Overview
overview
10Static
static
10123.exe
windows7-x64
1123.exe
windows10-2004-x64
1360sb.exe
windows7-x64
10360sb.exe
windows10-2004-x64
107000.32
ubuntu-18.04-amd64
17000.64
ubuntu-18.04-amd64
7Linux577
ubuntu-18.04-amd64
8Mh.exe
windows7-x64
7Mh.exe
windows10-2004-x64
10Mh1.exe
windows7-x64
7Mh1.exe
windows10-2004-x64
10Mh2.exe
windows7-x64
7Mh2.exe
windows10-2004-x64
10SETUP.exe
windows7-x64
SETUP.exe
windows10-2004-x64
TX98
ubuntu-18.04-amd64
1TX981
ubuntu-18.04-amd64
1TX982
ubuntu-18.04-amd64
7TX984
debian-9-armhf
7TX985
debian-9-mipsel
7TX986
debian-9-mips
7bjyk.exe
windows7-x64
10bjyk.exe
windows10-2004-x64
10ceshi.exe
windows7-x64
10ceshi.exe
windows10-2004-x64
10ddos.exe
windows7-x64
1ddos.exe
windows10-2004-x64
10dhl.exe
windows7-x64
7dhl.exe
windows10-2004-x64
10mh3.exe
windows7-x64
7mh3.exe
windows10-2004-x64
10server.exe
windows7-x64
10Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
27-03-2023 09:42
Behavioral task
behavioral1
Sample
123.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
123.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral3
Sample
360sb.exe
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
360sb.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
7000.32
Resource
ubuntu1804-amd64-20221111-en
Behavioral task
behavioral6
Sample
7000.64
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral7
Sample
Linux577
Resource
ubuntu1804-amd64-20221111-en
Behavioral task
behavioral8
Sample
Mh.exe
Resource
win7-20230220-en
Behavioral task
behavioral9
Sample
Mh.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral10
Sample
Mh1.exe
Resource
win7-20230220-en
Behavioral task
behavioral11
Sample
Mh1.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral12
Sample
Mh2.exe
Resource
win7-20230220-en
Behavioral task
behavioral13
Sample
Mh2.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral14
Sample
SETUP.exe
Resource
win7-20230220-en
Behavioral task
behavioral15
Sample
SETUP.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral16
Sample
TX98
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral17
Sample
TX981
Resource
ubuntu1804-amd64-20221111-en
Behavioral task
behavioral18
Sample
TX982
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral19
Sample
TX984
Resource
debian9-armhf-20221111-en
Behavioral task
behavioral20
Sample
TX985
Resource
debian9-mipsel-en-20211208
Behavioral task
behavioral21
Sample
TX986
Resource
debian9-mipsbe-20221111-en
Behavioral task
behavioral22
Sample
bjyk.exe
Resource
win7-20230220-en
Behavioral task
behavioral23
Sample
bjyk.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral24
Sample
ceshi.exe
Resource
win7-20230220-en
Behavioral task
behavioral25
Sample
ceshi.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral26
Sample
ddos.exe
Resource
win7-20230220-en
Behavioral task
behavioral27
Sample
ddos.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral28
Sample
dhl.exe
Resource
win7-20230220-en
Behavioral task
behavioral29
Sample
dhl.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral30
Sample
mh3.exe
Resource
win7-20230220-en
Behavioral task
behavioral31
Sample
mh3.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral32
Sample
server.exe
Resource
win7-20230220-en
General
-
Target
Mh.exe
-
Size
410KB
-
MD5
6b6fa473cd53b3b1d20fb7d0d7d94dd2
-
SHA1
ac8682258ec2a9556c5b06dac4b70aa7f408146b
-
SHA256
e4a5f740683ce26d8312c336e1a2d50aa5b56efe61fc793ff3f9dc08af2da30d
-
SHA512
59a132a04c621aad34c2130895e1c33f8a988a1d400b91ab712c4058ab6fefda698d01f395dd88f15cc8382f6826eee6550296b00981581a5b8abb10682fe9b0
-
SSDEEP
6144:66a0cy+o0eBYJw2acFyuItrcF7Faf3DROwunbNvTr:7XP0pJvacFyuItgZiTROwuxvTr
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 4 IoCs
Processes:
Mh.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List Mh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile Mh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications Mh.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\Mh.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Mh.exe:*:enabled:@shell32.dll,-1" Mh.exe -
ACProtect 1.3x - 1.4x DLL software 5 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\dni831F.tmp acprotect C:\Users\Admin\AppData\Local\Temp\dni831F.tmp acprotect C:\Users\Admin\AppData\Local\Temp\dni831F.tmp acprotect C:\Windows\Temp\pni869A.tmp acprotect C:\Windows\Temp\pni869A.tmp acprotect -
Executes dropped EXE 1 IoCs
Processes:
update.exepid process 4512 update.exe -
Loads dropped DLL 4 IoCs
Processes:
Mh.exeupdate.exepid process 2512 Mh.exe 2512 Mh.exe 4512 update.exe 4512 update.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
Mh.exedescription ioc process File opened (read-only) \??\U: Mh.exe File opened (read-only) \??\Y: Mh.exe File opened (read-only) \??\Z: Mh.exe File opened (read-only) \??\K: Mh.exe File opened (read-only) \??\O: Mh.exe File opened (read-only) \??\P: Mh.exe File opened (read-only) \??\S: Mh.exe File opened (read-only) \??\L: Mh.exe File opened (read-only) \??\N: Mh.exe File opened (read-only) \??\Q: Mh.exe File opened (read-only) \??\R: Mh.exe File opened (read-only) \??\T: Mh.exe File opened (read-only) \??\V: Mh.exe File opened (read-only) \??\G: Mh.exe File opened (read-only) \??\H: Mh.exe File opened (read-only) \??\I: Mh.exe File opened (read-only) \??\M: Mh.exe File opened (read-only) \??\W: Mh.exe File opened (read-only) \??\X: Mh.exe File opened (read-only) \??\E: Mh.exe File opened (read-only) \??\F: Mh.exe File opened (read-only) \??\J: Mh.exe -
Drops file in Windows directory 1 IoCs
Processes:
Mh.exedescription ioc process File created C:\Windows\update.exe Mh.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Mh.exeupdate.exepid process 2512 Mh.exe 2512 Mh.exe 4512 update.exe 4512 update.exe -
Suspicious behavior: MapViewOfSection 64 IoCs
Processes:
Mh.exepid process 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe 2512 Mh.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Mh.exeupdate.exedescription pid process Token: SeDebugPrivilege 2512 Mh.exe Token: SeDebugPrivilege 4512 update.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
Mh.exeupdate.exepid process 2512 Mh.exe 4512 update.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Mh.exedescription pid process target process PID 2512 wrote to memory of 584 2512 Mh.exe winlogon.exe PID 2512 wrote to memory of 584 2512 Mh.exe winlogon.exe PID 2512 wrote to memory of 584 2512 Mh.exe winlogon.exe PID 2512 wrote to memory of 584 2512 Mh.exe winlogon.exe PID 2512 wrote to memory of 584 2512 Mh.exe winlogon.exe PID 2512 wrote to memory of 584 2512 Mh.exe winlogon.exe PID 2512 wrote to memory of 668 2512 Mh.exe lsass.exe PID 2512 wrote to memory of 668 2512 Mh.exe lsass.exe PID 2512 wrote to memory of 668 2512 Mh.exe lsass.exe PID 2512 wrote to memory of 668 2512 Mh.exe lsass.exe PID 2512 wrote to memory of 668 2512 Mh.exe lsass.exe PID 2512 wrote to memory of 668 2512 Mh.exe lsass.exe PID 2512 wrote to memory of 772 2512 Mh.exe fontdrvhost.exe PID 2512 wrote to memory of 772 2512 Mh.exe fontdrvhost.exe PID 2512 wrote to memory of 772 2512 Mh.exe fontdrvhost.exe PID 2512 wrote to memory of 772 2512 Mh.exe fontdrvhost.exe PID 2512 wrote to memory of 772 2512 Mh.exe fontdrvhost.exe PID 2512 wrote to memory of 772 2512 Mh.exe fontdrvhost.exe PID 2512 wrote to memory of 780 2512 Mh.exe fontdrvhost.exe PID 2512 wrote to memory of 780 2512 Mh.exe fontdrvhost.exe PID 2512 wrote to memory of 780 2512 Mh.exe fontdrvhost.exe PID 2512 wrote to memory of 780 2512 Mh.exe fontdrvhost.exe PID 2512 wrote to memory of 780 2512 Mh.exe fontdrvhost.exe PID 2512 wrote to memory of 780 2512 Mh.exe fontdrvhost.exe PID 2512 wrote to memory of 792 2512 Mh.exe svchost.exe PID 2512 wrote to memory of 792 2512 Mh.exe svchost.exe PID 2512 wrote to memory of 792 2512 Mh.exe svchost.exe PID 2512 wrote to memory of 792 2512 Mh.exe svchost.exe PID 2512 wrote to memory of 792 2512 Mh.exe svchost.exe PID 2512 wrote to memory of 792 2512 Mh.exe svchost.exe PID 2512 wrote to memory of 912 2512 Mh.exe svchost.exe PID 2512 wrote to memory of 912 2512 Mh.exe svchost.exe PID 2512 wrote to memory of 912 2512 Mh.exe svchost.exe PID 2512 wrote to memory of 912 2512 Mh.exe svchost.exe PID 2512 wrote to memory of 912 2512 Mh.exe svchost.exe PID 2512 wrote to memory of 912 2512 Mh.exe svchost.exe PID 2512 wrote to memory of 960 2512 Mh.exe svchost.exe PID 2512 wrote to memory of 960 2512 Mh.exe svchost.exe PID 2512 wrote to memory of 960 2512 Mh.exe svchost.exe PID 2512 wrote to memory of 960 2512 Mh.exe svchost.exe PID 2512 wrote to memory of 960 2512 Mh.exe svchost.exe PID 2512 wrote to memory of 960 2512 Mh.exe svchost.exe PID 2512 wrote to memory of 64 2512 Mh.exe dwm.exe PID 2512 wrote to memory of 64 2512 Mh.exe dwm.exe PID 2512 wrote to memory of 64 2512 Mh.exe dwm.exe PID 2512 wrote to memory of 64 2512 Mh.exe dwm.exe PID 2512 wrote to memory of 64 2512 Mh.exe dwm.exe PID 2512 wrote to memory of 64 2512 Mh.exe dwm.exe PID 2512 wrote to memory of 388 2512 Mh.exe svchost.exe PID 2512 wrote to memory of 388 2512 Mh.exe svchost.exe PID 2512 wrote to memory of 388 2512 Mh.exe svchost.exe PID 2512 wrote to memory of 388 2512 Mh.exe svchost.exe PID 2512 wrote to memory of 388 2512 Mh.exe svchost.exe PID 2512 wrote to memory of 388 2512 Mh.exe svchost.exe PID 2512 wrote to memory of 864 2512 Mh.exe svchost.exe PID 2512 wrote to memory of 864 2512 Mh.exe svchost.exe PID 2512 wrote to memory of 864 2512 Mh.exe svchost.exe PID 2512 wrote to memory of 864 2512 Mh.exe svchost.exe PID 2512 wrote to memory of 864 2512 Mh.exe svchost.exe PID 2512 wrote to memory of 864 2512 Mh.exe svchost.exe PID 2512 wrote to memory of 956 2512 Mh.exe svchost.exe PID 2512 wrote to memory of 956 2512 Mh.exe svchost.exe PID 2512 wrote to memory of 956 2512 Mh.exe svchost.exe PID 2512 wrote to memory of 956 2512 Mh.exe svchost.exe
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"2⤵
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\Mh.exe"C:\Users\Admin\AppData\Local\Temp\Mh.exe"2⤵
- Modifies firewall policy service
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵
-
C:\Windows\update.exeC:\Windows\update.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\dni831F.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Users\Admin\AppData\Local\Temp\dni831F.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Users\Admin\AppData\Local\Temp\dni831F.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Windows\Temp\pni869A.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Windows\Temp\pni869A.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Windows\Temp\qoi8CA6.tmpFilesize
237KB
MD57bc53c4e584b5b3952f51f30b614a13f
SHA137e3bb970ae0338ca244a3ad270802bb6f447d38
SHA2561aa9171c8fdb831b8d8c32273b3cd911eb0b4ef7024017d057231f96360020e4
SHA51257a6ff6c10ff42c8998ca920b934ea071f75b6fe1172e768bfa318e98a6cda2869bd678d7f569b14106601bc7efb0ea1725d1d1a538227616695e017a8abe59f
-
C:\Windows\update.exeFilesize
410KB
MD56b6fa473cd53b3b1d20fb7d0d7d94dd2
SHA1ac8682258ec2a9556c5b06dac4b70aa7f408146b
SHA256e4a5f740683ce26d8312c336e1a2d50aa5b56efe61fc793ff3f9dc08af2da30d
SHA51259a132a04c621aad34c2130895e1c33f8a988a1d400b91ab712c4058ab6fefda698d01f395dd88f15cc8382f6826eee6550296b00981581a5b8abb10682fe9b0
-
C:\Windows\update.exeFilesize
410KB
MD56b6fa473cd53b3b1d20fb7d0d7d94dd2
SHA1ac8682258ec2a9556c5b06dac4b70aa7f408146b
SHA256e4a5f740683ce26d8312c336e1a2d50aa5b56efe61fc793ff3f9dc08af2da30d
SHA51259a132a04c621aad34c2130895e1c33f8a988a1d400b91ab712c4058ab6fefda698d01f395dd88f15cc8382f6826eee6550296b00981581a5b8abb10682fe9b0
-
memory/2512-167-0x000000007FE30000-0x000000007FE3C000-memory.dmpFilesize
48KB
-
memory/2512-180-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB
-
memory/2512-143-0x000000007FE40000-0x000000007FE4C000-memory.dmpFilesize
48KB
-
memory/2512-142-0x000000007FE40000-0x000000007FE4C000-memory.dmpFilesize
48KB
-
memory/2512-141-0x000000007FE40000-0x000000007FE4C000-memory.dmpFilesize
48KB
-
memory/2512-162-0x0000000002180000-0x00000000021F3000-memory.dmpFilesize
460KB
-
memory/2512-214-0x000000007FE40000-0x000000007FE4C000-memory.dmpFilesize
48KB
-
memory/2512-207-0x000000007FE30000-0x000000007FE3C000-memory.dmpFilesize
48KB
-
memory/2512-165-0x000000007FE30000-0x000000007FE3C000-memory.dmpFilesize
48KB
-
memory/2512-166-0x000000007FE30000-0x000000007FE3C000-memory.dmpFilesize
48KB
-
memory/2512-138-0x0000000002180000-0x00000000021F3000-memory.dmpFilesize
460KB
-
memory/2512-137-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB
-
memory/2512-177-0x000000007FE30000-0x000000007FE3C000-memory.dmpFilesize
48KB
-
memory/2512-178-0x000000007FE40000-0x000000007FE4C000-memory.dmpFilesize
48KB
-
memory/2512-179-0x000000007FE30000-0x000000007FE3C000-memory.dmpFilesize
48KB
-
memory/2512-149-0x0000000010000000-0x0000000010015000-memory.dmpFilesize
84KB
-
memory/2512-206-0x000000007FE40000-0x000000007FE4C000-memory.dmpFilesize
48KB
-
memory/2512-203-0x000000007FE30000-0x000000007FE3C000-memory.dmpFilesize
48KB
-
memory/2512-184-0x000000007FE30000-0x000000007FE3C000-memory.dmpFilesize
48KB
-
memory/2512-189-0x000000007FE30000-0x000000007FE3C000-memory.dmpFilesize
48KB
-
memory/2512-190-0x000000007FE40000-0x000000007FE4C000-memory.dmpFilesize
48KB
-
memory/2512-191-0x0000000002180000-0x00000000021F3000-memory.dmpFilesize
460KB
-
memory/2512-197-0x000000007FE40000-0x000000007FE4C000-memory.dmpFilesize
48KB
-
memory/2512-198-0x000000007FE30000-0x000000007FE3C000-memory.dmpFilesize
48KB
-
memory/4512-183-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB
-
memory/4512-182-0x00000000005C0000-0x0000000000633000-memory.dmpFilesize
460KB
-
memory/4512-164-0x00000000005C0000-0x0000000000633000-memory.dmpFilesize
460KB
-
memory/4512-163-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB
-
memory/4512-218-0x00000000005C0000-0x0000000000633000-memory.dmpFilesize
460KB