWwQlX.exe" 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe -
Drops file in Program Files directory 64 IoCs
Processes:
398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exedescription ioc process File opened for modification C:\Program Files\7-Zip\Lang\sq.txt 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-image-inset.png 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\HOW TO DECRYPT FILES.txt 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\HOW TO DECRYPT FILES.txt 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\HOW TO DECRYPT FILES.txt 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File created C:\Program Files\VideoLAN\VLC\plugins\logger\HOW TO DECRYPT FILES.txt 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File created C:\Program Files\Java\jre7\lib\zi\Indian\HOW TO DECRYPT FILES.txt 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File created C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\HOW TO DECRYPT FILES.txt 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File created C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\HOW TO DECRYPT FILES.txt 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File created C:\Program Files\Windows Journal\it-IT\HOW TO DECRYPT FILES.txt 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_SelectionSubpicture.png 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_ButtonGraphic.png 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_SelectionSubpicture.png 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File created C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\HOW TO DECRYPT FILES.txt 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\HOW TO DECRYPT FILES.txt 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport.png 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\HOW TO DECRYPT FILES.txt 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File created C:\Program Files\Windows Defender\de-DE\HOW TO DECRYPT FILES.txt 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonSubpicture.png 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain.wmv 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File created C:\Program Files\Java\jdk1.7.0_80\include\HOW TO DECRYPT FILES.txt 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\HOW TO DECRYPT FILES.txt 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File opened for modification C:\Program Files\Microsoft Games\Chess\ChessMCE.lnk 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\HOW TO DECRYPT FILES.txt 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\HOW TO DECRYPT FILES.txt 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\HOW TO DECRYPT FILES.txt 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File created C:\Program Files\VideoLAN\VLC\HOW TO DECRYPT FILES.txt 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File created C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\HOW TO DECRYPT FILES.txt 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File created C:\Program Files\Common Files\System\ado\it-IT\HOW TO DECRYPT FILES.txt 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_notes-txt-background.png 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_SelectionSubpicture.png 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\HOW TO DECRYPT FILES.txt 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File created C:\Program Files\Microsoft Games\Solitaire\es-ES\HOW TO DECRYPT FILES.txt 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File created C:\Program Files\Windows NT\TableTextService\ja-JP\HOW TO DECRYPT FILES.txt 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\HOW TO DECRYPT FILES.txt 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576black.png 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\HOW TO DECRYPT FILES.txt 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\softedges.png 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\LogoCanary.png 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File opened for modification C:\Program Files\VideoLAN\VLC\COPYING.txt 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File created C:\Program Files\Windows Media Player\Media Renderer\HOW TO DECRYPT FILES.txt 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\HOW TO DECRYPT FILES.txt 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File created C:\Program Files\Windows Mail\fr-FR\HOW TO DECRYPT FILES.txt 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File opened for modification C:\Program Files\7-Zip\Lang\hy.txt 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_SelectionSubpicture.png 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7TSFrame.png 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File created C:\Program Files\Windows Journal\en-US\HOW TO DECRYPT FILES.txt 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop.wmv 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\HOW TO DECRYPT FILES.txt 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\mix.gif 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\hprof-16.png 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HOW TO DECRYPT FILES.txt 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File created C:\Program Files\VideoLAN\VLC\lua\modules\HOW TO DECRYPT FILES.txt 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\HOW TO DECRYPT FILES.txt 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\HOW TO DECRYPT FILES.txt 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Notes_PAL.wmv 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\new-trigger-wiz.gif 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7.png 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe -
Drops file in Windows directory 1 IoCs
Processes:
398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exedescription ioc process File opened for modification C:\WINDOWS\EXPLORER.EXE 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe -
Modifies registry class 10 IoCs
Processes:
398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PRPASCBHJSZLMOM\shell 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PRPASCBHJSZLMOM\shell\open 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.CryptoTorLocker2015!\ = "PRPASCBHJSZLMOM" 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PRPASCBHJSZLMOM\DefaultIcon 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PRPASCBHJSZLMOM\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\w8i9eHkHOwWwQlX.exe,0" 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PRPASCBHJSZLMOM\shell\open\command 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.CryptoTorLocker2015! 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PRPASCBHJSZLMOM 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PRPASCBHJSZLMOM\ = "CRYPTED!" 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PRPASCBHJSZLMOM\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\w8i9eHkHOwWwQlX.exe" 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exepid process 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe -
Suspicious behavior: MapViewOfSection 22 IoCs
Processes:
398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exepid process 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exedescription pid process Token: SeDebugPrivilege 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe Token: SeTakeOwnershipPrivilege 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe Token: SeRestorePrivilege 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe Token: SeBackupPrivilege 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe Token: SeChangeNotifyPrivilege 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exedescription pid process target process PID 2036 wrote to memory of 368 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe wininit.exe PID 2036 wrote to memory of 368 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe wininit.exe PID 2036 wrote to memory of 368 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe wininit.exe PID 2036 wrote to memory of 368 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe wininit.exe PID 2036 wrote to memory of 368 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe wininit.exe PID 2036 wrote to memory of 368 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe wininit.exe PID 2036 wrote to memory of 368 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe wininit.exe PID 2036 wrote to memory of 380 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe csrss.exe PID 2036 wrote to memory of 380 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe csrss.exe PID 2036 wrote to memory of 380 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe csrss.exe PID 2036 wrote to memory of 380 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe csrss.exe PID 2036 wrote to memory of 380 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe csrss.exe PID 2036 wrote to memory of 380 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe csrss.exe PID 2036 wrote to memory of 380 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe csrss.exe PID 2036 wrote to memory of 416 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe winlogon.exe PID 2036 wrote to memory of 416 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe winlogon.exe PID 2036 wrote to memory of 416 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe winlogon.exe PID 2036 wrote to memory of 416 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe winlogon.exe PID 2036 wrote to memory of 416 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe winlogon.exe PID 2036 wrote to memory of 416 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe winlogon.exe PID 2036 wrote to memory of 416 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe winlogon.exe PID 2036 wrote to memory of 464 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe services.exe PID 2036 wrote to memory of 464 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe services.exe PID 2036 wrote to memory of 464 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe services.exe PID 2036 wrote to memory of 464 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe services.exe PID 2036 wrote to memory of 464 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe services.exe PID 2036 wrote to memory of 464 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe services.exe PID 2036 wrote to memory of 464 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe services.exe PID 2036 wrote to memory of 472 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe lsass.exe PID 2036 wrote to memory of 472 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe lsass.exe PID 2036 wrote to memory of 472 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe lsass.exe PID 2036 wrote to memory of 472 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe lsass.exe PID 2036 wrote to memory of 472 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe lsass.exe PID 2036 wrote to memory of 472 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe lsass.exe PID 2036 wrote to memory of 472 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe lsass.exe PID 2036 wrote to memory of 480 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe lsm.exe PID 2036 wrote to memory of 480 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe lsm.exe PID 2036 wrote to memory of 480 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe lsm.exe PID 2036 wrote to memory of 480 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe lsm.exe PID 2036 wrote to memory of 480 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe lsm.exe PID 2036 wrote to memory of 480 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe lsm.exe PID 2036 wrote to memory of 480 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe lsm.exe PID 2036 wrote to memory of 588 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe svchost.exe PID 2036 wrote to memory of 588 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe svchost.exe PID 2036 wrote to memory of 588 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe svchost.exe PID 2036 wrote to memory of 588 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe svchost.exe PID 2036 wrote to memory of 588 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe svchost.exe PID 2036 wrote to memory of 588 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe svchost.exe PID 2036 wrote to memory of 588 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe svchost.exe PID 2036 wrote to memory of 668 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe svchost.exe PID 2036 wrote to memory of 668 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe svchost.exe PID 2036 wrote to memory of 668 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe svchost.exe PID 2036 wrote to memory of 668 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe svchost.exe PID 2036 wrote to memory of 668 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe svchost.exe PID 2036 wrote to memory of 668 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe svchost.exe PID 2036 wrote to memory of 668 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe svchost.exe PID 2036 wrote to memory of 752 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe svchost.exe PID 2036 wrote to memory of 752 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe svchost.exe PID 2036 wrote to memory of 752 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe svchost.exe PID 2036 wrote to memory of 752 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe svchost.exe PID 2036 wrote to memory of 752 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe svchost.exe PID 2036 wrote to memory of 752 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe svchost.exe PID 2036 wrote to memory of 752 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe svchost.exe PID 2036 wrote to memory of 800 2036 398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe svchost.exe
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:472
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵PID:464
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵PID:832
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵PID:748
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵PID:908
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵PID:1216
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵PID:1036
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵PID:1008
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵PID:108
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵PID:876
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵PID:800
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵PID:752
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵PID:668
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵PID:588
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:416
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:380
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:368
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:480
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe1⤵PID:1972
-
\\?\C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R1⤵PID:1704
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe"C:\Users\Admin\AppData\Local\Temp\398575a09f41e8b1da28164960e72cdacb331e24922c999e1b9d1887a6ec5a72.exe"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1304