23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2023 19:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe
Size

223KB
MD5

aa7c1437997a0f1c1ae8d07ff907135a
SHA1

9a7e53855be3996f35854572cc5d9867e734f260
SHA256

23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8
SHA512

df285ebbbcf74a70aa5a60ed6f116b5b2d0799db321a4abb69ac19bbedab7ea1727a2ea7c1cd3f0d4626d59f200de0ce1d9a3b3f9616c371c54e8b90ebab765e
SSDEEP

3072:xZ7wXfSRZ0ON/EwW66wN94xu4CkAZJM2k5D66L+NfGbVON2Nqi/6gS5UoWXHz72n:7wPSUONLNsuWA7koN+boRi9S6oiz72D

Score

10^/10

upx vmprotect

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

Explorer.EXE

description pid process target process

PID 3120 created 588 3120 Explorer.EXE winlogon.exe

description	pid	process	target process
PID 3120 created 588	3120	Explorer.EXE	winlogon.exe

Drops file in Drivers directory 9 IoCs

Processes:

msdtc.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\jNkMsMmWFa.roj	msdtc.exe
File opened for modification	C:\Windows\system32\drivers\DhcEKD3Bx4suz.ayv	msdtc.exe
File opened for modification	C:\Windows\system32\drivers\GZIiD2KSn39C.sys	msdtc.exe
File opened for modification	C:\Windows\system32\drivers\b8dFKa4aeKS.oma	msdtc.exe
File opened for modification	C:\Windows\system32\drivers\q0uuwiskCN3bT.sys	msdtc.exe
File opened for modification	C:\Windows\system32\drivers\KZTmakl77u.wqj	msdtc.exe
File created	C:\Windows\System32\drivers\gRU4Q6.sys	msdtc.exe
File opened for modification	C:\Windows\system32\drivers\fN2neMeqouctL.sys	msdtc.exe
File opened for modification	C:\Windows\system32\drivers\hNjZPaE75bg.sys	msdtc.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1067295379-1486014338-1703171060-1000\Control Panel\International\Geo\Nation	23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe

Executes dropped EXE 1 IoCs

Processes:

msdtc.exe

pid process

2084 msdtc.exe

pid	process
2084	msdtc.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1848-0-0x0000000000C60000-0x0000000000CCE000-memory.dmp	upx
behavioral2/memory/1848-52-0x0000000000C60000-0x0000000000CCE000-memory.dmp	upx
behavioral2/memory/1848-54-0x0000000000C60000-0x0000000000CCE000-memory.dmp	upx

Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 114.114.114.114

description	ioc
Destination IP	114.114.114.114

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
C:\Windows\Wvpk8ZFeDLv.sys	vmprotect
C:\Windows\FAh9EvVHYcLJh2.sys	vmprotect
C:\Windows\9bI9sOdnNHvnsj.sys	vmprotect
C:\Windows\5UQL4XD0biI0G1.sys	vmprotect

Drops file in System32 directory 23 IoCs

Processes:

msdtc.exe

description	ioc	process
File opened for modification	C:\Windows\system32\qq4uFOF6AkjrL.zhd	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AD5F118F7897046E8CA970AE6A6AB70B_ADB601E2C381343DA1163E5F08582475	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\349D186F1CB5682FA0194D4F3754EF36_CE21678B3713ACF5F5ED4AAA700C6173	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D440AC65793A7BBE167BE882B99F465E	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D440AC65793A7BBE167BE882B99F465E	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3	msdtc.exe
File created	C:\Windows\system32\ \Windows\System32\8jGvJ6zAh.sys	msdtc.exe
File opened for modification	C:\Windows\system32\DIsdUc1PR4hL.cme	msdtc.exe
File opened for modification	C:\Windows\system32\dzEtJavzpXRS.qvm	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_896832C6BC857CFAEA9E59E166B13E2C	msdtc.exe
File opened for modification	C:\Windows\system32\Sa6BsLuuwH.sys	msdtc.exe
File opened for modification	C:\Windows\system32\qXEZopU41QOTF.sys	msdtc.exe
File opened for modification	C:\Windows\system32\2agxZ7GRGQ29S.dsy	msdtc.exe
File opened for modification	C:\Windows\system32\2VJNaWeKhyjvK.sys	msdtc.exe
File opened for modification	C:\Windows\system32\X6Dda1jkurz.sys	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_896832C6BC857CFAEA9E59E166B13E2C	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AD5F118F7897046E8CA970AE6A6AB70B_ADB601E2C381343DA1163E5F08582475	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\349D186F1CB5682FA0194D4F3754EF36_CE21678B3713ACF5F5ED4AAA700C6173	msdtc.exe

Drops file in Program Files directory 26 IoCs

Processes:

msdtc.exeExplorer.EXE

description	ioc	process
File opened for modification	C:\Program Files\gXRWrA9tqJGGA.sys	msdtc.exe
File opened for modification	C:\Program Files\AjG2rn8c0IEIZ.sys	msdtc.exe
File opened for modification	C:\Program Files\wtMZXXFvSUBpP.sys	msdtc.exe
File opened for modification	C:\Program Files\46lzzfYOr2zDD.bhi	msdtc.exe
File opened for modification	C:\Program Files (x86)\5eER9PusMHUU.sys	msdtc.exe
File opened for modification	C:\Program Files\Windows Mail\5611d1b4.js	msdtc.exe
File opened for modification	C:\Program Files\WindowsApps\lib\646a1fc2.js	Explorer.EXE
File opened for modification	C:\Program Files\gghE1hNSpx.sys	msdtc.exe
File opened for modification	C:\Program Files (x86)\0TOK3Mwg16gQd.ipr	msdtc.exe
File opened for modification	C:\Program Files\gIYRDja1ly.kua	msdtc.exe
File opened for modification	C:\Program Files (x86)\HWxxGv6fqtItv.npv	msdtc.exe
File opened for modification	C:\Program Files (x86)\pSqtCMzN5vTRN.sys	msdtc.exe
File opened for modification	C:\Program Files\WindowsApps\396136b8.js	Explorer.EXE
File opened for modification	C:\Program Files (x86)\4W13lhgdAbvgs2.sys	msdtc.exe
File opened for modification	C:\Program Files\WindowsApps\manifest.json	Explorer.EXE
File opened for modification	C:\Program Files (x86)\FVifWtrVz8gdNT.tjx	msdtc.exe
File opened for modification	C:\Program Files (x86)\ipc8UnSOnrYGB.sys	msdtc.exe
File opened for modification	C:\Program Files\WindowsApps\47b98466.html	Explorer.EXE
File opened for modification	C:\Program Files\PJ2oWg5mHptD5.ugk	msdtc.exe
File opened for modification	C:\Program Files\Windows Mail\47b98416.html	msdtc.exe
File opened for modification	C:\Program Files\6NHqVlNkZmxXW.mjq	msdtc.exe
File opened for modification	C:\Program Files\Windows Mail\manifest.json	msdtc.exe
File opened for modification	C:\Program Files\Windows Mail\39613678.js	msdtc.exe
File opened for modification	C:\Program Files\Windows Mail\lib\646a1f52.js	msdtc.exe
File opened for modification	C:\Program Files\WindowsApps\5611d214.js	Explorer.EXE
File opened for modification	C:\Program Files (x86)\ETPm5scuTES.qtx	msdtc.exe

Drops file in Windows directory 11 IoCs

Processes:

Explorer.EXEmsdtc.exe

description	ioc	process
File created	C:\Windows\Help\msdtc.exe	Explorer.EXE
File opened for modification	C:\Windows\Help\msdtc.exe	Explorer.EXE
File opened for modification	C:\Windows\FAh9EvVHYcLJh2.sys	msdtc.exe
File opened for modification	C:\Windows\9bI9sOdnNHvnsj.sys	msdtc.exe
File opened for modification	C:\Windows\LvmXUxN1VRyAyc.otu	msdtc.exe
File created	C:\Windows\SnmGbO.sys	msdtc.exe
File opened for modification	C:\Windows\Wvpk8ZFeDLv.sys	msdtc.exe
File opened for modification	C:\Windows\NZEz3ysPI14KJ.ovr	msdtc.exe
File opened for modification	C:\Windows\rWMGh7n9vl.dlu	msdtc.exe
File opened for modification	C:\Windows\bEbVx3OX4T.hwf	msdtc.exe
File opened for modification	C:\Windows\5UQL4XD0biI0G1.sys	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msdtc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	msdtc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	msdtc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	msdtc.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

4920 timeout.exe

pid	process
4920	timeout.exe

Modifies data under HKEY_USERS 12 IoCs

Processes:

msdtc.exemsinfo32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	msdtc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	msdtc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	msdtc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	msdtc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	msdtc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	msinfo32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	msdtc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	msdtc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	msdtc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	msdtc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	msinfo32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	msinfo32.exe

Modifies registry class 3 IoCs

Processes:

Explorer.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1067295379-1486014338-1703171060-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exeExplorer.EXEmsdtc.exemsinfo32.exe

pid	process
1848	23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe
1848	23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe
1848	23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe
1848	23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe
1848	23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe
1848	23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe
1848	23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe
1848	23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe
3120	Explorer.EXE
3120	Explorer.EXE
3120	Explorer.EXE
3120	Explorer.EXE
1848	23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe
1848	23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe
2084	msdtc.exe
2084	msdtc.exe
4236	msinfo32.exe
4236	msinfo32.exe
2084	msdtc.exe
2084	msdtc.exe
2084	msdtc.exe
2084	msdtc.exe
2084	msdtc.exe
2084	msdtc.exe
2084	msdtc.exe
2084	msdtc.exe
2084	msdtc.exe
2084	msdtc.exe
2084	msdtc.exe
2084	msdtc.exe
2084	msdtc.exe
2084	msdtc.exe
2084	msdtc.exe
2084	msdtc.exe
2084	msdtc.exe
2084	msdtc.exe
2084	msdtc.exe
2084	msdtc.exe
2084	msdtc.exe
2084	msdtc.exe
2084	msdtc.exe
2084	msdtc.exe
2084	msdtc.exe
2084	msdtc.exe
2084	msdtc.exe
2084	msdtc.exe
2084	msdtc.exe
2084	msdtc.exe
2084	msdtc.exe
2084	msdtc.exe
2084	msdtc.exe
2084	msdtc.exe
2084	msdtc.exe
2084	msdtc.exe
2084	msdtc.exe
2084	msdtc.exe
2084	msdtc.exe
2084	msdtc.exe
2084	msdtc.exe
2084	msdtc.exe
2084	msdtc.exe
2084	msdtc.exe
2084	msdtc.exe
2084	msdtc.exe

Suspicious behavior: LoadsDriver 59 IoCs

Processes:

pid	process
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656

Suspicious use of AdjustPrivilegeToken 27 IoCs

Processes:

23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exeExplorer.EXEmsdtc.exedwm.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	1848	23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe
Token: SeTcbPrivilege	1848	23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe
Token: SeDebugPrivilege	1848	23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe
Token: SeDebugPrivilege	3120	Explorer.EXE
Token: SeDebugPrivilege	3120	Explorer.EXE
Token: SeDebugPrivilege	1848	23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe
Token: SeDebugPrivilege	2084	msdtc.exe
Token: SeDebugPrivilege	2084	msdtc.exe
Token: SeDebugPrivilege	2084	msdtc.exe
Token: SeIncBasePriorityPrivilege	1848	23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe
Token: SeShutdownPrivilege	3120	Explorer.EXE
Token: SeCreatePagefilePrivilege	3120	Explorer.EXE
Token: SeDebugPrivilege	2084	msdtc.exe
Token: SeDebugPrivilege	2084	msdtc.exe
Token: SeBackupPrivilege	2084	msdtc.exe
Token: SeDebugPrivilege	2084	msdtc.exe
Token: SeDebugPrivilege	2084	msdtc.exe
Token: SeDebugPrivilege	2084	msdtc.exe
Token: SeDebugPrivilege	3120	Explorer.EXE
Token: SeBackupPrivilege	3120	Explorer.EXE
Token: SeDebugPrivilege	316	dwm.exe
Token: SeBackupPrivilege	316	dwm.exe
Token: SeShutdownPrivilege	316	dwm.exe
Token: SeCreatePagefilePrivilege	316	dwm.exe
Token: SeManageVolumePrivilege	4800	svchost.exe
Token: SeShutdownPrivilege	3120	Explorer.EXE
Token: SeCreatePagefilePrivilege	3120	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

3120 Explorer.EXE
3120 Explorer.EXE
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Explorer.EXE

pid process

3120 Explorer.EXE
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

3120 Explorer.EXE

pid	process
3120	Explorer.EXE
3120	Explorer.EXE

pid	process
3120	Explorer.EXE

pid	process
3120	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exeExplorer.EXEcmd.exemsdtc.exe

description	pid	process	target process
PID 1848 wrote to memory of 3120	1848	23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe	Explorer.EXE
PID 1848 wrote to memory of 3120	1848	23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe	Explorer.EXE
PID 1848 wrote to memory of 3120	1848	23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe	Explorer.EXE
PID 1848 wrote to memory of 3120	1848	23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe	Explorer.EXE
PID 1848 wrote to memory of 3120	1848	23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe	Explorer.EXE
PID 3120 wrote to memory of 2084	3120	Explorer.EXE	msdtc.exe
PID 3120 wrote to memory of 2084	3120	Explorer.EXE	msdtc.exe
PID 3120 wrote to memory of 2084	3120	Explorer.EXE	msdtc.exe
PID 3120 wrote to memory of 2084	3120	Explorer.EXE	msdtc.exe
PID 3120 wrote to memory of 2084	3120	Explorer.EXE	msdtc.exe
PID 3120 wrote to memory of 2084	3120	Explorer.EXE	msdtc.exe
PID 3120 wrote to memory of 2084	3120	Explorer.EXE	msdtc.exe
PID 1848 wrote to memory of 588	1848	23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe	winlogon.exe
PID 1848 wrote to memory of 588	1848	23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe	winlogon.exe
PID 1848 wrote to memory of 588	1848	23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe	winlogon.exe
PID 1848 wrote to memory of 588	1848	23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe	winlogon.exe
PID 1848 wrote to memory of 588	1848	23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe	winlogon.exe
PID 1848 wrote to memory of 3748	1848	23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe	cmd.exe
PID 1848 wrote to memory of 3748	1848	23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe	cmd.exe
PID 1848 wrote to memory of 3748	1848	23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe	cmd.exe
PID 3748 wrote to memory of 4920	3748	cmd.exe	timeout.exe
PID 3748 wrote to memory of 4920	3748	cmd.exe	timeout.exe
PID 3748 wrote to memory of 4920	3748	cmd.exe	timeout.exe
PID 2084 wrote to memory of 3120	2084	msdtc.exe	Explorer.EXE
PID 2084 wrote to memory of 3120	2084	msdtc.exe	Explorer.EXE
PID 2084 wrote to memory of 4236	2084	msdtc.exe	msinfo32.exe
PID 2084 wrote to memory of 4236	2084	msdtc.exe	msinfo32.exe
PID 2084 wrote to memory of 4236	2084	msdtc.exe	msinfo32.exe
PID 2084 wrote to memory of 4236	2084	msdtc.exe	msinfo32.exe
PID 2084 wrote to memory of 4236	2084	msdtc.exe	msinfo32.exe
PID 2084 wrote to memory of 4236	2084	msdtc.exe	msinfo32.exe
PID 2084 wrote to memory of 4236	2084	msdtc.exe	msinfo32.exe
PID 2084 wrote to memory of 3120	2084	msdtc.exe	Explorer.EXE
PID 2084 wrote to memory of 3120	2084	msdtc.exe	Explorer.EXE
PID 2084 wrote to memory of 3120	2084	msdtc.exe	Explorer.EXE
PID 2084 wrote to memory of 3120	2084	msdtc.exe	Explorer.EXE
PID 2084 wrote to memory of 3120	2084	msdtc.exe	Explorer.EXE
PID 2084 wrote to memory of 3120	2084	msdtc.exe	Explorer.EXE
PID 2084 wrote to memory of 3120	2084	msdtc.exe	Explorer.EXE
PID 2084 wrote to memory of 3120	2084	msdtc.exe	Explorer.EXE
PID 2084 wrote to memory of 3120	2084	msdtc.exe	Explorer.EXE
PID 2084 wrote to memory of 3120	2084	msdtc.exe	Explorer.EXE
PID 2084 wrote to memory of 3120	2084	msdtc.exe	Explorer.EXE
PID 2084 wrote to memory of 3120	2084	msdtc.exe	Explorer.EXE
PID 2084 wrote to memory of 3120	2084	msdtc.exe	Explorer.EXE
PID 2084 wrote to memory of 3120	2084	msdtc.exe	Explorer.EXE
PID 2084 wrote to memory of 3120	2084	msdtc.exe	Explorer.EXE
PID 2084 wrote to memory of 3120	2084	msdtc.exe	Explorer.EXE
PID 2084 wrote to memory of 3120	2084	msdtc.exe	Explorer.EXE
PID 2084 wrote to memory of 3120	2084	msdtc.exe	Explorer.EXE
PID 2084 wrote to memory of 3120	2084	msdtc.exe	Explorer.EXE
PID 2084 wrote to memory of 3120	2084	msdtc.exe	Explorer.EXE
PID 2084 wrote to memory of 3120	2084	msdtc.exe	Explorer.EXE
PID 2084 wrote to memory of 3120	2084	msdtc.exe	Explorer.EXE
PID 2084 wrote to memory of 3120	2084	msdtc.exe	Explorer.EXE
PID 2084 wrote to memory of 3120	2084	msdtc.exe	Explorer.EXE
PID 2084 wrote to memory of 3120	2084	msdtc.exe	Explorer.EXE
PID 2084 wrote to memory of 3120	2084	msdtc.exe	Explorer.EXE
PID 2084 wrote to memory of 3120	2084	msdtc.exe	Explorer.EXE
PID 2084 wrote to memory of 3120	2084	msdtc.exe	Explorer.EXE
PID 2084 wrote to memory of 3120	2084	msdtc.exe	Explorer.EXE
PID 2084 wrote to memory of 3120	2084	msdtc.exe	Explorer.EXE
PID 2084 wrote to memory of 3120	2084	msdtc.exe	Explorer.EXE
PID 2084 wrote to memory of 3120	2084	msdtc.exe	Explorer.EXE

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:588

C:\Windows\system32\dwm.exe
"dwm.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:316

C:\Windows\Help\msdtc.exe
"C:\Windows\Help\msdtc.exe"
2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2084

C:\Windows\system32\msinfo32.exe
"C:\Windows\system32\msinfo32.exe"
3⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4236

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3120

C:\Users\Admin\AppData\Local\Temp\23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe
"C:\Users\Admin\AppData\Local\Temp\23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe"
2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1848

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:3748

C:\Windows\SysWOW64\timeout.exe
timeout /t 1
4⤵
- Delays execution with timeout.exe
PID:4920

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:2496

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4800

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\5UQL4XD0biI0G1.sys
Filesize
415KB

MD5
86dcce1f65f56babe1312b8d63018391

SHA1
735bb7f6884a6b26f548dbb567351ea21497d28a

SHA256
0b1117aec00b614ad6c684147bf76530a096d86db537a280dec6b044de1c701b

SHA512
38e3a53f158c8ff409dd8aba0eba6105dd04bbcd54bd63e1234d71d6656fc84e70643dd915e0293f42c322710ab2f0c01470ec72bded290407a6f907df3f0ea3

Download Submit
C:\Windows\9bI9sOdnNHvnsj.sys
Filesize
415KB

MD5
64bc1983743c584a9ad09dacf12792e5

SHA1
0f14098f523d21f11129c4df09451413ddff6d61

SHA256
057ec356f1577fe86b706e5aeb74e3bdd6fe04d22586fecf69b866f8f72db7f5

SHA512
9ab4ddb64bd97dd1a7ee15613a258edf1d2eba880a0896a91487c47a32c9bd1118cde18211053a5b081216d123d5f901b454a525cbba01d8067c31babd8c8c3c

Download Submit
C:\Windows\FAh9EvVHYcLJh2.sys
Filesize
447KB

MD5
7ba2e5f80701b7c3c0d4a929f324de71

SHA1
c91323cba3c0aaf968845ef750826f3fdadb4fde

SHA256
d927f8e5073e0cc02ff0f29224390d2148268d6bec3a13c0052cb674c8d73ba9

SHA512
9d0028f9857400bf9b4a3ac2d431ea79400072b82ae27ab434356ee0f61e55f31fee72301796d3d3e532b94d123c801c1c023a2d0eb0b7e14f679441e6ae951a

Download Submit
C:\Windows\Help\msdtc.exe
Filesize
145KB

MD5
2ef846ac66e181be820b513dbc15b5d2

SHA1
8b4786eb9d864fc78bd99432ae0c78f887049461

SHA256
edfe71025c352d0dabec7b9506c5945bb0ec11f8db540db8cb1116c2ea1648a8

SHA512
2587acd723f515eb8fa1dd7016647079fd7af2a1c32f92ff344766803d524d9820bebaf21daa3b3d3556d2db8ab956a8a1682eaa46abb9b04a4c8e1e21321bdc

Download Submit
C:\Windows\Help\msdtc.exe
Filesize
145KB

MD5
2ef846ac66e181be820b513dbc15b5d2

SHA1
8b4786eb9d864fc78bd99432ae0c78f887049461

SHA256
edfe71025c352d0dabec7b9506c5945bb0ec11f8db540db8cb1116c2ea1648a8

SHA512
2587acd723f515eb8fa1dd7016647079fd7af2a1c32f92ff344766803d524d9820bebaf21daa3b3d3556d2db8ab956a8a1682eaa46abb9b04a4c8e1e21321bdc

Download Submit
C:\Windows\Wvpk8ZFeDLv.sys
Filesize
447KB

MD5
d15f5f23df8036bd5089ce8d151b0e0d

SHA1
4066ff4d92ae189d92fcdfb8c11a82cc9db56bb2

SHA256
f2c40dde6f40beaa3c283b66791ff27e6f06d66c8dd6eff5262f51e02ee26520

SHA512
feaec8a00346b0a74c530859785e1b280da5833bf3113083bf4664ebee85b14ceca648499f36d266d329d602349f9ad0fc21a10e605377b3a2c24b456f3a9bd9

Download Submit
memory/316-343-0x0000020922270000-0x0000020922274000-memory.dmp

Filesize
16KB

Download
memory/316-339-0x0000020922120000-0x0000020922242000-memory.dmp

Filesize
1.1MB

Download
memory/316-340-0x0000020922260000-0x0000020922261000-memory.dmp

Filesize
4KB

Download
memory/316-346-0x0000020922120000-0x0000020922242000-memory.dmp

Filesize
1.1MB

Download
memory/588-66-0x000001DAEC160000-0x000001DAEC188000-memory.dmp

Filesize
160KB

Download
memory/588-17-0x000001DAEC150000-0x000001DAEC153000-memory.dmp

Filesize
12KB

Download
memory/588-19-0x000001DAEC160000-0x000001DAEC188000-memory.dmp

Filesize
160KB

Download
memory/588-20-0x000001DAEC1A0000-0x000001DAEC1A1000-memory.dmp

Filesize
4KB

Download
memory/588-67-0x000001DAEC1A0000-0x000001DAEC1A1000-memory.dmp

Filesize
4KB

Download
memory/1848-0-0x0000000000C60000-0x0000000000CCE000-memory.dmp

Filesize
440KB

Download
memory/1848-52-0x0000000000C60000-0x0000000000CCE000-memory.dmp

Filesize
440KB

Download
memory/1848-54-0x0000000000C60000-0x0000000000CCE000-memory.dmp

Filesize
440KB

Download
memory/2084-86-0x0000020E49EE0000-0x0000020E49EE1000-memory.dmp

Filesize
4KB

Download
memory/2084-149-0x0000020E49ED0000-0x0000020E49ED2000-memory.dmp

Filesize
8KB

Download
memory/2084-58-0x0000020E49EE0000-0x0000020E49EE1000-memory.dmp

Filesize
4KB

Download
memory/2084-57-0x0000020E49EF0000-0x0000020E49EF1000-memory.dmp

Filesize
4KB

Download
memory/2084-347-0x0000020E49CC0000-0x0000020E49CC1000-memory.dmp

Filesize
4KB

Download
memory/2084-10-0x0000020E47A20000-0x0000020E47A23000-memory.dmp

Filesize
12KB

Download
memory/2084-61-0x0000020E47CB0000-0x0000020E47D7B000-memory.dmp

Filesize
812KB

Download
memory/2084-62-0x0000020E49ED0000-0x0000020E49ED1000-memory.dmp

Filesize
4KB

Download
memory/2084-63-0x0000020E47D80000-0x0000020E47D81000-memory.dmp

Filesize
4KB

Download
memory/2084-64-0x0000020E49EE0000-0x0000020E49EEF000-memory.dmp

Filesize
60KB

Download
memory/2084-65-0x0000020E49F30000-0x0000020E49FE7000-memory.dmp

Filesize
732KB

Download
memory/2084-55-0x0000020E49ED0000-0x0000020E49ED1000-memory.dmp

Filesize
4KB

Download
memory/2084-53-0x0000020E49CC0000-0x0000020E49CC2000-memory.dmp

Filesize
8KB

Download
memory/2084-70-0x0000020E4A5A0000-0x0000020E4A5CE000-memory.dmp

Filesize
184KB

Download
memory/2084-332-0x0000020E49CC0000-0x0000020E49CC1000-memory.dmp

Filesize
4KB

Download
memory/2084-68-0x0000020E4B520000-0x0000020E4B642000-memory.dmp

Filesize
1.1MB

Download
memory/2084-76-0x0000020E49ED0000-0x0000020E49ED2000-memory.dmp

Filesize
8KB

Download
memory/2084-73-0x0000020E4A5D0000-0x0000020E4A5D1000-memory.dmp

Filesize
4KB

Download
memory/2084-80-0x0000020E4B950000-0x0000020E4BB1A000-memory.dmp

Filesize
1.8MB

Download
memory/2084-331-0x0000020E4B430000-0x0000020E4B43A000-memory.dmp

Filesize
40KB

Download
memory/2084-87-0x0000020E49EF0000-0x0000020E49EF1000-memory.dmp

Filesize
4KB

Download
memory/2084-51-0x00007FFA8ADE0000-0x00007FFA8ADF0000-memory.dmp

Filesize
64KB

Download
memory/2084-92-0x0000020E49ED0000-0x0000020E49ED2000-memory.dmp

Filesize
8KB

Download
memory/2084-94-0x0000020E49ED0000-0x0000020E49ED1000-memory.dmp

Filesize
4KB

Download
memory/2084-15-0x00007FFA8ADE0000-0x00007FFA8ADF0000-memory.dmp

Filesize
64KB

Download
memory/2084-135-0x0000020E49F30000-0x0000020E49FE7000-memory.dmp

Filesize
732KB

Download
memory/2084-145-0x0000020E4B520000-0x0000020E4B642000-memory.dmp

Filesize
1.1MB

Download
memory/2084-141-0x0000020E49ED0000-0x0000020E49ED1000-memory.dmp

Filesize
4KB

Download
memory/2084-13-0x0000020E47CB0000-0x0000020E47D7B000-memory.dmp

Filesize
812KB

Download
memory/2084-56-0x0000020E49EE0000-0x0000020E49EE1000-memory.dmp

Filesize
4KB

Download
memory/2084-14-0x0000020E47D80000-0x0000020E47D81000-memory.dmp

Filesize
4KB

Download
memory/2084-330-0x0000020E4A5E0000-0x0000020E4A5E1000-memory.dmp

Filesize
4KB

Download
memory/2084-323-0x0000020E4B430000-0x0000020E4B43A000-memory.dmp

Filesize
40KB

Download
memory/2084-11-0x0000020E47CB0000-0x0000020E47D7B000-memory.dmp

Filesize
812KB

Download
memory/3120-335-0x0000000002D20000-0x0000000002D23000-memory.dmp

Filesize
12KB

Download
memory/3120-1-0x0000000002EA0000-0x0000000002EA3000-memory.dmp

Filesize
12KB

Download
memory/3120-224-0x0000000002E70000-0x0000000002E71000-memory.dmp

Filesize
4KB

Download
memory/3120-324-0x0000000002E70000-0x0000000002E71000-memory.dmp

Filesize
4KB

Download
memory/3120-325-0x0000000002E70000-0x0000000002E71000-memory.dmp

Filesize
4KB

Download
memory/3120-326-0x0000000002E70000-0x0000000002E71000-memory.dmp

Filesize
4KB

Download
memory/3120-327-0x0000000002E70000-0x0000000002E71000-memory.dmp

Filesize
4KB

Download
memory/3120-328-0x0000000002E70000-0x0000000002E71000-memory.dmp

Filesize
4KB

Download
memory/3120-329-0x0000000002E70000-0x0000000002E71000-memory.dmp

Filesize
4KB

Download
memory/3120-212-0x0000000002E70000-0x0000000002E71000-memory.dmp

Filesize
4KB

Download
memory/3120-350-0x0000000008E80000-0x0000000008FA2000-memory.dmp

Filesize
1.1MB

Download
memory/3120-298-0x0000000002E70000-0x0000000002E71000-memory.dmp

Filesize
4KB

Download
memory/3120-60-0x0000000008580000-0x0000000008677000-memory.dmp

Filesize
988KB

Download
memory/3120-338-0x0000000002D50000-0x0000000002D51000-memory.dmp

Filesize
4KB

Download
memory/3120-311-0x0000000002E70000-0x0000000002E71000-memory.dmp

Filesize
4KB

Download
memory/3120-8-0x0000000008580000-0x0000000008677000-memory.dmp

Filesize
988KB

Download
memory/3120-341-0x0000000002D60000-0x0000000002D61000-memory.dmp

Filesize
4KB

Download
memory/3120-7-0x0000000002EC0000-0x0000000002EC1000-memory.dmp

Filesize
4KB

Download
memory/3120-2-0x0000000002EA0000-0x0000000002EA3000-memory.dmp

Filesize
12KB

Download
memory/3120-344-0x0000000008E80000-0x0000000008FA2000-memory.dmp

Filesize
1.1MB

Download
memory/3120-345-0x0000000008FB0000-0x0000000008FB4000-memory.dmp

Filesize
16KB

Download
memory/3120-72-0x0000000002E70000-0x0000000002E71000-memory.dmp

Filesize
4KB

Download
memory/3120-59-0x0000000002EC0000-0x0000000002EC1000-memory.dmp

Filesize
4KB

Download
memory/4236-82-0x0000018482410000-0x00000184825B6000-memory.dmp

Filesize
1.6MB

Download

pid	process
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656

pid	process
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656

pid	process
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656