Analysis
-
max time kernel
151s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06/12/2022, 10:59
Static task
static1
Behavioral task
behavioral1
Sample
9c62fa0ae5b9680351c9b8d9f78af3dfe0117848bd50d0f34479f41de7f1258f.exe
Resource
win7-20220812-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
9c62fa0ae5b9680351c9b8d9f78af3dfe0117848bd50d0f34479f41de7f1258f.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
18 signatures
150 seconds
General
-
Target
9c62fa0ae5b9680351c9b8d9f78af3dfe0117848bd50d0f34479f41de7f1258f.exe
-
Size
164KB
-
MD5
aaf2166b1022c9305d88c87ef29af18c
-
SHA1
1b62395ae78b0b87374009ad950fda7c906fd3be
-
SHA256
9c62fa0ae5b9680351c9b8d9f78af3dfe0117848bd50d0f34479f41de7f1258f
-
SHA512
b602f250443e62efd6ee7d51d43ca37cb295dc4b97f576f60748281e3939db813d8001df49937b64b2616b3cb1ea18d96a90f2cee9b2fcec565ba08e9e4fcc6f
-
SSDEEP
1536:c6QiUVV3v5AeIIYY5GAUyIBewtGfBLkG7pqY6m8tVu+wOm:c6B6Noy4gtuA+zm
Score
10/10
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" svchost.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "3" svchost.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1" svchost.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" svchost.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 1416 winlogon.exe -
Sets file execution options in registry 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\titanin.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agentsvr.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccevtmgr.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsmain.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kerio-wrp-421-en-win.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcupdate.exe svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\n32scan.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nwservice.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rshell.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scvhosl.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avp32.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\alertsvc.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\watchdog.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\escanh95.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navapsvc.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nisserv.exe svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atupdater.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkserv.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\serv95.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vscan.exe svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winsfcm.exe svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vpcmap.exe svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autotrace.exe svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ldnetmon.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tcm.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EHttpSrv.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iface.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rescue32.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sharedaccess.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wingate.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HJTInstall.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cclaw.exe svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avxquar.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mxtask.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dvp95.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icmoon.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iface.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taumon.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsched.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\defwatch.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dpf.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\supftrl.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\swxcacls.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsm32.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nupgrade.exe svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wgfe95.exe svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmgrdian.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netstat.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navwnt.exe svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\padmin.exe svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoupdate.exe svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navdx.exe svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avpm.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iamserv.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vet98.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avnotify.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccsetmgr.exe svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outpostproinstall.exe svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pptbc.exe\Debugger = "\"C:\\Users\\Admin\\Admin1\\winlogon.exe\"" svchost.exe -
resource yara_rule behavioral1/memory/1316-63-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/1316-66-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/1316-67-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/1316-71-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/1316-72-0x0000000000400000-0x000000000041E000-memory.dmp upx -
Loads dropped DLL 2 IoCs
pid Process 1608 9c62fa0ae5b9680351c9b8d9f78af3dfe0117848bd50d0f34479f41de7f1258f.exe 1608 9c62fa0ae5b9680351c9b8d9f78af3dfe0117848bd50d0f34479f41de7f1258f.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\NVIDIA Media Center Library = "C:\\Users\\Admin\\Admin1\\winlogon.exe" svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NVIDIA Media Center Library = "C:\\Users\\Admin\\Admin1\\winlogon.exe" svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1416 set thread context of 1316 1416 winlogon.exe 27 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Local Page = "http://2-6-.p-1-.5-b-e-n-t-f-p-p-7-1-1-0-7-c-q-0-3-00-6-u-7-t-1-n-y-q-u-f-u.info" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Local Page = "http://d-9-c-6-l-7-w-3-a-t-2-t-6-n-f.-9-4-.i-k-r-g-1-0-u-5-1-f-3-g-li-9-p-1-x-t-6-g-l-8-m-q-y-s-k-6-l.info" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://3-a-3-9-e-5-1-b-v-6-4-t-s-8-r-7-c.-6-.j-z-0-3-0-u-u-x-f-1l-3-l-h-w-b-q-z-u-5-n-l-l-m-s-5-v-s-z-g.info" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page = "http://3-j-6-.s-2-e-0-k-.j-z-0-3-0-u-u-x-f-1l-3-l-h-w-b-q-z-u-5-n-l-l-m-s-5-v-s-z-g.info" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://2.-0-l-x-2-t-z-k-r-h-7-0-n-m-3-m-y-8-7-.j-z-0-3-0-u-u-x-f-1l-3-l-h-w-b-q-z-u-5-n-l-l-m-s-5-v-s-z-g.info" svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://8-7-.k-b-5-5-5-2-e-.i-k-r-g-1-0-u-5-1-f-3-g-li-9-p-1-x-t-6-g-l-8-m-q-y-s-k-6-l.info" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL = "http://9-6-n-q-p-j-6-2-0-4-j-9-n-0-5-.x-9-5-h-8-o-f-9-u-1-r-.5-b-e-n-t-f-p-p-7-1-1-0-7-c-q-0-3-00-6-u-7-t-1-n-y-q-u-f-u.info" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://e-4-r-x-3.-k-8-5-0-2-0-t-8-z-j-.i-k-r-g-1-0-u-5-1-f-3-g-li-9-p-1-x-t-6-g-l-8-m-q-y-s-k-6-l.info" svchost.exe -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://4-y-m-l-9-7-1-n-8-5-9-s-0.-u-.5-b-e-n-t-f-p-p-7-1-1-0-7-c-q-0-3-00-6-u-7-t-1-n-y-q-u-f-u.info" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://z.-7-.j-z-0-3-0-u-u-x-f-1l-3-l-h-w-b-q-z-u-5-n-l-l-m-s-5-v-s-z-g.info" svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeBackupPrivilege 1316 svchost.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1608 9c62fa0ae5b9680351c9b8d9f78af3dfe0117848bd50d0f34479f41de7f1258f.exe 1416 winlogon.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1608 wrote to memory of 1416 1608 9c62fa0ae5b9680351c9b8d9f78af3dfe0117848bd50d0f34479f41de7f1258f.exe 26 PID 1608 wrote to memory of 1416 1608 9c62fa0ae5b9680351c9b8d9f78af3dfe0117848bd50d0f34479f41de7f1258f.exe 26 PID 1608 wrote to memory of 1416 1608 9c62fa0ae5b9680351c9b8d9f78af3dfe0117848bd50d0f34479f41de7f1258f.exe 26 PID 1608 wrote to memory of 1416 1608 9c62fa0ae5b9680351c9b8d9f78af3dfe0117848bd50d0f34479f41de7f1258f.exe 26 PID 1416 wrote to memory of 1316 1416 winlogon.exe 27 PID 1416 wrote to memory of 1316 1416 winlogon.exe 27 PID 1416 wrote to memory of 1316 1416 winlogon.exe 27 PID 1416 wrote to memory of 1316 1416 winlogon.exe 27 PID 1416 wrote to memory of 1316 1416 winlogon.exe 27 PID 1416 wrote to memory of 1316 1416 winlogon.exe 27 PID 1416 wrote to memory of 1316 1416 winlogon.exe 27 PID 1416 wrote to memory of 1316 1416 winlogon.exe 27 PID 1416 wrote to memory of 1316 1416 winlogon.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\9c62fa0ae5b9680351c9b8d9f78af3dfe0117848bd50d0f34479f41de7f1258f.exe"C:\Users\Admin\AppData\Local\Temp\9c62fa0ae5b9680351c9b8d9f78af3dfe0117848bd50d0f34479f41de7f1258f.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\Admin1\winlogon.exe"C:\Users\Admin\Admin1\winlogon.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Windows\SysWOW64\svchost.exe03⤵
- Modifies security service
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Windows security bypass
- Drops file in Drivers directory
- Sets file execution options in registry
- Adds Run key to start application
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1316
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
164KB
MD5aaf2166b1022c9305d88c87ef29af18c
SHA11b62395ae78b0b87374009ad950fda7c906fd3be
SHA2569c62fa0ae5b9680351c9b8d9f78af3dfe0117848bd50d0f34479f41de7f1258f
SHA512b602f250443e62efd6ee7d51d43ca37cb295dc4b97f576f60748281e3939db813d8001df49937b64b2616b3cb1ea18d96a90f2cee9b2fcec565ba08e9e4fcc6f
-
Filesize
164KB
MD5aaf2166b1022c9305d88c87ef29af18c
SHA11b62395ae78b0b87374009ad950fda7c906fd3be
SHA2569c62fa0ae5b9680351c9b8d9f78af3dfe0117848bd50d0f34479f41de7f1258f
SHA512b602f250443e62efd6ee7d51d43ca37cb295dc4b97f576f60748281e3939db813d8001df49937b64b2616b3cb1ea18d96a90f2cee9b2fcec565ba08e9e4fcc6f
-
Filesize
164KB
MD5aaf2166b1022c9305d88c87ef29af18c
SHA11b62395ae78b0b87374009ad950fda7c906fd3be
SHA2569c62fa0ae5b9680351c9b8d9f78af3dfe0117848bd50d0f34479f41de7f1258f
SHA512b602f250443e62efd6ee7d51d43ca37cb295dc4b97f576f60748281e3939db813d8001df49937b64b2616b3cb1ea18d96a90f2cee9b2fcec565ba08e9e4fcc6f