04a09091d1d59ed0848cb7747ada8ba2a5cebe06595382c2a641c1ac1c7045ac

Analysis

max time kernel
163s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 03:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04a09091d1d59ed0848cb7747ada8ba2a5cebe06595382c2a641c1ac1c7045ac.exe
Size

543KB
MD5

f2bf2ccce67ddbb35416ad1446fbe272
SHA1

75e8b2e1a68f69c6b518c7c8f9dcd9ef8e1a1323
SHA256

04a09091d1d59ed0848cb7747ada8ba2a5cebe06595382c2a641c1ac1c7045ac
SHA512

bd7cb9b084e77d769996d5a9cddbf961690fcd546fe50e1c086f78d14f0458abcef518fe7613a07b77d595ad8c764eb4d5eb27174dc9ab6c97f6d44bb4c79e2e
SSDEEP

6144:SRMLwiZtLix78pD/AUFr/ZHdjx60AMP9s4wzQpGQ65HVOMQga8cV9/yudsPE4TP7:9EiZa4Y+ZY6s4g155RA/yuip+1suOd+I

Score

8^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1476	COUNTE~1.EXE

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{T5TBB77L-4678-0MKC-421Q-14416031DYU6}\StubPath = "C:\\Windows\\system32\\Cerberus\\server.exe Restart"	04a09091d1d59ed0848cb7747ada8ba2a5cebe06595382c2a641c1ac1c7045ac.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{T5TBB77L-4678-0MKC-421Q-14416031DYU6}	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{T5TBB77L-4678-0MKC-421Q-14416031DYU6}\StubPath = "C:\\Windows\\system32\\Cerberus\\server.exe Restart"	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{T5TBB77L-4678-0MKC-421Q-14416031DYU6}	04a09091d1d59ed0848cb7747ada8ba2a5cebe06595382c2a641c1ac1c7045ac.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1476-137-0x0000000010410000-0x00000000104D4000-memory.dmp	upx

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cerberus = "C:\\Windows\\system32\\Cerberus\\server.exe"	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	04a09091d1d59ed0848cb7747ada8ba2a5cebe06595382c2a641c1ac1c7045ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	04a09091d1d59ed0848cb7747ada8ba2a5cebe06595382c2a641c1ac1c7045ac.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cerberus = "C:\\Windows\\system32\\Cerberus\\server.exe"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run	iexplore.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Cerberus\server.exe	iexplore.exe
File opened for modification	C:\Windows\SysWOW64\Cerberus\server.exe	iexplore.exe
File opened for modification	C:\Windows\SysWOW64\Cerberus\plugin.dat	iexplore.exe
File opened for modification	C:\Windows\SysWOW64\Cerberus\	iexplore.exe
File created	C:\Windows\SysWOW64\Cerberus\logs.dat	iexplore.exe
File opened for modification	C:\Windows\SysWOW64\Cerberus\logs.dat	iexplore.exe
File created	C:\Windows\SysWOW64\Cerberus\plugin.dat	iexplore.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	iexplore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	iexplore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	iexplore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	iexplore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	iexplore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	iexplore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	iexplore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	iexplore.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1476	COUNTE~1.EXE
1476	COUNTE~1.EXE
1476	COUNTE~1.EXE
1476	COUNTE~1.EXE
1476	COUNTE~1.EXE
1476	COUNTE~1.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4948	iexplore.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1476	COUNTE~1.EXE
Token: SeDebugPrivilege	1476	COUNTE~1.EXE
Token: SeDebugPrivilege	1476	COUNTE~1.EXE
Token: SeDebugPrivilege	1476	COUNTE~1.EXE
Token: SeDebugPrivilege	4948	iexplore.exe
Token: SeDebugPrivilege	4948	iexplore.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 1476	4552	04a09091d1d59ed0848cb7747ada8ba2a5cebe06595382c2a641c1ac1c7045ac.exe	82
PID 4552 wrote to memory of 1476	4552	04a09091d1d59ed0848cb7747ada8ba2a5cebe06595382c2a641c1ac1c7045ac.exe	82
PID 4552 wrote to memory of 1476	4552	04a09091d1d59ed0848cb7747ada8ba2a5cebe06595382c2a641c1ac1c7045ac.exe	82
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83
PID 1476 wrote to memory of 4948	1476	COUNTE~1.EXE	83

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:680

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:596
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:788
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:64

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1148
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1408
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2536

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1704

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1808

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1484

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2384

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2548

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3228

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1032
- C:\Users\Admin\AppData\Local\Temp\04a09091d1d59ed0848cb7747ada8ba2a5cebe06595382c2a641c1ac1c7045ac.exe
  "C:\Users\Admin\AppData\Local\Temp\04a09091d1d59ed0848cb7747ada8ba2a5cebe06595382c2a641c1ac1c7045ac.exe"
  2⤵
  - Modifies Installed Components in the registry
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\COUNTE~1.EXE
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\COUNTE~1.EXE
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1476
  - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
      4⤵
      Modifies Installed Components in the registry
      Adds Run key to start application
      Drops file in System32 directory
      Checks SCSI registry key(s)
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:4948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2684

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2392

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1980

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1916

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3400

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:2864

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1396

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:2272

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:4824

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:3596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4656

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:5096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:1660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:1000

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1952

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:5068

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:5032

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4744

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4424

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3792

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3564

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1908

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1712

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1376

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1260

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1044

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:932

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:804

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:796

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\COUNTE~1.EXE

Filesize
498KB

MD5
890c0fe0bcc48e63bc6ee97f456f33eb

SHA1
af555d5c97d507f4a9ffc77c87c21d380e99ced2

SHA256
0e0dc078d93a1be9aa86e4c476b38c59d008655c1bc30c5a8650f86dba96de8e

SHA512
5e5564c3880db4a73e632e6dbae5d973730029d7490243c88b9f47dcf85030ed2c794a7a6f85aef21e7779415b2cbec053276cbbb383ac97166bdf4adb3ab5fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\COUNTE~1.EXE

Filesize
498KB

MD5
890c0fe0bcc48e63bc6ee97f456f33eb

SHA1
af555d5c97d507f4a9ffc77c87c21d380e99ced2

SHA256
0e0dc078d93a1be9aa86e4c476b38c59d008655c1bc30c5a8650f86dba96de8e

SHA512
5e5564c3880db4a73e632e6dbae5d973730029d7490243c88b9f47dcf85030ed2c794a7a6f85aef21e7779415b2cbec053276cbbb383ac97166bdf4adb3ab5fd

Download Submit
C:\Windows\SysWOW64\Cerberus\plugin.dat

Filesize
568KB

MD5
5df04454161b456e94ae6fa5f9b80f13

SHA1
8c59e40ab5f9dc3101c5d1d8c2d2fec46535d77d

SHA256
bc226ceff041c3af6874997056e1aea07ff4643b55e8c17ebf105fedd2df34c1

SHA512
969004c6f0ba531fccb18169dcbf28ca8f2569f01b37b2c4df3a226c5958f2804326bc15c5e73edf6d7ebaba698c99a9c275c2bbd4be74d5db66a55f42c80fa0

Download Submit
C:\Windows\SysWOW64\Cerberus\server.exe

Filesize
498KB

MD5
890c0fe0bcc48e63bc6ee97f456f33eb

SHA1
af555d5c97d507f4a9ffc77c87c21d380e99ced2

SHA256
0e0dc078d93a1be9aa86e4c476b38c59d008655c1bc30c5a8650f86dba96de8e

SHA512
5e5564c3880db4a73e632e6dbae5d973730029d7490243c88b9f47dcf85030ed2c794a7a6f85aef21e7779415b2cbec053276cbbb383ac97166bdf4adb3ab5fd

Download Submit
memory/1476-176-0x0000000000610000-0x000000000061A000-memory.dmp

Filesize
40KB

Download
memory/1476-191-0x00000000104E0000-0x00000000104EA000-memory.dmp

Filesize
40KB

Download
memory/1476-148-0x0000000000570000-0x000000000057A000-memory.dmp

Filesize
40KB

Download
memory/1476-155-0x00000000005D0000-0x00000000005DA000-memory.dmp

Filesize
40KB

Download
memory/1476-162-0x00000000005E0000-0x00000000005EA000-memory.dmp

Filesize
40KB

Download
memory/1476-169-0x0000000000600000-0x000000000060A000-memory.dmp

Filesize
40KB

Download
memory/1476-183-0x0000000002400000-0x000000000240A000-memory.dmp

Filesize
40KB

Download
memory/1476-137-0x0000000010410000-0x00000000104D4000-memory.dmp

Filesize
784KB

Download
memory/1476-141-0x0000000000560000-0x000000000056A000-memory.dmp

Filesize
40KB

Download
memory/1476-198-0x0000000002410000-0x000000000241A000-memory.dmp

Filesize
40KB

Download
memory/1476-205-0x00000000104F0000-0x00000000104FA000-memory.dmp

Filesize
40KB

Download
memory/1476-212-0x0000000010500000-0x000000001050A000-memory.dmp

Filesize
40KB

Download
memory/4552-190-0x0000000001000000-0x000000000110FC53-memory.dmp

Filesize
1.1MB

Download
memory/4552-132-0x0000000001000000-0x000000000110FC53-memory.dmp

Filesize
1.1MB

Download
memory/4552-493-0x0000000010920000-0x000000001092A000-memory.dmp

Filesize
40KB

Download
memory/4552-494-0x0000000001000000-0x000000000110FC53-memory.dmp

Filesize
1.1MB

Download