Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2023 13:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9cd4cebf8b04cd6864b59e4c0cf4aafa.exe
Resource
win7-20231215-en
windows7-x64
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
9cd4cebf8b04cd6864b59e4c0cf4aafa.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
9cd4cebf8b04cd6864b59e4c0cf4aafa.exe
-
Size
654KB
-
MD5
9cd4cebf8b04cd6864b59e4c0cf4aafa
-
SHA1
2287faa3026c5981f3796268112998ac1c06c5d3
-
SHA256
748b8dc9ddd13cfdf844a6ba40a59dc5a464d0240133394adffc5496cd1021e7
-
SHA512
03ec7b69a8f616ab4254429499d80e5b5e7e28c1b44b418b446f6a341bdc77393482cd790764981498c6d54d2ffd0d32c118c45dee056d681533167f7b83359d
-
SSDEEP
12288:MkzXMinmtrfsNG9USY7x3lgSsIXlYlOHls2E/qZaTcMUJnGHqsvXX1tfLs:LjArfCG+nN3aNIXNFZ5R1GHqsvDI
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3940 pcftxel.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini svchost.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-18\desktop.ini svchost.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: svchost.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 892 3940 WerFault.exe 90 2292 3940 WerFault.exe 90 -
Modifies data under HKEY_USERS 23 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WallpaperStyle = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E} svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\ = "%SystemRoot%\\System32\\imageres.dll,-55" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Empty = "%SystemRoot%\\System32\\imageres.dll,-55" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{14f6f45c-0000-0000-0000-d01200000000} svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{14f6f45c-0000-0000-0000-d01200000000}\MaxCapacity = "14116" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\LastEnum = 30002c007b00310034006600360066003400350063002d0030003000300030002d0030003000300030002d0030003000300030002d006400300031003200300030003000300030003000300030007d00000030002c007b00310034006600360066003400350063002d0030003000300030002d0030003000300030002d0030003000300030002d006600300066006600330061003000300030003000300030007d0000000000 svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Full = "%SystemRoot%\\System32\\imageres.dll,-54" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{14f6f45c-0000-0000-0000-f0ff3a000000}\MaxCapacity = "2047" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{14f6f45c-0000-0000-0000-f0ff3a000000}\NukeOnDelete = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@%SystemRoot%\system32\shell32.dll,-50176 = "File Operation" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{14f6f45c-0000-0000-0000-d01200000000}\NukeOnDelete = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{14f6f45c-0000-0000-0000-f0ff3a000000} svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\TileWallpaper = "0" svchost.exe -
Modifies registry class 37 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133478270339072223" svchost.exe Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\HAM\AUI svchost.exe Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy svchost.exe Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\HAM\AUI\App svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133478269640634924" svchost.exe Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI svchost.exe Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\HAM\AUI svchost.exe Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\HAM\AUI\App svchost.exe Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\HAM\AUI\App\V1\LU svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133478270725947348" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133471152356253443" svchost.exe Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU svchost.exe Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy svchost.exe Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1 svchost.exe Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\HAM\AUI\App\V1\LU svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133478269637666043" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU\ICT = "133471152360472113" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133478270347978887" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133478270722822471" svchost.exe Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\HAM\AUI\App\V1 svchost.exe Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1 svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133478269330781883" svchost.exe Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI svchost.exe Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\HAM\AUI\App\V1 svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133478269961103758" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133478269985166094" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133478270324384912" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133478270736572539" svchost.exe Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy svchost.exe Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133478269397041109" svchost.exe Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133478270727353655" svchost.exe Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU\PCT = "133471152358753508" svchost.exe Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133478270306416136" svchost.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4988 9cd4cebf8b04cd6864b59e4c0cf4aafa.exe 4988 9cd4cebf8b04cd6864b59e4c0cf4aafa.exe 3940 pcftxel.exe 3940 pcftxel.exe 3940 pcftxel.exe 3940 pcftxel.exe 3940 pcftxel.exe 3940 pcftxel.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3940 pcftxel.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe Token: SeTcbPrivilege 812 svchost.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 3940 wrote to memory of 812 3940 pcftxel.exe 11 PID 812 wrote to memory of 4032 812 svchost.exe 102 PID 812 wrote to memory of 4032 812 svchost.exe 102 PID 812 wrote to memory of 2328 812 svchost.exe 105 PID 812 wrote to memory of 2328 812 svchost.exe 105 PID 812 wrote to memory of 4136 812 svchost.exe 106 PID 812 wrote to memory of 4136 812 svchost.exe 106 PID 812 wrote to memory of 4368 812 svchost.exe 108 PID 812 wrote to memory of 4368 812 svchost.exe 108 PID 812 wrote to memory of 4368 812 svchost.exe 108 PID 812 wrote to memory of 2708 812 svchost.exe 110 PID 812 wrote to memory of 2708 812 svchost.exe 110 PID 812 wrote to memory of 2708 812 svchost.exe 110 PID 812 wrote to memory of 3544 812 svchost.exe 111 PID 812 wrote to memory of 3544 812 svchost.exe 111 PID 812 wrote to memory of 3544 812 svchost.exe 111 PID 812 wrote to memory of 4828 812 svchost.exe 113 PID 812 wrote to memory of 4828 812 svchost.exe 113 PID 812 wrote to memory of 4828 812 svchost.exe 113 PID 812 wrote to memory of 32 812 svchost.exe 114 PID 812 wrote to memory of 32 812 svchost.exe 114 PID 812 wrote to memory of 32 812 svchost.exe 114 PID 812 wrote to memory of 4496 812 svchost.exe 115 PID 812 wrote to memory of 4496 812 svchost.exe 115 PID 812 wrote to memory of 4496 812 svchost.exe 115 PID 812 wrote to memory of 4928 812 svchost.exe 116 PID 812 wrote to memory of 4928 812 svchost.exe 116 PID 812 wrote to memory of 4928 812 svchost.exe 116 PID 812 wrote to memory of 2196 812 svchost.exe 117 PID 812 wrote to memory of 2196 812 svchost.exe 117 PID 812 wrote to memory of 2196 812 svchost.exe 117 PID 812 wrote to memory of 4904 812 svchost.exe 118 PID 812 wrote to memory of 4904 812 svchost.exe 118 PID 812 wrote to memory of 4904 812 svchost.exe 118 PID 812 wrote to memory of 1852 812 svchost.exe 119 PID 812 wrote to memory of 1852 812 svchost.exe 119
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding2⤵PID:4032
-
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding2⤵PID:2328
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}2⤵PID:4136
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca2⤵PID:4368
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca2⤵PID:2708
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca2⤵PID:3544
-
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.12⤵PID:4828
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca2⤵PID:32
-
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.12⤵PID:4496
-
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.12⤵PID:4928
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca2⤵PID:2196
-
-
C:\Windows\system32\BackgroundTaskHost.exe"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider2⤵PID:4904
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:1852
-
-
C:\Users\Admin\AppData\Local\Temp\9cd4cebf8b04cd6864b59e4c0cf4aafa.exe"C:\Users\Admin\AppData\Local\Temp\9cd4cebf8b04cd6864b59e4c0cf4aafa.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4988
-
C:\Users\Admin\AppData\Local\Temp\pcftxel.exeC:\Users\Admin\AppData\Local\Temp\pcftxel.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 6842⤵
- Program crash
PID:892
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 6922⤵
- Program crash
PID:2292
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3940 -ip 39401⤵PID:3616
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3940 -ip 39401⤵PID:2988
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
654B
MD50269b753ce2098e66dd7fd2068a9e0dc
SHA149c5ebe8e401c72b1ebc5154687a90bee292899d
SHA256fd5aebc0b5e385e9b9dd08ae905082d69783bfde3a26ba039b7069fdc73d9456
SHA51226fb7fa4fcc67d5c9b9e7b413bdb3a6d744430e243cd29ae986e319c25bfd1f09289300b4351a11b31d46a9997e189adacc7238edc5ba55deefe4216f9f8caed
-
Filesize
654KB
MD59cd4cebf8b04cd6864b59e4c0cf4aafa
SHA12287faa3026c5981f3796268112998ac1c06c5d3
SHA256748b8dc9ddd13cfdf844a6ba40a59dc5a464d0240133394adffc5496cd1021e7
SHA51203ec7b69a8f616ab4254429499d80e5b5e7e28c1b44b418b446f6a341bdc77393482cd790764981498c6d54d2ffd0d32c118c45dee056d681533167f7b83359d