7bfffae521bf579cd33463deb7e19ce83c69a5ab40bb71af96c3fe141c7b16fd

Analysis

max time kernel
176s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
03/11/2023, 15:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.fa2f8ea0dface3b3e935b106edef4150.dll
Size

3.5MB
MD5

fa2f8ea0dface3b3e935b106edef4150
SHA1

1944790945d8b7fee88d474404eb90b89d9384d6
SHA256

7bfffae521bf579cd33463deb7e19ce83c69a5ab40bb71af96c3fe141c7b16fd
SHA512

d0b3b0df5a5190444290b4e538546d01e7384d564bdd1aa86786f4f6b5ef759277627cb7ead3b79a9fd36b2c3c963aab7eb5b0c19378358fd09bb195dcd76827
SSDEEP

49152:mMXEiGdi/R+kKp+6FlLlCYuJPA3LBuq8NBU8AxdwDHVfv9ytA8Wpl+SJ8lQqhq:aBp+gtlCRiSJ8

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies security service 2 TTPs 5 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\PreshutdownTimeout = "57600000"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\RequiredPrivileges = 5300650041007500640069007400500072006900760069006c0065006700650000005300650043007200650061007400650047006c006f00620061006c00500072006900760069006c006500670065000000530065004300720065006100740065005000610067006500460069006c006500500072006900760069006c00650067006500000053006500540063006200500072006900760069006c00650067006500000053006500410073007300690067006e005000720069006d0061007200790054006f006b0065006e00500072006900760069006c0065006700650000005300650049006d0070006500720073006f006e00610074006500500072006900760069006c0065006700650000005300650049006e00630072006500610073006500510075006f0074006100500072006900760069006c0065006700650000000000	regsvr32.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters\ServiceDll = "C:\\Windows\\system32\\wuaueng.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters\ServiceMain = "WUServiceMain"	regsvr32.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters\ServiceDll = "C:\\Windows\\system32\\wuaueng.dll"	regsvr32.exe

Checks for any installed AV software in registry 1 TTPs 2 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	svchost.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avast Software\Avast	svchost.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\SLS\9482F4B4-E343-43B6-B170-9A65BC822C77\sls.cab	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\SLS\855E8A7C-ECB4-4CA3-B045-1DFA50104289\sls.cab	svchost.exe
File created	C:\Windows\SoftwareDistribution\Download\c0e8d71de8b53a2b9d1cd9915e1e5586\BlockMap.xml	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\SLS\855E8A7C-ECB4-4CA3-B045-1DFA50104289\TMP54D4.tmp	svchost.exe
File opened for modification	C:\Windows\WindowsUpdate.log	regsvr32.exe
File created	C:\Windows\SoftwareDistribution\SLS\2B81F1BF-356C-4FA1-90F1-7581A62C6764\sls.cab	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\SLS\2B81F1BF-356C-4FA1-90F1-7581A62C6764\TMP43AB.tmp	svchost.exe
File created	C:\Windows\SoftwareDistribution\Download\c799ec51450a41ff046dfd5e0ff1ae89\BlockMap.xml	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\SLS\9482F4B4-E343-43B6-B170-9A65BC822C77\TMP5197.tmp	svchost.exe
File created	C:\Windows\SoftwareDistribution\DataStore\Logs\tmp.edb	svchost.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe

Checks SCSI registry key(s) 3 TTPs 32 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\001C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0025	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0012	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0012	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0025	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\001C	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\001B	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\001C	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0025	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\001B	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0012	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\001B	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0025	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\001C	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\001B	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0012	svchost.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	svchost.exe

Modifies data under HKEY_USERS 42 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe

Modifies registry class 23 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f3b4e234-7a68-4e43-b813-e4ba55a065f6}	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\{8E566856-05B7-0001-CC89-568EB705DA01}\S-1-5-18\{44D9ABE1-2829-466F-A400-651155B9BD76}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7cd918ef-d777-4131-ac8d-ed16e93e898e}\ = "SUSInternalUpgrade Class 1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{784E29F4-5EBE-4279-9948-1E8FE941646D}\AppId = "{653C5148-4DCE-4905-9CFD-1B23662D3D9E}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\APPID\{653C5148-4DCE-4905-9CFD-1B23662D3D9E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\APPID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e60687f7-01a1-40aa-86ac-db1cbf673334}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7cd918ef-d777-4131-ac8d-ed16e93e898e}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{784E29F4-5EBE-4279-9948-1E8FE941646D}\ = "AUSessionConnectTaskHandler Class 1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{eff7f153-1c97-417a-b633-fede6683a939}\ = "AUSessionConnectTaskHandler Class 1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{653C5148-4DCE-4905-9CFD-1B23662D3D9E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f3b4e234-7a68-4e43-b813-e4ba55a065f6}\AppId = "{653C5148-4DCE-4905-9CFD-1B23662D3D9E}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9B1F122C-2982-4e91-AA8B-E071D54F2A4D}\AppId = "{653C5148-4DCE-4905-9CFD-1B23662D3D9E}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f3b4e234-7a68-4e43-b813-e4ba55a065f6}\ = "AUScheduledInstallTaskHandler Class 1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{784E29F4-5EBE-4279-9948-1E8FE941646D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{eff7f153-1c97-417a-b633-fede6683a939}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{eff7f153-1c97-417a-b633-fede6683a939}\AppId = "{653C5148-4DCE-4905-9CFD-1B23662D3D9E}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7cd918ef-d777-4131-ac8d-ed16e93e898e}\AppId = "{653C5148-4DCE-4905-9CFD-1B23662D3D9E}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9B1F122C-2982-4e91-AA8B-E071D54F2A4D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9B1F122C-2982-4e91-AA8B-E071D54F2A4D}\ = "CAutoUpdate Class 1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\{8E566856-05B7-0000-C290-568EB705DA01}\S-1-5-18\{4A8D2306-C842-4DDF-A6DD-AA147AC61ACD}	svchost.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2552	regsvr32.exe
Token: SeShutdownPrivilege	5088	svchost.exe
Token: SeCreatePagefilePrivilege	5088	svchost.exe
Token: SeShutdownPrivilege	5088	svchost.exe
Token: SeCreatePagefilePrivilege	5088	svchost.exe
Token: SeShutdownPrivilege	5088	svchost.exe
Token: SeCreatePagefilePrivilege	5088	svchost.exe
Token: SeShutdownPrivilege	5088	svchost.exe
Token: SeCreatePagefilePrivilege	5088	svchost.exe
Token: SeBackupPrivilege	5088	svchost.exe
Token: SeRestorePrivilege	5088	svchost.exe
Token: SeBackupPrivilege	5088	svchost.exe
Token: SeRestorePrivilege	5088	svchost.exe
Token: SeBackupPrivilege	5088	svchost.exe
Token: SeRestorePrivilege	5088	svchost.exe
Token: SeBackupPrivilege	5088	svchost.exe
Token: SeRestorePrivilege	5088	svchost.exe
Token: SeManageVolumePrivilege	5088	svchost.exe
Token: SeBackupPrivilege	5088	svchost.exe
Token: SeRestorePrivilege	5088	svchost.exe
Token: SeBackupPrivilege	5088	svchost.exe
Token: SeRestorePrivilege	5088	svchost.exe
Token: SeBackupPrivilege	5088	svchost.exe
Token: SeRestorePrivilege	5088	svchost.exe
Token: SeBackupPrivilege	5088	svchost.exe
Token: SeRestorePrivilege	5088	svchost.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\NEAS.fa2f8ea0dface3b3e935b106edef4150.dll
1⤵
- Modifies security service
- Sets DLL path for service in the registry
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s wuauserv
1⤵
- Checks for any installed AV software in registry
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RGI39F7.tmp

Filesize
5KB

MD5
b1de769b1de88d3c15dde48343ea675f

SHA1
5c29acd5ded8ce153b10e6df356f7ca6af725c65

SHA256
59a9466ba020839c9b20d8f545920b9ec807a1c89f6895b0e78f0ca8a07bf989

SHA512
4dd8ea6901d51d7e9c2b4286241eccd9838a2f37cdc67db0c34069c1a06cd39160947f9c4c656c4ef7105f207ff28f0b01f55367c57eafff79c86d3a662fde1a

Download Submit
C:\Windows\SoftwareDistribution\SLS\2B81F1BF-356C-4FA1-90F1-7581A62C6764\TMP43AB.tmp

Filesize
16KB

MD5
d410319561b5559e46f2d12a94a463f5

SHA1
6c5aed5986ecb1acda7c6b80cfd3d41cff7faf29

SHA256
7d33dcedb1aef041eaa4c7b1c6139843a3da71128382c93e9c516d625922d4b9

SHA512
6ae16b3a6a79a0f0fe308a49c8cae9603743343ca0c3afc635129c92f51958593f49a06df148cb5376cde403cf7ddc3fb29dfb1774182969c0d994dd2a29d725

Download Submit
C:\Windows\SoftwareDistribution\SLS\2B81F1BF-356C-4FA1-90F1-7581A62C6764\sls.cab

Filesize
23KB

MD5
df05ac827e0d5ef261a0103db3d6b086

SHA1
ab26c67c4f72e4dffad5686e7f912773d6797cc9

SHA256
4156412f0ed20b33707572e12603468fd1844c89f66aaa9509f55b2dce540c72

SHA512
84255d98a249ab635f9b2eee382bbfe945edc09c3a63bef6dfb686061b20642861d6c26ba11e8a67eb1a9a956a2e2ec26dbd7ea93a9d34475f04f9a250fe6c90

Download Submit
C:\Windows\SoftwareDistribution\SLS\855E8A7C-ECB4-4CA3-B045-1DFA50104289\TMP54D4.tmp

Filesize
29KB

MD5
165979b7bfbfb10099f8f7f69c29c94d

SHA1
a37f36c61f8ba27705e9e6cfc10a39bb47c1a119

SHA256
bc0136b29983b6508f5d284dbb23891fbcfd170c12d115dcf8788034cff949b0

SHA512
31b8eddc93e25768718407a356aa51f15df10e61a5b5dc29bdd278fbeac2bbd23d7ac1199e4c04914b837bffa7052af0b564da666c05a9151efe922063454041

Download Submit
C:\Windows\SoftwareDistribution\SLS\855E8A7C-ECB4-4CA3-B045-1DFA50104289\sls.cab

Filesize
37KB

MD5
c3b5852f73b43cf19dfd1da78886e128

SHA1
5e15062d33a677850f853dcecc5ff0fae92b3df8

SHA256
003978a8c3beeba597c4b3308049245618c83b498a399bdec022ed0b761a0abb

SHA512
d550cdb4e4cf1d81b3f96f9b28e42bffd6c7bea38faca738542f886a299d6af15ab61228a4caf9b4ac689b05c100e736b251dfbcc25f3274ab6f8107c8bfc3aa

Download Submit
C:\Windows\SoftwareDistribution\SLS\9482F4B4-E343-43B6-B170-9A65BC822C77\TMP5197.tmp

Filesize
25KB

MD5
b96f3c205fa38c44254b0ef5e46b6187

SHA1
939e293cc6d6ee47459a63e50aa95c4e0333b2de

SHA256
6f99bc79bc58acd3854ecd03fb7cc0b4bfa311197467407e397eb9511e506139

SHA512
f515cb0cd13081b5b7fa47977446696457aeaf8aa47982c7c421e8505f09e888e9f7a7e599e895d6d2f2183139b43e287cdee9b95bf6e86a401821b8ed937f75

Download Submit
C:\Windows\SoftwareDistribution\SLS\9482F4B4-E343-43B6-B170-9A65BC822C77\sls.cab

Filesize
35KB

MD5
5b903c1057d55077131c30b0d7fc5201

SHA1
cfe1b07a6620d84015a80cd3cdcffe33582a6b35

SHA256
b4290a223af42fd19d5fd94650a601204a09d4dd3bbf5f72a4ad4fba8192188b

SHA512
7b3934c8495d04be5f0a32cd0b3fb6db8196ab3a5c8adcd3f2ff18bccad9178023617d51a9258f0b5d1fa12c38fc14f840f40207e5b47e0e2e36a34903ee8387

Download Submit
memory/5088-13-0x000002CCE5790000-0x000002CCE57A0000-memory.dmp

Filesize
64KB

Download
memory/5088-45-0x000002CCEAC30000-0x000002CCEAC34000-memory.dmp

Filesize
16KB

Download
memory/5088-46-0x000002CCEAC20000-0x000002CCEAC21000-memory.dmp

Filesize
4KB

Download
memory/5088-42-0x000002CCEA980000-0x000002CCEA984000-memory.dmp

Filesize
16KB

Download
memory/5088-25-0x000002CCEA410000-0x000002CCEA414000-memory.dmp

Filesize
16KB

Download
memory/5088-19-0x000002CCE5D20000-0x000002CCE5D30000-memory.dmp

Filesize
64KB

Download
memory/5088-43-0x000002CCEA970000-0x000002CCEA971000-memory.dmp

Filesize
4KB

Download
memory/5088-78-0x000002CCEC6F0000-0x000002CCEC6F4000-memory.dmp

Filesize
16KB

Download
memory/5088-79-0x000002CCEC6F0000-0x000002CCEC6F4000-memory.dmp

Filesize
16KB

Download
memory/5088-80-0x000002CCECFC0000-0x000002CCECFC4000-memory.dmp

Filesize
16KB

Download
memory/5088-81-0x000002CCECFC0000-0x000002CCECFC4000-memory.dmp

Filesize
16KB

Download
memory/5088-82-0x000002CCED030000-0x000002CCED034000-memory.dmp

Filesize
16KB

Download
memory/5088-83-0x000002CCED060000-0x000002CCED064000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads