Analysis
-
max time kernel
149s -
max time network
136s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
05-04-2024 11:31
Static task
static1
Behavioral task
behavioral1
Sample
Windows10Upgrade9252.exe
Resource
win10-20240404-en
General
-
Target
Windows10Upgrade9252.exe
-
Size
3.2MB
-
MD5
c0b25def4312fbddbcc4f01c6c0f5ba6
-
SHA1
8d16a183d61233e7d6b6af7b3cafc6645ac2acb1
-
SHA256
c0424d0ae06ca1e6e0249b40d33ac40d74075856d543ec0924884664fba52b79
-
SHA512
8c67619747bb108dae5661688ec8fa4c62bc6ac38ee6ff14a4691aab04d7ddd870fee4262cb30624a6bd85ac1f7595af05311496b0336f979e7e5f797791bc0e
-
SSDEEP
98304:GgjXlctych4cCzJ8k2omX8sUf0ht5f/LyXtcH/:JjKtych9CzJqXM32jyX
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Executes dropped EXE 1 IoCs
pid Process 3868 Windows10UpgraderApp.exe -
Loads dropped DLL 1 IoCs
pid Process 3868 Windows10UpgraderApp.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe -
Drops file in Program Files directory 26 IoCs
description ioc Process File created C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe Windows10Upgrade9252.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\GetCurrentDeploy.dll Windows10Upgrade9252.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\bullet.png Windows10Upgrade9252.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\logo.png Windows10Upgrade9252.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\js\ui.js Windows10Upgrade9252.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\pass.png Windows10Upgrade9252.exe File opened for modification C:\Program Files (x86)\WindowsInstallationAssistant\Configuration.ini Windows10UpgraderApp.exe File opened for modification C:\Program Files (x86)\WindowsInstallationAssistant\Configuration.ini Windows10Upgrade9252.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\block.png Windows10Upgrade9252.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\WinDlp.dll Windows10Upgrade9252.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\appraiserxp.dll Windows10Upgrade9252.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\GetCurrentRollback.EXE Windows10Upgrade9252.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default.htm Windows10Upgrade9252.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\js\base.js Windows10Upgrade9252.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\downloader.dll Windows10Upgrade9252.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\ESDHelper.dll Windows10Upgrade9252.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\GetCurrentOOBE.dll Windows10Upgrade9252.exe File opened for modification C:\Program Files (x86)\WindowsInstallationAssistant\appraiserxp.dll Windows10Upgrade9252.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\css\oobe-desktopRS2.css Windows10Upgrade9252.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default.css Windows10Upgrade9252.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\css\oobe-desktop.css Windows10Upgrade9252.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\Microsoft.WinJS\css\ui-dark.css Windows10Upgrade9252.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\default_sunvalley.htm Windows10Upgrade9252.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\eula.css Windows10Upgrade9252.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\loading.gif Windows10Upgrade9252.exe File created C:\Program Files (x86)\WindowsInstallationAssistant\resources\ux\marketing.png Windows10Upgrade9252.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe File created C:\Windows\rescache\_merged\2717123927\1590785016.pri taskmgr.exe File created C:\Windows\rescache\_merged\2717123927\1590785016.pri explorer.exe File created C:\Windows\rescache\_merged\1601268389\715946058.pri SearchUI.exe File created C:\Windows\rescache\_merged\4032412167\4002656488.pri explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 4548 3868 WerFault.exe 75 -
Checks SCSI registry key(s) 3 TTPs 29 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags explorer.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchUI.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchUI.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch Windows10UpgraderApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" Windows10UpgraderApp.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Internet Explorer\TypedURLs taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Internet Explorer\GPU SearchUI.exe -
Modifies registry class 30 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance explorer.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.cortana SearchUI.exe Set value (data) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\IconStreams = 14000000070000000100010006000000140000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b0072000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c100000000000002000000e80704004100720067006a006200650078002000200033000a005600610067007200650061007200670020006e007000700072006600660000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000074ae2078e323294282c1e41cb67d5b9c000000000000000000000000b15081264d87da0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000002000000e80704004600630072006e0078007200650066003a002000360037002500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000100000073ae2078e323294282c1e41cb67d5b9c000000000000000000000000b03d6e264d87da0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000007b0031004e005000310034005200370037002d0030003200520037002d0034005200350051002d004f003700340034002d00320052004f0031004e00520035003100390038004f0037007d005c0047006e00660078007a00740065002e0072006b007200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e807040050004300480020003500350025000d000a005a0072007a00620065006c0020003600300025000d000a0051007600660078002000310025000d000a004100720067006a00620065007800200030002500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000f14de1284d87da0100000000000000000000000047006e006600780020005a006e0061006e0074007200650000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b00360051003800300039003300370037002d0036004e00530030002d003400340034004f002d0038003900350037002d004e00330037003700330053003000320032003000300052007d005c004a0076006100710062006a0066002000510072007300720061007100720065005c005a0046004e00460050006800760059002e0072006b007200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000000000000e80704004e0070006700760062006100660020006100720072007100720071002e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000fffffffff9a6406d323dcb4f8a86be992e03dc760000000000000000000000006b8308248a86da0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a0066000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff75ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff81ae2078e323294282c1e41cb67d5b9c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185" SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "133567065789565016" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchUI.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance explorer.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cortana SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "23" SearchUI.exe Set value (str) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "23" SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance explorer.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\windows.immersivecontrolpanel_cw5n1h2txyewy\SplashScreen explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "56" SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "56" SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152" SearchUI.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 3844 taskmgr.exe 3712 explorer.exe -
Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeBackupPrivilege 352 Windows10Upgrade9252.exe Token: SeRestorePrivilege 352 Windows10Upgrade9252.exe Token: SeDebugPrivilege 3844 taskmgr.exe Token: SeSystemProfilePrivilege 3844 taskmgr.exe Token: SeCreateGlobalPrivilege 3844 taskmgr.exe Token: SeShutdownPrivilege 3712 explorer.exe Token: SeCreatePagefilePrivilege 3712 explorer.exe Token: SeShutdownPrivilege 3712 explorer.exe Token: SeCreatePagefilePrivilege 3712 explorer.exe Token: SeShutdownPrivilege 3712 explorer.exe Token: SeCreatePagefilePrivilege 3712 explorer.exe Token: SeShutdownPrivilege 3712 explorer.exe Token: SeCreatePagefilePrivilege 3712 explorer.exe Token: SeShutdownPrivilege 3712 explorer.exe Token: SeCreatePagefilePrivilege 3712 explorer.exe Token: SeShutdownPrivilege 3712 explorer.exe Token: SeCreatePagefilePrivilege 3712 explorer.exe Token: SeShutdownPrivilege 3712 explorer.exe Token: SeCreatePagefilePrivilege 3712 explorer.exe Token: SeShutdownPrivilege 3712 explorer.exe Token: SeCreatePagefilePrivilege 3712 explorer.exe Token: SeShutdownPrivilege 3712 explorer.exe Token: SeCreatePagefilePrivilege 3712 explorer.exe Token: SeShutdownPrivilege 3712 explorer.exe Token: SeCreatePagefilePrivilege 3712 explorer.exe Token: SeShutdownPrivilege 3712 explorer.exe Token: SeCreatePagefilePrivilege 3712 explorer.exe Token: SeShutdownPrivilege 3712 explorer.exe Token: SeCreatePagefilePrivilege 3712 explorer.exe Token: SeShutdownPrivilege 3712 explorer.exe Token: SeCreatePagefilePrivilege 3712 explorer.exe Token: SeShutdownPrivilege 3712 explorer.exe Token: SeCreatePagefilePrivilege 3712 explorer.exe Token: SeShutdownPrivilege 3712 explorer.exe Token: SeCreatePagefilePrivilege 3712 explorer.exe Token: SeShutdownPrivilege 3712 explorer.exe Token: SeCreatePagefilePrivilege 3712 explorer.exe Token: SeShutdownPrivilege 3712 explorer.exe Token: SeCreatePagefilePrivilege 3712 explorer.exe Token: SeShutdownPrivilege 3712 explorer.exe Token: SeCreatePagefilePrivilege 3712 explorer.exe Token: SeShutdownPrivilege 3712 explorer.exe Token: SeCreatePagefilePrivilege 3712 explorer.exe Token: SeShutdownPrivilege 3712 explorer.exe Token: SeCreatePagefilePrivilege 3712 explorer.exe Token: SeShutdownPrivilege 3712 explorer.exe Token: SeCreatePagefilePrivilege 3712 explorer.exe Token: SeShutdownPrivilege 3712 explorer.exe Token: SeCreatePagefilePrivilege 3712 explorer.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3844 taskmgr.exe 3712 explorer.exe 3712 explorer.exe 3712 explorer.exe 3712 explorer.exe 3712 explorer.exe 3712 explorer.exe 3712 explorer.exe 3712 explorer.exe 3712 explorer.exe 3712 explorer.exe 3712 explorer.exe 3712 explorer.exe 3712 explorer.exe 3712 explorer.exe 3712 explorer.exe 3712 explorer.exe 3844 taskmgr.exe 3712 explorer.exe 3712 explorer.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 3868 Windows10UpgraderApp.exe 3868 Windows10UpgraderApp.exe 3868 Windows10UpgraderApp.exe 3868 Windows10UpgraderApp.exe 3868 Windows10UpgraderApp.exe 4392 SearchUI.exe 3844 taskmgr.exe 3712 explorer.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 352 wrote to memory of 3868 352 Windows10Upgrade9252.exe 75 PID 352 wrote to memory of 3868 352 Windows10Upgrade9252.exe 75 PID 352 wrote to memory of 3868 352 Windows10Upgrade9252.exe 75 PID 3844 wrote to memory of 3712 3844 taskmgr.exe 83 PID 3844 wrote to memory of 3712 3844 taskmgr.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe"C:\Users\Admin\AppData\Local\Temp\Windows10Upgrade9252.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:352 -
C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe"C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3868 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 17083⤵
- Program crash
PID:4548
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3712
-
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4392
Network
-
Remote address:8.8.8.8:53Request58.28.101.95.in-addr.arpaIN PTRResponse58.28.101.95.in-addr.arpaIN PTRa95-101-28-58deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request29.243.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request211.143.182.52.in-addr.arpaIN PTRResponse
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
27B
MD5ca22263c7a6f965df18f5c601f5db7ce
SHA1e4b1a401ed497523a583ae8613646b03778a33a6
SHA256299fa3043627954c524b6171c26fcc3513790310aa2561e6f012eff15254381c
SHA5123cd39b438f7cb34b38f32240b1ba6a5010f49e12123db770460cf74217bc6946e2032355376c203b68863ee85596d21aa7b2d77c94da48a54def111d147311f8
-
Filesize
197KB
MD55b62ad6ae42f32806062ad1bcb3e2de5
SHA18d4a543eac9643931fcb620cd588e2cc1067920a
SHA25696f7b268820511abeeb6bbfad0918cf9161366bc2f558ef7f011331e7de1d6f3
SHA512af5bdbc5019b56eb9a32b6d264388e309e36013d43dbe09c61224ba6fabf1ff905371bc5b6ddaa0d5bfedae99cc5a7051f13fbf26cc756793799e568094eabcf
-
Filesize
3.5MB
MD5ab38a78503d8ad3ce7d69f937d71a99c
SHA100b6a6f09dd45e356ef9e2cacd554c728313fa99
SHA256f635cd1996967c2297e3f20c4838d2f45d1535cfea38971909683e26158fb782
SHA512fe8e4c6973cb26b863ef97d95a7ae8b1b2dbce14bf3b317d085b38347be27db1adc46f5503c110df43e032911e5b070f3e9139857573fffdafff684f27ef1b8f
-
Filesize
82B
MD5b81d1e97c529ac3d7f5a699afce27080
SHA10a981264db289afd71695b4d6849672187e8120f
SHA25635c6e30c7954f7e4b806c883576218621e2620166c8940701b33157bdd0ba225
SHA512e5a8c95d0e9f7464f7bd908cf2f76c89100e69d9bc2e9354c0519bf7da15c5665b3ed97cd676d960d48c024993de0e9eb6683352d902eb86b8af68692334e607
-
Filesize
5KB
MD57f5fcac447cc2150ac90020f8dc8c98b
SHA15710398d65fba59bd91d603fc340bf2a101df40a
SHA256453d8ca4f52fb8fd40d5b4596596911b9fb0794bb89fbf9b60dc27af3eaa2850
SHA512b9fb315fdcf93d028423f49438b1eff40216b377d8c3bc866a20914c17e00bef58a18228bebb8b33c8a64fcaaa34bee84064bb24a525b4c9ac2f26e384edb1ff
-
Filesize
60KB
MD5b2a06af2867a2bb3d4b198a22f7936b3
SHA198a28e15abdd2d6989d667cc578bf6ab954c29f5
SHA25640f468006ab37ef4fcc54c5ff25005644f15d696f1269f67b450c9e3ce5e8d23
SHA512eefc295a7cd517c93bbeadee51ab778f371be8b21a92b0c06339da2e624abd19c34907e0a8965e6bfe81863752c56cc509fcf015a3ee986d208a5fc7cac8bfc5
-
Filesize
16KB
MD51a276cb116bdece96adf8e32c4af4fee
SHA16bc30738fcd0c04370436f4d3340d460d25b788f
SHA2569d9a156c6ca2929f0f22c310260723e28428cb38995c0f940f2617b25e15b618
SHA5125b515b5975fda333a6d9ca0e7de81dbc70311f4ecd8be22770d31c5f159807f653c87acf9df4a72b2d0664f0ef3141088de7f5aa12efc6307715c1c31ba55bb6
-
Filesize
2KB
MD5afeed45df4d74d93c260a86e71e09102
SHA12cc520e3d23f6b371c288645649a482a5db7ccd9
SHA256f5fb1e3a7bca4e2778903e8299c63ab34894e810a174b0143b79183c0fa5072f
SHA512778a6c494eab333c5bb00905adf556c019160c5ab858415c1dd918933f494faf3650e60845d557171c6e1370bcff687672d5af0f647302867b449a2cff9b925d
-
Filesize
420B
MD50968430a52f9f877d83ef2b46b107631
SHA1c1436477b4ee1ee0b0c81c9036eb228e4038b376
SHA256b210f3b072c60c2feb959e56c529e24cec77c1fcf933dcadad1f491f974f5e96
SHA5127a8a15524aecdb48753cc201c215df19bc79950373adc6dd4a8f641e3add53eba31d1309bf671e3b9e696616a3badce65839b211591a2eeebb9306390d81cfcf
-
Filesize
14KB
MD593b13a3ba6c10444e382ea61adae8877
SHA11972b05417059836ae9ae1becb3617958018f93c
SHA256ad625e4cd47b32ab60de59b874b23b88849e36b5161a0ca8b9476a7ff7b069f8
SHA512ce7fa0a163a564e212dfb22ff73accc051d9f58c8e160a04345d772f9994d844e79b3b73966fdee9c0a3455164855446db97b7a097349a14f38445396b43adf0
-
Filesize
363KB
MD5cbb270591c9a1bfb1b10559ab672f705
SHA1fed0d59d60709b5b05b9d31030ea7a5422767a7e
SHA256770a9a15e1eb8e2729f23a3d262b55bef16e4bb7822a2d16eeac3db35a116d7f
SHA51267c4154d47981f22965966aa823dc0e05872b2f6d8fc7d80b4130f1cdb8bf9f326a20980e29c085e2940fc1f7b033b85d2eb192f5bda2da136364a842ea20f6a
-
Filesize
39KB
MD55ad8ceea06e280b9b42e1b8df4b8b407
SHA1693ea7ac3f9fed186e0165e7667d2c41376c5d61
SHA25603a724309e738786023766fde298d17b6ccfcc3d2dbbf5c41725cf93eb891feb
SHA5121694fa3b9102771eef8a42b367d076c691b002de81eb4334ac6bd7befde747b168e7ed8f94f1c8f8877280f51c44adb69947fc1d899943d25b679a1be71dec84