748b8dc9ddd13cfdf844a6ba40a59dc5a464d0240133394adffc5496cd1021e7

General

Target

9cd4cebf8b04cd6864b59e4c0cf4aafa.exe
Size

654KB
MD5

9cd4cebf8b04cd6864b59e4c0cf4aafa
SHA1

2287faa3026c5981f3796268112998ac1c06c5d3
SHA256

748b8dc9ddd13cfdf844a6ba40a59dc5a464d0240133394adffc5496cd1021e7
SHA512

03ec7b69a8f616ab4254429499d80e5b5e7e28c1b44b418b446f6a341bdc77393482cd790764981498c6d54d2ffd0d32c118c45dee056d681533167f7b83359d
SSDEEP

12288:MkzXMinmtrfsNG9USY7x3lgSsIXlYlOHls2E/qZaTcMUJnGHqsvXX1tfLs:LjArfCG+nN3aNIXNFZ5R1GHqsvDI

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

pcftxel.exe

pid process

3940 pcftxel.exe

pid	process
3940	pcftxel.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	svchost.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-18\desktop.ini	svchost.exe

Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

svchost.exe

description ioc process

File opened (read-only) \??\F: svchost.exe
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

892 3940 WerFault.exe pcftxel.exe
2292 3940 WerFault.exe pcftxel.exe

description	ioc	process
File opened (read-only)	\??\F:	svchost.exe

pid	pid_target	process	target process
892	3940	WerFault.exe	pcftxel.exe
2292	3940	WerFault.exe	pcftxel.exe

Modifies data under HKEY_USERS 23 IoCs

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WallpaperStyle = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\ = "%SystemRoot%\\System32\\imageres.dll,-55"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Empty = "%SystemRoot%\\System32\\imageres.dll,-55"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{14f6f45c-0000-0000-0000-d01200000000}	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{14f6f45c-0000-0000-0000-d01200000000}\MaxCapacity = "14116"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\LastEnum = 30002c007b00310034006600360066003400350063002d0030003000300030002d0030003000300030002d0030003000300030002d006400300031003200300030003000300030003000300030007d00000030002c007b00310034006600360066003400350063002d0030003000300030002d0030003000300030002d0030003000300030002d006600300066006600330061003000300030003000300030007d0000000000	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Full = "%SystemRoot%\\System32\\imageres.dll,-54"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{14f6f45c-0000-0000-0000-f0ff3a000000}\MaxCapacity = "2047"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{14f6f45c-0000-0000-0000-f0ff3a000000}\NukeOnDelete = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@%SystemRoot%\system32\shell32.dll,-50176 = "File Operation"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{14f6f45c-0000-0000-0000-d01200000000}\NukeOnDelete = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{14f6f45c-0000-0000-0000-f0ff3a000000}	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\TileWallpaper = "0"	svchost.exe

Modifies registry class 37 IoCs

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133478270339072223"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\HAM\AUI	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\HAM\AUI\App	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133478269640634924"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\HAM\AUI	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\HAM\AUI\App	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\HAM\AUI\App\V1\LU	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133478270725947348"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133471152356253443"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\HAM\AUI\App\V1\LU	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133478269637666043"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU\ICT = "133471152360472113"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133478270347978887"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133478270722822471"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\HAM\AUI\App\V1	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133478269330781883"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\HAM\AUI\App\V1	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133478269961103758"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133478269985166094"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133478270324384912"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133478270736572539"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133478269397041109"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133478270727353655"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU\PCT = "133471152358753508"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133478270306416136"	svchost.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

9cd4cebf8b04cd6864b59e4c0cf4aafa.exepcftxel.exe

pid	process
4988	9cd4cebf8b04cd6864b59e4c0cf4aafa.exe
4988	9cd4cebf8b04cd6864b59e4c0cf4aafa.exe
3940	pcftxel.exe
3940	pcftxel.exe
3940	pcftxel.exe
3940	pcftxel.exe
3940	pcftxel.exe
3940	pcftxel.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

pcftxel.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	3940	pcftxel.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe
Token: SeTcbPrivilege	812	svchost.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

pcftxel.exesvchost.exe

description	pid	process	target process
PID 3940 wrote to memory of 812	3940	pcftxel.exe	svchost.exe
PID 812 wrote to memory of 4032	812	svchost.exe	wmiprvse.exe
PID 812 wrote to memory of 4032	812	svchost.exe	wmiprvse.exe
PID 812 wrote to memory of 2328	812	svchost.exe	mousocoreworker.exe
PID 812 wrote to memory of 2328	812	svchost.exe	mousocoreworker.exe
PID 812 wrote to memory of 4136	812	svchost.exe	DllHost.exe
PID 812 wrote to memory of 4136	812	svchost.exe	DllHost.exe
PID 812 wrote to memory of 4368	812	svchost.exe	backgroundTaskHost.exe
PID 812 wrote to memory of 4368	812	svchost.exe	backgroundTaskHost.exe
PID 812 wrote to memory of 4368	812	svchost.exe	backgroundTaskHost.exe
PID 812 wrote to memory of 2708	812	svchost.exe	backgroundTaskHost.exe
PID 812 wrote to memory of 2708	812	svchost.exe	backgroundTaskHost.exe
PID 812 wrote to memory of 2708	812	svchost.exe	backgroundTaskHost.exe
PID 812 wrote to memory of 3544	812	svchost.exe	backgroundTaskHost.exe
PID 812 wrote to memory of 3544	812	svchost.exe	backgroundTaskHost.exe
PID 812 wrote to memory of 3544	812	svchost.exe	backgroundTaskHost.exe
PID 812 wrote to memory of 4828	812	svchost.exe	BackgroundTransferHost.exe
PID 812 wrote to memory of 4828	812	svchost.exe	BackgroundTransferHost.exe
PID 812 wrote to memory of 4828	812	svchost.exe	BackgroundTransferHost.exe
PID 812 wrote to memory of 32	812	svchost.exe	backgroundTaskHost.exe
PID 812 wrote to memory of 32	812	svchost.exe	backgroundTaskHost.exe
PID 812 wrote to memory of 32	812	svchost.exe	backgroundTaskHost.exe
PID 812 wrote to memory of 4496	812	svchost.exe	BackgroundTransferHost.exe
PID 812 wrote to memory of 4496	812	svchost.exe	BackgroundTransferHost.exe
PID 812 wrote to memory of 4496	812	svchost.exe	BackgroundTransferHost.exe
PID 812 wrote to memory of 4928	812	svchost.exe	BackgroundTransferHost.exe
PID 812 wrote to memory of 4928	812	svchost.exe	BackgroundTransferHost.exe
PID 812 wrote to memory of 4928	812	svchost.exe	BackgroundTransferHost.exe
PID 812 wrote to memory of 2196	812	svchost.exe	backgroundTaskHost.exe
PID 812 wrote to memory of 2196	812	svchost.exe	backgroundTaskHost.exe
PID 812 wrote to memory of 2196	812	svchost.exe	backgroundTaskHost.exe
PID 812 wrote to memory of 4904	812	svchost.exe	BackgroundTaskHost.exe
PID 812 wrote to memory of 4904	812	svchost.exe	BackgroundTaskHost.exe
PID 812 wrote to memory of 4904	812	svchost.exe	BackgroundTaskHost.exe
PID 812 wrote to memory of 1852	812	svchost.exe	RuntimeBroker.exe
PID 812 wrote to memory of 1852	812	svchost.exe	RuntimeBroker.exe

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:812

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
2⤵
PID:4032

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
2⤵
PID:2328

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
2⤵
PID:4136

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
2⤵
PID:4368

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
2⤵
PID:2708

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
2⤵
PID:3544

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
2⤵
PID:4828

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
2⤵
PID:32

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
2⤵
PID:4496

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
2⤵
PID:4928

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
2⤵
PID:2196

C:\Windows\system32\BackgroundTaskHost.exe
"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
2⤵
PID:4904

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
2⤵
PID:1852

C:\Users\Admin\AppData\Local\Temp\9cd4cebf8b04cd6864b59e4c0cf4aafa.exe
"C:\Users\Admin\AppData\Local\Temp\9cd4cebf8b04cd6864b59e4c0cf4aafa.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4988

C:\Users\Admin\AppData\Local\Temp\pcftxel.exe
C:\Users\Admin\AppData\Local\Temp\pcftxel.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 684
2⤵
- Program crash
PID:892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 692
2⤵
- Program crash
PID:2292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3940 -ip 3940
1⤵
PID:3616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3940 -ip 3940
1⤵
PID:2988

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\csllzaa
Filesize
654B

MD5
0269b753ce2098e66dd7fd2068a9e0dc

SHA1
49c5ebe8e401c72b1ebc5154687a90bee292899d

SHA256
fd5aebc0b5e385e9b9dd08ae905082d69783bfde3a26ba039b7069fdc73d9456

SHA512
26fb7fa4fcc67d5c9b9e7b413bdb3a6d744430e243cd29ae986e319c25bfd1f09289300b4351a11b31d46a9997e189adacc7238edc5ba55deefe4216f9f8caed

Download Submit
C:\Users\Admin\AppData\Local\Temp\pcftxel.exe
Filesize
654KB

MD5
9cd4cebf8b04cd6864b59e4c0cf4aafa

SHA1
2287faa3026c5981f3796268112998ac1c06c5d3

SHA256
748b8dc9ddd13cfdf844a6ba40a59dc5a464d0240133394adffc5496cd1021e7

SHA512
03ec7b69a8f616ab4254429499d80e5b5e7e28c1b44b418b446f6a341bdc77393482cd790764981498c6d54d2ffd0d32c118c45dee056d681533167f7b83359d

Download Submit
memory/812-17-0x000000000D4E0000-0x000000000D557000-memory.dmp

Filesize
476KB

Download
memory/812-9-0x000000000D4E0000-0x000000000D557000-memory.dmp

Filesize
476KB

Download
memory/812-11-0x000000000D4E0000-0x000000000D557000-memory.dmp

Filesize
476KB

Download
memory/812-12-0x000000000D4E0000-0x000000000D557000-memory.dmp

Filesize
476KB

Download
memory/812-15-0x000000000D4E0000-0x000000000D557000-memory.dmp

Filesize
476KB

Download
memory/812-21-0x000000000D4E0000-0x000000000D557000-memory.dmp

Filesize
476KB

Download
memory/812-48-0x000000000D4E0000-0x000000000D557000-memory.dmp

Filesize
476KB

Download
memory/812-215-0x000000000D4E0000-0x000000000D557000-memory.dmp

Filesize
476KB

Download
memory/812-3331-0x000000000D4E0000-0x000000000D557000-memory.dmp

Filesize
476KB

Download
memory/3940-6-0x0000000000B40000-0x0000000000D8B000-memory.dmp

Filesize
2.3MB

Download
memory/4988-1-0x0000000000E20000-0x000000000106B000-memory.dmp

Filesize
2.3MB

Download
memory/4988-0-0x0000000000C00000-0x0000000000E1A000-memory.dmp

Filesize
2.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads