blustealer | e1c7bbb8d2741efb4b5357b1b65d14821ae4436e57c0aafc34e3852fa6083129

Analysis

max time kernel
85s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
05/08/2023, 21:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
Size

1.4MB
MD5

34aa0ca40863c30653a0b6ba10d3daa2
SHA1

c5dbbc9a3f6d537ab49aeb89223810cd67c256f7
SHA256

427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9
SHA512

34e46909f3ea586033baa5f73ecbf1f5072f2d05cfaf77f6ab2535ee0798f01427b1e62719fc4026f4b38af03e445a33ff2deb22ef9817ab42e506cfb5cb10d2
SSDEEP

24576:O94Lauo2BLrZ6dj7Wd50QKQIsBJXkQsUc/i/Egj87qLom0Y5m6Uy:O/uHrZ6WPKQ5X0QsUN/EgQ7qEmv

Score

10^/10

blustealer spyware stealer

Malware Config

Extracted

Family

blustealer

https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325

Signatures

BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

Executes dropped EXE 22 IoCs

pid	Process
1148	alg.exe
640	DiagnosticsHub.StandardCollector.Service.exe
2320	fxssvc.exe
1820	elevation_service.exe
4760	elevation_service.exe
2004	maintenanceservice.exe
1012	msdtc.exe
3640	OSE.EXE
1740	PerceptionSimulationService.exe
3832	perfhost.exe
2484	locator.exe
1548	SensorDataService.exe
3764	snmptrap.exe
1844	spectrum.exe
4204	ssh-agent.exe
5072	TieringEngineService.exe
2192	SearchFilterHost.exe
4568	vds.exe
3672	vssvc.exe
1860	wbengine.exe
4480	WmiApSrv.exe
4244	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Windows\System32\msdtc.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Windows\system32\msiexec.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Windows\System32\alg.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Windows\system32\AgentService.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Windows\system32\locator.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Windows\system32\spectrum.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Windows\System32\vds.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Windows\system32\wbengine.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c2d3af1a7176c85f.bin	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Windows\system32\vssvc.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1988 set thread context of 3816	1988	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe	92
PID 3816 set thread context of 5080	3816	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe	98

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\klist.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\javacpl.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmid.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\kinit.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\tnameserv.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\orbd.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\rmid.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\wsimport.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\java.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jvisualvm.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\jabswitch.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\ktab.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec64.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\rmiregistry.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\native2ascii.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\ktab.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\servertool.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\rmic.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmiregistry.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{999D2D33-1062-43FC-851C-66B4A533BE0F}\chrome_installer.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\servertool.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 57 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d21b572ae3c7d901	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004fbcfa2be3c7d901	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d48e502ce3c7d901	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001da74434e3c7d901	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b653552ce3c7d901	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000053a6062ce3c7d901	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000092fde12ce3c7d901	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006c55712ae3c7d901	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	81	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1988	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
1988	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
1988	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
1988	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
1988	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
1988	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeDebugPrivilege	1988	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
Token: SeTakeOwnershipPrivilege	3816	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
Token: SeAuditPrivilege	2320	fxssvc.exe
Token: SeRestorePrivilege	5072	TieringEngineService.exe
Token: SeManageVolumePrivilege	5072	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2192	SearchFilterHost.exe
Token: SeBackupPrivilege	3672	vssvc.exe
Token: SeRestorePrivilege	3672	vssvc.exe
Token: SeAuditPrivilege	3672	vssvc.exe
Token: SeBackupPrivilege	1860	wbengine.exe
Token: SeRestorePrivilege	1860	wbengine.exe
Token: SeSecurityPrivilege	1860	wbengine.exe
Token: 33	4244	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4244	SearchIndexer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3816	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 3152	1988	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe	89
PID 1988 wrote to memory of 3152	1988	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe	89
PID 1988 wrote to memory of 3152	1988	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe	89
PID 1988 wrote to memory of 4980	1988	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe	90
PID 1988 wrote to memory of 4980	1988	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe	90
PID 1988 wrote to memory of 4980	1988	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe	90
PID 1988 wrote to memory of 3040	1988	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe	91
PID 1988 wrote to memory of 3040	1988	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe	91
PID 1988 wrote to memory of 3040	1988	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe	91
PID 1988 wrote to memory of 3816	1988	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe	92
PID 1988 wrote to memory of 3816	1988	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe	92
PID 1988 wrote to memory of 3816	1988	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe	92
PID 1988 wrote to memory of 3816	1988	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe	92
PID 1988 wrote to memory of 3816	1988	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe	92
PID 1988 wrote to memory of 3816	1988	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe	92
PID 1988 wrote to memory of 3816	1988	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe	92
PID 1988 wrote to memory of 3816	1988	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe	92
PID 3816 wrote to memory of 5080	3816	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe	98
PID 3816 wrote to memory of 5080	3816	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe	98
PID 3816 wrote to memory of 5080	3816	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe	98
PID 3816 wrote to memory of 5080	3816	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe	98
PID 3816 wrote to memory of 5080	3816	427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe	98
PID 4244 wrote to memory of 4208	4244	SearchIndexer.exe	119
PID 4244 wrote to memory of 4208	4244	SearchIndexer.exe	119
PID 4244 wrote to memory of 2192	4244	SearchIndexer.exe	120
PID 4244 wrote to memory of 2192	4244	SearchIndexer.exe	120

C:\Users\Admin\AppData\Local\Temp\427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
"C:\Users\Admin\AppData\Local\Temp\427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Users\Admin\AppData\Local\Temp\427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
  "C:\Users\Admin\AppData\Local\Temp\427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe"
  2⤵
  PID:3152
- C:\Users\Admin\AppData\Local\Temp\427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
  "C:\Users\Admin\AppData\Local\Temp\427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe"
  2⤵
  PID:4980
- C:\Users\Admin\AppData\Local\Temp\427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
  "C:\Users\Admin\AppData\Local\Temp\427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe"
  2⤵
  PID:3040
- C:\Users\Admin\AppData\Local\Temp\427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe
  "C:\Users\Admin\AppData\Local\Temp\427279a267a65691961da1112b7c562ba7c707709b681c71a7194aa136066eb9.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3816
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    3⤵
    PID:5080

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1148

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:640

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4892

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2320

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1820

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4760

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2004

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1012

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3640

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1740

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3832

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2484

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
PID:1548

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3764

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
PID:1844

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2024

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5072

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:2192

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4568

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3672

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1860

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4480

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4208
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

Filesize
2.1MB

MD5
279a162a0f457c3925c6d25f552077f8

SHA1
e742ae135af96e778b2d6e3fa857e093865cb552

SHA256
5eed62f6763fca950bf9e084277eae334b1b839500102c27588ca15958ba1250

SHA512
b74d4345756d9f4b061a2e62b121995602899ed8e6d1f3af49dda7138c5075231ae3ace3dd523131e984d229474452fe10a9be558a5438892b14beca842dbc0e

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
1.4MB

MD5
4b16efd15c0656b33cb2b7ae999627ad

SHA1
0e9a1c7d17ed20972d5353d8db13d8ae23246865

SHA256
81d5bba95f82ace536b92b7f42376604c175c8f0ebc5755590b58668fc117a94

SHA512
7570c5b0d2f30921ab146c8f99dc3a490882b45f7ef770a46740382b85a598a4801783128f089345de05e7c89dbd1ac435c877eb06479571a04b62ed581476ff

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
1.5MB

MD5
3867ae71d8f0d7883fb2c9baedaae155

SHA1
3ac163b2d80cf6ebbe6cf461836cb9e3d2a6d9ea

SHA256
66dfb26f2f39f251aaf488af75b08132c2dcc6ae109ba4d38ff3a1b5ffb96318

SHA512
120c570355f87dec6a22c9076ff4783da6d1f7074227756ce31ec92d35515ae259d5a5933f38efb4582b935c37ab293867f346ed5a4849ce29f52da3e3a8261f

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
2.1MB

MD5
051ac924b4e4164726e16902724bd3c7

SHA1
a74a72ffc59a92fa782a09d0589542ed48f55183

SHA256
9901c51e110bbe3e9530c3811fb981885658d0b92383ec2888ec73492aaf9fd3

SHA512
83c2fa9a03400938b41e9a06482a3f4ee0ea789b18febd94f654930b238fba6f39a250f8992655e014d13d14239b3ac5139819f264959f2d031261aa869ce772

Download Submit
C:\Windows\SysWOW64\perfhost.exe

Filesize
1.2MB

MD5
a7bcf89e42ce56c3e93ffa24803df9bb

SHA1
d9bd782344c4dbc49c7ea28596d59186d2a7906a

SHA256
c44a3cb0db32e42d2d7ebe1eccc091e191ca40012dec35851497b12d19780d0a

SHA512
d5eaa990f10e0a6eb0b6b81b75c268a2d2db8c00464abfa0873f3cb8cff34efd4d88ad7ecdf9caf4328aa2ec3a402328ac7b98d58748362404450520847f60b8

Download Submit
C:\Windows\System32\AgentService.exe

Filesize
1.7MB

MD5
699f3a92f5403196421779b7608713ad

SHA1
467fd212aed527983b0822c814e60a0d1cbe9f0c

SHA256
e50a267b91efb6f20ad98cd816a942644d10c5b912e94c5516f054fe04a85068

SHA512
39cfc9c243d9bc092572d07de293d1894001ec050c38e70298fd644b46a8c44eb7d1e7d3d3ab562c423983c403bb21e917ad633edddf2110947c7ad6f9245034

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Filesize
1.3MB

MD5
f829499a6662d81fd3f937697a97b100

SHA1
a9836a6243f6dc8f450704ced4f205657813ee68

SHA256
5401942354a9a5ceeaf8715a22cbcb36d3a83b88e3a3833a677bd3e179f0cc48

SHA512
36e22b5d9ba96b897bdb2beff0b25881951e9bf04ffe9077d9d7f7a6b566494726a146e2ca67cd5756d56f63b1e93e290f4cbe5ce56670a9c350c1026efc6cfc

Download Submit
C:\Windows\System32\FXSSVC.exe

Filesize
1.2MB

MD5
a1e88030b2449f9ac78adb16bf938086

SHA1
0f1effe7750977648384ce11622495c8f031b00f

SHA256
72939196dc73d3dbc930775b94b1a61a271d4ae9959e19b8b1eee0e35dbcef0c

SHA512
a895015052867b5034b54308aca2f04538d6c1f827695836ae5645fdfd24b5f8382b580727db6df4a7bf83b9ebaf73ea90bd748f7bfc6e65bf3ee766fa166027

Download Submit
C:\Windows\System32\Locator.exe

Filesize
1.2MB

MD5
f9ae4b83b531a0f96fb732e43db3498b

SHA1
3007decfcddbe4c60ea0eaecd01b90767a6e1717

SHA256
6d342c6ef7276fee0e69882197a48335c5b6ffa016fc4c9ace148a8e9b5982e1

SHA512
97aec66cb2f3b4f717ddeb4f1f87d47193b893d1eca39abab7345c3e5563ad29523ad5266d6fb1639ffb60d4f2dfe284677f0f2ebbf3c00440f04111ddf0225a

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe

Filesize
1.6MB

MD5
e42eae98aeda344ee8a50e225f240741

SHA1
8341f836a4ba7e06db896f50798f57c5d9be680c

SHA256
0e19d0ed88595549296ffe92763d6d4272736003cc1804db52d8f1a351e191c3

SHA512
1b4094703fd909a2b7c49cde350864ec5496a009d5c094c305d3b14516f3abdc4e5f6c92e071ed83c90c5a14260b28f61dbef3da2163f2f137a975377a666e48

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe

Filesize
1.6MB

MD5
e42eae98aeda344ee8a50e225f240741

SHA1
8341f836a4ba7e06db896f50798f57c5d9be680c

SHA256
0e19d0ed88595549296ffe92763d6d4272736003cc1804db52d8f1a351e191c3

SHA512
1b4094703fd909a2b7c49cde350864ec5496a009d5c094c305d3b14516f3abdc4e5f6c92e071ed83c90c5a14260b28f61dbef3da2163f2f137a975377a666e48

Download Submit
C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

Filesize
1.3MB

MD5
02d1198a254338ff8e254a41a6b9d706

SHA1
0940bea48117fcc2fcd2d574f1b31e08198e5c79

SHA256
66bb5e7803982d652656ec06118a70f467076f4972ab20905caa25b857eecf36

SHA512
7bac4f289426a1ca9076535a3829f6c275870ba11424626cd848709791e382dd322028278ca0f02916dab7bfc8db4b985f41aec179d29da2a1456c5049e4dd15

Download Submit
C:\Windows\System32\SearchIndexer.exe

Filesize
1.4MB

MD5
42a45b1ba35be7eb117d737b74ffffaa

SHA1
882cf4f769c84c635c3e38a0537f295942c680d6

SHA256
cf6b13261a047b17a292afdfbc04a1dc757419c40d92514d2b45e5cb8fb5a327

SHA512
4b25bbb3d513899d7cc8e93a8e15b34f83688a08e40fcc368ca8caebf883e34d5a9d2e84865b0b519ba97a264f315a164ab349ee7f3a8b0a7e29281091ac8f45

Download Submit
C:\Windows\System32\SensorDataService.exe

Filesize
1.8MB

MD5
5231411340b02e8caa33f8cbfd5b6eff

SHA1
bff13798aab8cbd6fdccbe3ec5ecce94805dbdde

SHA256
08bef788f27bc9d202bb34486918a08974e58c7aa9f57482622a0a0947e24abd

SHA512
22d7c3e90610867cad1c4365a575dd75c52108c9033d45b6d9aa57dbd498ae26b72a1bcaa4d8665b96314231f516378a42664bc27f6048fc89c198be29f5a873

Download Submit
C:\Windows\System32\Spectrum.exe

Filesize
1.4MB

MD5
17321ff42daf4929302b8e4c4159fbad

SHA1
eb8038c63c6b6e5c9ac38b80b5c9b4398e3f3efa

SHA256
b6c282937000908b26292177125b049a9b8fdb50d28ce4b540044b963718ecf6

SHA512
8761d4890da35ce9b110e345bca6894d60558fe400f8f71ecfe9104f47097971abe251a13fe4ef400aebbbdff33fa2d586c79e26df19dec4278e5713fab7b7b4

Download Submit
C:\Windows\System32\TieringEngineService.exe

Filesize
1.5MB

MD5
e59c9d2dfcecfcef1af627b2f57e672a

SHA1
4cdedc0014c5b554fff0c5ded28819f399f95419

SHA256
741772b31c0789bf0f6ded514ff8fbf189ad7cf71fce78854eeac443c4685891

SHA512
a98058e92f1c16f029743a1da7023109595c6ec8ae10172960410043fe25216f621266e55f461f48430ab3f08a3508d133fcf1079f80653b163c569e9ec24842

Download Submit
C:\Windows\System32\VSSVC.exe

Filesize
2.0MB

MD5
03303ef18d8e2c0e4ac535978c5d2652

SHA1
e6c88babd0120324b9f6c2c737b1beae40aa9159

SHA256
18f09304d53df6eaf298333b383ee0d5a4a17a31de070b19f3b562702da1b37d

SHA512
33d5e3ad0a83aa74da4348a22bb725f70c962ec71d7c8ef12abc5229363a859055cb67a1e3545785a24dfb177cce999647aa70cd29d91e5195d7be38f807f06b

Download Submit
C:\Windows\System32\alg.exe

Filesize
1.3MB

MD5
b585737688296e380bcd186ca9f20b12

SHA1
54d5e9cb70e782e911771b317203f1a4c4493822

SHA256
2940b7cc850907e2c64bde47cd88ed76af00bed20780347a76b8ed2cb8fa3c3a

SHA512
c2b6543c12305a7cb580c55c012d1065ba1cd2c1c64b237665210c7735b18935ec11801526840654459ed4ff470f9c9611988f7ff85e31da7b832d382da0bd01

Download Submit
C:\Windows\System32\msdtc.exe

Filesize
1.4MB

MD5
ef1721fdc2d98d80e8e52a38c13b946b

SHA1
2b68b91edd71c55d6e351726ae5f8bd15cd06bd4

SHA256
4ca33bb8816c225fa5e72797d133e67238e48a851a14f1228edf3d88b3c7d266

SHA512
a3004efa1153c52a11a2a348772488eb727356a17d0f9419762a47848399de985889bd5ee16ee72ab83ac0cf2a154d56e6fa9937163cdde127b5323c6598ac8b

Download Submit
C:\Windows\System32\snmptrap.exe

Filesize
1.2MB

MD5
43567adfca1e0dcea7243464f573e762

SHA1
f95056888e1c243f3f2f33e1fd7e88ec368de100

SHA256
8ba498ba005e2f846bf16164fb2af4ced989e568bf815aada7f50559d7cdf800

SHA512
5655c83a2d3427801e3dbc53e15a418c225ddc068c8078713d2bcb3ecc6bb11abb9e0d4fe17e7a81d6b5adb07a7c0221ec7f8b196e84d5659da91b3b9b0d7d36

Download Submit
C:\Windows\System32\vds.exe

Filesize
1.3MB

MD5
c735788be2e69b5ee42157330555c693

SHA1
9b39a6f49493b7dc493a6f3b69f777e833bb00be

SHA256
ad6103dff2edc97d33044abd64cc8c7212bb9e971055180260f3f48e45737b3a

SHA512
88fb8ebbdf6fdf16278b9dd38377e6544f2f746e51249adb890584719d3a6e6c3136e58533ca8bb28e9044984bb22a4915f36b9e181a7fcd7be61c91efc1b052

Download Submit
C:\Windows\System32\wbem\WmiApSrv.exe

Filesize
1.4MB

MD5
cdb55154a0127f9c4c74288f763c6583

SHA1
702976930cf0aefd0fd5c4b953dc393b5706b7b4

SHA256
000b3a089c5b11d395f69ce951fabeb4ea99530a9c123b5a3759f4ecf1d2b2d3

SHA512
1de9491ed5ba09aeac49dc43f88672de8f071bc8bb36ff70ec5c2e2d6c617551f32bfac743112488d8d750fa9b6b5b409e2176762febf1005fc456ec3b5c833b

Download Submit
C:\Windows\System32\wbengine.exe

Filesize
2.1MB

MD5
38f949f53b3ab2623474f2c6a967ec45

SHA1
ce0a0b0086672fa0809d6fd440771c6adcfed936

SHA256
ed33c18eaa4e0317941c115f01867d9b754dfbcd7442cc917bbc4537eb29e845

SHA512
0fbf7be35f3431ee111f84dd8544c6c49e1878b5fa154b7bed78ccea158f3fb0dfa802968ecf171f5a05e18969f27269f5925f717a11768f909e19819e5a9546

Download Submit
memory/640-183-0x00000000004C0000-0x0000000000520000-memory.dmp

Filesize
384KB

Download
memory/640-176-0x0000000140000000-0x0000000140200000-memory.dmp

Filesize
2.0MB

Download
memory/640-239-0x0000000140000000-0x0000000140200000-memory.dmp

Filesize
2.0MB

Download
memory/640-175-0x00000000004C0000-0x0000000000520000-memory.dmp

Filesize
384KB

Download
memory/1012-256-0x0000000000800000-0x0000000000860000-memory.dmp

Filesize
384KB

Download
memory/1012-313-0x0000000140000000-0x0000000140210000-memory.dmp

Filesize
2.1MB

Download
memory/1012-248-0x0000000140000000-0x0000000140210000-memory.dmp

Filesize
2.1MB

Download
memory/1012-249-0x0000000000800000-0x0000000000860000-memory.dmp

Filesize
384KB

Download
memory/1148-226-0x0000000140000000-0x0000000140201000-memory.dmp

Filesize
2.0MB

Download
memory/1148-162-0x0000000140000000-0x0000000140201000-memory.dmp

Filesize
2.0MB

Download
memory/1148-161-0x0000000000590000-0x00000000005F0000-memory.dmp

Filesize
384KB

Download
memory/1148-169-0x0000000000590000-0x00000000005F0000-memory.dmp

Filesize
384KB

Download
memory/1548-381-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/1548-315-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/1548-322-0x00000000006C0000-0x0000000000720000-memory.dmp

Filesize
384KB

Download
memory/1740-340-0x0000000140000000-0x0000000140202000-memory.dmp

Filesize
2.0MB

Download
memory/1740-286-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Filesize
384KB

Download
memory/1740-278-0x0000000140000000-0x0000000140202000-memory.dmp

Filesize
2.0MB

Download
memory/1820-207-0x00000000007F0000-0x0000000000850000-memory.dmp

Filesize
384KB

Download
memory/1820-265-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/1820-199-0x00000000007F0000-0x0000000000850000-memory.dmp

Filesize
384KB

Download
memory/1820-200-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/1844-341-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/1844-349-0x0000000000660000-0x00000000006C0000-memory.dmp

Filesize
384KB

Download
memory/1988-135-0x0000000005370000-0x0000000005914000-memory.dmp

Filesize
5.6MB

Download
memory/1988-133-0x00000000001F0000-0x000000000035C000-memory.dmp

Filesize
1.4MB

Download
memory/1988-134-0x0000000074E90000-0x0000000075640000-memory.dmp

Filesize
7.7MB

Download
memory/1988-138-0x0000000004D50000-0x0000000004D5A000-memory.dmp

Filesize
40KB

Download
memory/1988-139-0x0000000074E90000-0x0000000075640000-memory.dmp

Filesize
7.7MB

Download
memory/1988-141-0x00000000073B0000-0x000000000744C000-memory.dmp

Filesize
624KB

Download
memory/1988-148-0x0000000074E90000-0x0000000075640000-memory.dmp

Filesize
7.7MB

Download
memory/1988-140-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

Filesize
64KB

Download
memory/1988-137-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

Filesize
64KB

Download
memory/1988-136-0x0000000004DC0000-0x0000000004E52000-memory.dmp

Filesize
584KB

Download
memory/2004-243-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Filesize
384KB

Download
memory/2004-230-0x0000000140000000-0x0000000140221000-memory.dmp

Filesize
2.1MB

Download
memory/2004-246-0x0000000140000000-0x0000000140221000-memory.dmp

Filesize
2.1MB

Download
memory/2004-232-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Filesize
384KB

Download
memory/2004-238-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Filesize
384KB

Download
memory/2192-395-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/2192-390-0x0000000000500000-0x0000000000560000-memory.dmp

Filesize
384KB

Download
memory/2192-384-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/2192-396-0x0000000000500000-0x0000000000560000-memory.dmp

Filesize
384KB

Download
memory/2320-212-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/2320-194-0x0000000000DC0000-0x0000000000E20000-memory.dmp

Filesize
384KB

Download
memory/2320-188-0x0000000000DC0000-0x0000000000E20000-memory.dmp

Filesize
384KB

Download
memory/2320-187-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/2320-195-0x0000000000DC0000-0x0000000000E20000-memory.dmp

Filesize
384KB

Download
memory/2320-210-0x0000000000DC0000-0x0000000000E20000-memory.dmp

Filesize
384KB

Download
memory/2484-301-0x0000000140000000-0x00000001401EC000-memory.dmp

Filesize
1.9MB

Download
memory/2484-309-0x0000000000500000-0x0000000000560000-memory.dmp

Filesize
384KB

Download
memory/2484-368-0x0000000140000000-0x00000001401EC000-memory.dmp

Filesize
1.9MB

Download
memory/3640-275-0x0000000000920000-0x0000000000980000-memory.dmp

Filesize
384KB

Download
memory/3640-327-0x0000000140000000-0x0000000140226000-memory.dmp

Filesize
2.1MB

Download
memory/3640-267-0x0000000140000000-0x0000000140226000-memory.dmp

Filesize
2.1MB

Download
memory/3764-330-0x0000000140000000-0x00000001401ED000-memory.dmp

Filesize
1.9MB

Download
memory/3764-336-0x00000000006C0000-0x0000000000720000-memory.dmp

Filesize
384KB

Download
memory/3764-398-0x0000000140000000-0x00000001401ED000-memory.dmp

Filesize
1.9MB

Download
memory/3816-153-0x00000000033A0000-0x0000000003406000-memory.dmp

Filesize
408KB

Download
memory/3816-154-0x00000000033A0000-0x0000000003406000-memory.dmp

Filesize
408KB

Download
memory/3816-142-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/3816-216-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/3816-145-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/3816-146-0x0000000000400000-0x0000000000654000-memory.dmp

Filesize
2.3MB

Download
memory/3816-147-0x00000000033A0000-0x0000000003406000-memory.dmp

Filesize
408KB

Download
memory/3832-355-0x0000000000400000-0x00000000005EE000-memory.dmp

Filesize
1.9MB

Download
memory/3832-363-0x00000000007B0000-0x0000000000816000-memory.dmp

Filesize
408KB

Download
memory/3832-290-0x0000000000400000-0x00000000005EE000-memory.dmp

Filesize
1.9MB

Download
memory/3832-297-0x00000000007B0000-0x0000000000816000-memory.dmp

Filesize
408KB

Download
memory/4204-365-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Filesize
384KB

Download
memory/4204-357-0x0000000140000000-0x0000000140259000-memory.dmp

Filesize
2.3MB

Download
memory/4760-220-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/4760-273-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/4760-215-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/4760-223-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/5072-377-0x0000000000690000-0x00000000006F0000-memory.dmp

Filesize
384KB

Download
memory/5072-369-0x0000000140000000-0x0000000140239000-memory.dmp

Filesize
2.2MB

Download
memory/5080-240-0x0000000074590000-0x0000000074D40000-memory.dmp

Filesize
7.7MB

Download
memory/5080-227-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

Filesize
64KB

Download
memory/5080-213-0x0000000000B00000-0x0000000000B66000-memory.dmp

Filesize
408KB

Download
memory/5080-224-0x0000000074590000-0x0000000074D40000-memory.dmp

Filesize
7.7MB

Download