imminent | 1c43c431210b337d6e963610fe180138be555cda12ed80f0295513ddeeb56862

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30-04-2024 13:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MW2 FOV Changer.exe
Size

15.2MB
MD5

57d5a31aa74a02a1c155aaa618c290c1
SHA1

9dd86085bc7f7497d8b437de5da8db54e8703ace
SHA256

af917a63e27ea18999a8f1feb4e7fa60955f21dd3c8fac6a4d9c5bb34f4d2ca1
SHA512

c46bfd6e3877812bad8456e6d13c36db4f69d8e6798d47a41aa24bb3f16229deef2e852b9956ab745ae1acdbcf1a4b610e7b652ab16902f0efe8f4988c4559f3
SSDEEP

24576:tvoagpQjczZKdUt5TKX+aW1dMG0m6jYg1CZbBJT0n:5TaQgZ2GbMGf4CZDIn

Score

10^/10

imminent nanocore evasion keylogger spyware stealer trojan

Malware Config

Signatures

Imminent RAT
Remote-access trojan based on Imminent Monitor remote admin software.
trojan spyware imminent
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Checks computer location settings 2 TTPs 10 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	WMIhook.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	WMIhook.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	WMIhook.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	WMIhook.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	WMIhook.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	MW2 FOV Changer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	SystemHosts.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	WMIhook.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	WMIhook.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	WMIhook.exe

Drops startup file 9 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WMIhook.exe.lnk	WMIhook.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WMIhook.exe.lnk	SystemHosts.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WMIhook.exe.lnk	WMIhook.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WMIhook.exe.lnk	WMIhook.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WMIhook.exe.lnk	WMIhook.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WMIhook.exe.lnk	WMIhook.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WMIhook.exe.lnk	WMIhook.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WMIhook.exe.lnk	WMIhook.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WMIhook.exe.lnk	WMIhook.exe

Executes dropped EXE 29 IoCs

pid	Process
516	SystemHosts.exe
2888	svhost.exe
4848	tmp.exe
816	svhost.exe
2772	WMIhook.exe
4236	WMIhook.exe
2972	tmp.exe
448	svhost.exe
2644	tmp.exe
5024	svhost.exe
2300	WMIhook.exe
2296	tmp.exe
1284	svhost.exe
1956	WMIhook.exe
1924	tmp.exe
1744	svhost.exe
3204	WMIhook.exe
3140	tmp.exe
216	svhost.exe
1648	WMIhook.exe
1836	tmp.exe
1676	svhost.exe
1624	WMIhook.exe
3980	tmp.exe
1352	svhost.exe
4492	WMIhook.exe
1952	tmp.exe
876	svhost.exe
4616	WMIhook.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	svhost.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	tmp.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	tmp.exe

Suspicious use of SetThreadContext 10 IoCs

description	pid	Process	procid_target
PID 4528 set thread context of 2888	4528	MW2 FOV Changer.exe	86
PID 516 set thread context of 816	516	SystemHosts.exe	94
PID 2772 set thread context of 448	2772	WMIhook.exe	107
PID 4236 set thread context of 5024	4236	WMIhook.exe	112
PID 2300 set thread context of 1284	2300	WMIhook.exe	123
PID 1956 set thread context of 1744	1956	WMIhook.exe	132
PID 3204 set thread context of 216	3204	WMIhook.exe	141
PID 1648 set thread context of 1676	1648	WMIhook.exe	150
PID 1624 set thread context of 1352	1624	WMIhook.exe	159
PID 4492 set thread context of 876	4492	WMIhook.exe	170

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	tmp.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	tmp.exe
File opened for modification	C:\Windows\assembly	tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
5000	schtasks.exe

Delays execution with timeout.exe 8 IoCs

evasion

pid	Process
4428	timeout.exe
5088	timeout.exe
3788	timeout.exe
5040	timeout.exe
2000	timeout.exe
1920	timeout.exe
4828	timeout.exe
4888	timeout.exe

Enumerates processes with tasklist 1 TTPs 8 IoCs

Process Discovery

T1057

pid	Process
4036	tasklist.exe
3104	tasklist.exe
2992	tasklist.exe
5116	tasklist.exe
1708	tasklist.exe
2320	tasklist.exe
920	tasklist.exe
4540	tasklist.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
4528	MW2 FOV Changer.exe
4528	MW2 FOV Changer.exe
2888	svhost.exe
2888	svhost.exe
2888	svhost.exe
516	SystemHosts.exe
516	SystemHosts.exe
516	SystemHosts.exe
2772	WMIhook.exe
2772	WMIhook.exe
2772	WMIhook.exe
4236	WMIhook.exe
4236	WMIhook.exe
4236	WMIhook.exe
2300	WMIhook.exe
2300	WMIhook.exe
2300	WMIhook.exe
1956	WMIhook.exe
1956	WMIhook.exe
1956	WMIhook.exe
3204	WMIhook.exe
3204	WMIhook.exe
3204	WMIhook.exe
1648	WMIhook.exe
1648	WMIhook.exe
1648	WMIhook.exe
1624	WMIhook.exe
1624	WMIhook.exe
1624	WMIhook.exe
4492	WMIhook.exe
4492	WMIhook.exe
4492	WMIhook.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2888	svhost.exe
4848	tmp.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeDebugPrivilege	4528	MW2 FOV Changer.exe
Token: 33	4528	MW2 FOV Changer.exe
Token: SeIncBasePriorityPrivilege	4528	MW2 FOV Changer.exe
Token: SeDebugPrivilege	516	SystemHosts.exe
Token: 33	516	SystemHosts.exe
Token: SeIncBasePriorityPrivilege	516	SystemHosts.exe
Token: SeDebugPrivilege	2888	svhost.exe
Token: SeDebugPrivilege	4848	tmp.exe
Token: 33	4848	tmp.exe
Token: SeIncBasePriorityPrivilege	4848	tmp.exe
Token: SeDebugPrivilege	2772	WMIhook.exe
Token: 33	2772	WMIhook.exe
Token: SeIncBasePriorityPrivilege	2772	WMIhook.exe
Token: SeDebugPrivilege	4540	tasklist.exe
Token: SeDebugPrivilege	4236	WMIhook.exe
Token: 33	4236	WMIhook.exe
Token: SeIncBasePriorityPrivilege	4236	WMIhook.exe
Token: SeDebugPrivilege	4036	tasklist.exe
Token: SeDebugPrivilege	2300	WMIhook.exe
Token: 33	2300	WMIhook.exe
Token: SeIncBasePriorityPrivilege	2300	WMIhook.exe
Token: SeDebugPrivilege	3104	tasklist.exe
Token: SeDebugPrivilege	1956	WMIhook.exe
Token: 33	1956	WMIhook.exe
Token: SeIncBasePriorityPrivilege	1956	WMIhook.exe
Token: SeDebugPrivilege	2992	tasklist.exe
Token: SeDebugPrivilege	3204	WMIhook.exe
Token: 33	3204	WMIhook.exe
Token: SeIncBasePriorityPrivilege	3204	WMIhook.exe
Token: SeDebugPrivilege	5116	tasklist.exe
Token: SeDebugPrivilege	1648	WMIhook.exe
Token: 33	1648	WMIhook.exe
Token: SeIncBasePriorityPrivilege	1648	WMIhook.exe
Token: SeDebugPrivilege	1708	tasklist.exe
Token: SeDebugPrivilege	1624	WMIhook.exe
Token: 33	1624	WMIhook.exe
Token: SeIncBasePriorityPrivilege	1624	WMIhook.exe
Token: SeDebugPrivilege	2320	tasklist.exe
Token: SeDebugPrivilege	4492	WMIhook.exe
Token: 33	4492	WMIhook.exe
Token: SeIncBasePriorityPrivilege	4492	WMIhook.exe
Token: SeDebugPrivilege	920	tasklist.exe
Token: SeDebugPrivilege	4616	WMIhook.exe
Token: 33	4616	WMIhook.exe
Token: SeIncBasePriorityPrivilege	4616	WMIhook.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4848	tmp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 516	4528	MW2 FOV Changer.exe	85
PID 4528 wrote to memory of 516	4528	MW2 FOV Changer.exe	85
PID 4528 wrote to memory of 516	4528	MW2 FOV Changer.exe	85
PID 4528 wrote to memory of 2888	4528	MW2 FOV Changer.exe	86
PID 4528 wrote to memory of 2888	4528	MW2 FOV Changer.exe	86
PID 4528 wrote to memory of 2888	4528	MW2 FOV Changer.exe	86
PID 4528 wrote to memory of 2888	4528	MW2 FOV Changer.exe	86
PID 4528 wrote to memory of 2888	4528	MW2 FOV Changer.exe	86
PID 4528 wrote to memory of 2888	4528	MW2 FOV Changer.exe	86
PID 4528 wrote to memory of 2888	4528	MW2 FOV Changer.exe	86
PID 4528 wrote to memory of 2888	4528	MW2 FOV Changer.exe	86
PID 2888 wrote to memory of 5000	2888	svhost.exe	88
PID 2888 wrote to memory of 5000	2888	svhost.exe	88
PID 2888 wrote to memory of 5000	2888	svhost.exe	88
PID 516 wrote to memory of 3224	516	SystemHosts.exe	90
PID 516 wrote to memory of 3224	516	SystemHosts.exe	90
PID 516 wrote to memory of 3224	516	SystemHosts.exe	90
PID 3224 wrote to memory of 2924	3224	cmd.exe	92
PID 3224 wrote to memory of 2924	3224	cmd.exe	92
PID 3224 wrote to memory of 2924	3224	cmd.exe	92
PID 516 wrote to memory of 4848	516	SystemHosts.exe	93
PID 516 wrote to memory of 4848	516	SystemHosts.exe	93
PID 516 wrote to memory of 4848	516	SystemHosts.exe	93
PID 516 wrote to memory of 816	516	SystemHosts.exe	94
PID 516 wrote to memory of 816	516	SystemHosts.exe	94
PID 516 wrote to memory of 816	516	SystemHosts.exe	94
PID 516 wrote to memory of 816	516	SystemHosts.exe	94
PID 516 wrote to memory of 816	516	SystemHosts.exe	94
PID 516 wrote to memory of 816	516	SystemHosts.exe	94
PID 516 wrote to memory of 816	516	SystemHosts.exe	94
PID 516 wrote to memory of 816	516	SystemHosts.exe	94
PID 516 wrote to memory of 1168	516	SystemHosts.exe	95
PID 516 wrote to memory of 1168	516	SystemHosts.exe	95
PID 516 wrote to memory of 1168	516	SystemHosts.exe	95
PID 1168 wrote to memory of 5040	1168	cmd.exe	97
PID 1168 wrote to memory of 5040	1168	cmd.exe	97
PID 1168 wrote to memory of 5040	1168	cmd.exe	97
PID 516 wrote to memory of 2772	516	SystemHosts.exe	98
PID 516 wrote to memory of 2772	516	SystemHosts.exe	98
PID 516 wrote to memory of 2772	516	SystemHosts.exe	98
PID 1168 wrote to memory of 4540	1168	cmd.exe	99
PID 1168 wrote to memory of 4540	1168	cmd.exe	99
PID 1168 wrote to memory of 4540	1168	cmd.exe	99
PID 1168 wrote to memory of 1816	1168	cmd.exe	100
PID 1168 wrote to memory of 1816	1168	cmd.exe	100
PID 1168 wrote to memory of 1816	1168	cmd.exe	100
PID 1168 wrote to memory of 4236	1168	cmd.exe	102
PID 1168 wrote to memory of 4236	1168	cmd.exe	102
PID 1168 wrote to memory of 4236	1168	cmd.exe	102
PID 2772 wrote to memory of 4188	2772	WMIhook.exe	103
PID 2772 wrote to memory of 4188	2772	WMIhook.exe	103
PID 2772 wrote to memory of 4188	2772	WMIhook.exe	103
PID 4188 wrote to memory of 4184	4188	cmd.exe	105
PID 4188 wrote to memory of 4184	4188	cmd.exe	105
PID 4188 wrote to memory of 4184	4188	cmd.exe	105
PID 2772 wrote to memory of 2972	2772	WMIhook.exe	106
PID 2772 wrote to memory of 2972	2772	WMIhook.exe	106
PID 2772 wrote to memory of 2972	2772	WMIhook.exe	106
PID 2772 wrote to memory of 448	2772	WMIhook.exe	107
PID 2772 wrote to memory of 448	2772	WMIhook.exe	107
PID 2772 wrote to memory of 448	2772	WMIhook.exe	107
PID 2772 wrote to memory of 448	2772	WMIhook.exe	107
PID 2772 wrote to memory of 448	2772	WMIhook.exe	107
PID 2772 wrote to memory of 448	2772	WMIhook.exe	107

C:\Users\Admin\AppData\Local\Temp\MW2 FOV Changer.exe
"C:\Users\Admin\AppData\Local\Temp\MW2 FOV Changer.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Users\Admin\AppData\Local\Temp\SystemHosts.exe
  "C:\Users\Admin\AppData\Local\Temp\SystemHosts.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:516
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3224
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\WMIHost\WMIhook.exe.lnk " /f
      4⤵
      PID:2924
- - C:\Users\Admin\AppData\Roaming\tmp.exe
    "C:\Users\Admin\AppData\Roaming\tmp.exe"
    3⤵
    - Executes dropped EXE
    - Drops desktop.ini file(s)
    - Drops file in Windows directory
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4848
- - C:\Users\Admin\AppData\Roaming\svhost.exe
    "C:\Users\Admin\AppData\Roaming\svhost.exe"
    3⤵
    - Executes dropped EXE
    PID:816
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WMIHost\WMIhook.exe.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1168
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 6
      4⤵
      Delays execution with timeout.exe
      PID:5040
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /nh /fi "imagename eq .exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4540
  - - C:\Windows\SysWOW64\find.exe
      find /i ".exe"
      4⤵
      PID:1816
  - - C:\Users\Admin\AppData\Roaming\WMIHost\WMIhook.exe
      "C:\Users\Admin\AppData\Roaming\WMIHost\WMIhook.exe"
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4236
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe"
        5⤵
        
        PID:3432
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\WMIHost\WMIhook.exe.lnk " /f
        6⤵
        
        PID:2092
    - - C:\Users\Admin\AppData\Roaming\tmp.exe
        
        "C:\Users\Admin\AppData\Roaming\tmp.exe"
        5⤵
        Executes dropped EXE
        
        PID:2644
    - - C:\Users\Admin\AppData\Roaming\svhost.exe
        
        "C:\Users\Admin\AppData\Roaming\svhost.exe"
        5⤵
        Executes dropped EXE
        
        PID:5024
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 6
      4⤵
      Delays execution with timeout.exe
      PID:2000
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /nh /fi "imagename eq .exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4036
  - - C:\Windows\SysWOW64\find.exe
      find /i ".exe"
      4⤵
      PID:4192
  - - C:\Users\Admin\AppData\Roaming\WMIHost\WMIhook.exe
      "C:\Users\Admin\AppData\Roaming\WMIHost\WMIhook.exe"
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2300
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe"
        5⤵
        
        PID:3060
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\WMIHost\WMIhook.exe.lnk " /f
        6⤵
        
        PID:1352
    - - C:\Users\Admin\AppData\Roaming\tmp.exe
        
        "C:\Users\Admin\AppData\Roaming\tmp.exe"
        5⤵
        Executes dropped EXE
        
        PID:2296
    - - C:\Users\Admin\AppData\Roaming\svhost.exe
        
        "C:\Users\Admin\AppData\Roaming\svhost.exe"
        5⤵
        Executes dropped EXE
        
        PID:1284
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 6
      4⤵
      Delays execution with timeout.exe
      PID:1920
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /nh /fi "imagename eq .exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3104
  - - C:\Windows\SysWOW64\find.exe
      find /i ".exe"
      4⤵
      PID:2624
  - - C:\Users\Admin\AppData\Roaming\WMIHost\WMIhook.exe
      "C:\Users\Admin\AppData\Roaming\WMIHost\WMIhook.exe"
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1956
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe"
        5⤵
        
        PID:1216
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\WMIHost\WMIhook.exe.lnk " /f
        6⤵
        
        PID:4476
    - - C:\Users\Admin\AppData\Roaming\tmp.exe
        
        "C:\Users\Admin\AppData\Roaming\tmp.exe"
        5⤵
        Executes dropped EXE
        
        PID:1924
    - - C:\Users\Admin\AppData\Roaming\svhost.exe
        
        "C:\Users\Admin\AppData\Roaming\svhost.exe"
        5⤵
        Executes dropped EXE
        
        PID:1744
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 6
      4⤵
      Delays execution with timeout.exe
      PID:4828
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /nh /fi "imagename eq .exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2992
  - - C:\Windows\SysWOW64\find.exe
      find /i ".exe"
      4⤵
      PID:2064
  - - C:\Users\Admin\AppData\Roaming\WMIHost\WMIhook.exe
      "C:\Users\Admin\AppData\Roaming\WMIHost\WMIhook.exe"
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3204
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe"
        5⤵
        
        PID:2024
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\WMIHost\WMIhook.exe.lnk " /f
        6⤵
        
        PID:2152
    - - C:\Users\Admin\AppData\Roaming\tmp.exe
        
        "C:\Users\Admin\AppData\Roaming\tmp.exe"
        5⤵
        Executes dropped EXE
        
        PID:3140
    - - C:\Users\Admin\AppData\Roaming\svhost.exe
        
        "C:\Users\Admin\AppData\Roaming\svhost.exe"
        5⤵
        Executes dropped EXE
        
        PID:216
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 6
      4⤵
      Delays execution with timeout.exe
      PID:4888
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /nh /fi "imagename eq .exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5116
  - - C:\Windows\SysWOW64\find.exe
      find /i ".exe"
      4⤵
      PID:4236
  - - C:\Users\Admin\AppData\Roaming\WMIHost\WMIhook.exe
      "C:\Users\Admin\AppData\Roaming\WMIHost\WMIhook.exe"
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1648
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe"
        5⤵
        
        PID:1780
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\WMIHost\WMIhook.exe.lnk " /f
        6⤵
        
        PID:1984
    - - C:\Users\Admin\AppData\Roaming\tmp.exe
        
        "C:\Users\Admin\AppData\Roaming\tmp.exe"
        5⤵
        Executes dropped EXE
        
        PID:1836
    - - C:\Users\Admin\AppData\Roaming\svhost.exe
        
        "C:\Users\Admin\AppData\Roaming\svhost.exe"
        5⤵
        Executes dropped EXE
        
        PID:1676
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 6
      4⤵
      Delays execution with timeout.exe
      PID:4428
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /nh /fi "imagename eq .exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1708
  - - C:\Windows\SysWOW64\find.exe
      find /i ".exe"
      4⤵
      PID:1720
  - - C:\Users\Admin\AppData\Roaming\WMIHost\WMIhook.exe
      "C:\Users\Admin\AppData\Roaming\WMIHost\WMIhook.exe"
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1624
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe"
        5⤵
        
        PID:3968
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\WMIHost\WMIhook.exe.lnk " /f
        6⤵
        
        PID:736
    - - C:\Users\Admin\AppData\Roaming\tmp.exe
        
        "C:\Users\Admin\AppData\Roaming\tmp.exe"
        5⤵
        Executes dropped EXE
        
        PID:3980
    - - C:\Users\Admin\AppData\Roaming\svhost.exe
        
        "C:\Users\Admin\AppData\Roaming\svhost.exe"
        5⤵
        Executes dropped EXE
        
        PID:1352
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 6
      4⤵
      Delays execution with timeout.exe
      PID:5088
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /nh /fi "imagename eq .exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2320
  - - C:\Windows\SysWOW64\find.exe
      find /i ".exe"
      4⤵
      PID:5052
  - - C:\Users\Admin\AppData\Roaming\WMIHost\WMIhook.exe
      "C:\Users\Admin\AppData\Roaming\WMIHost\WMIhook.exe"
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4492
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe"
        5⤵
        
        PID:2636
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\WMIHost\WMIhook.exe.lnk " /f
        6⤵
        
        PID:3612
    - - C:\Users\Admin\AppData\Roaming\tmp.exe
        
        "C:\Users\Admin\AppData\Roaming\tmp.exe"
        5⤵
        Executes dropped EXE
        
        PID:1952
    - - C:\Users\Admin\AppData\Roaming\svhost.exe
        
        "C:\Users\Admin\AppData\Roaming\svhost.exe"
        5⤵
        Executes dropped EXE
        
        PID:876
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 6
      4⤵
      Delays execution with timeout.exe
      PID:3788
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist /nh /fi "imagename eq .exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:920
  - - C:\Windows\SysWOW64\find.exe
      find /i ".exe"
      4⤵
      PID:452
  - - C:\Users\Admin\AppData\Roaming\WMIHost\WMIhook.exe
      "C:\Users\Admin\AppData\Roaming\WMIHost\WMIhook.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4616
- - C:\Users\Admin\AppData\Roaming\WMIHost\WMIhook.exe
    C:\Users\Admin\AppData\Roaming\WMIHost\WMIhook.exe
    3⤵
    - Checks computer location settings
    - Drops startup file
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2772
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4188
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\WMIHost\WMIhook.exe.lnk " /f
        5⤵
        
        PID:4184
  - - C:\Users\Admin\AppData\Roaming\tmp.exe
      "C:\Users\Admin\AppData\Roaming\tmp.exe"
      4⤵
      Executes dropped EXE
      PID:2972
  - - C:\Users\Admin\AppData\Roaming\svhost.exe
      "C:\Users\Admin\AppData\Roaming\svhost.exe"
      4⤵
      Executes dropped EXE
      PID:448
- C:\Users\Admin\AppData\Local\Temp\svhost.exe
  "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /create /f /tn "DPI Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp3E61.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:5000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\WMIhook.exe.log

Filesize
408B

MD5
40b0c3caa1b14a4c83e8475c46bf2016

SHA1
af9575cda4d842f028d18b17063796a894ecd9d0

SHA256
70e88a428d92b6ab5905dac9f324824c4c6f120bc3f385c82b2d12f707a4a867

SHA512
916437df737de4b6063b7116b4d148229d4a975eb4046122d47434b81fba06e88e09e5f273ec496c81ef3feecb843ccad20a7a04074224416c1fa9951acbdac7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\svhost.exe.log

Filesize
319B

MD5
824ba7b7eed8b900a98dd25129c4cd83

SHA1
54478770b2158000ef365591d42977cb854453a1

SHA256
d182dd648c92e41cd62dccc65f130c07f0a96c03b32f907c3d1218e9aa5bda03

SHA512
ae4f3a9673711ecb6cc5d06874c587341d5094803923b53b6e982278fa64549d7acf866de165e23750facd55da556b6794c0d32f129f4087529c73acd4ffb11e

Download Submit
C:\Users\Admin\AppData\Local\Temp\SystemHosts.exe

Filesize
6.7MB

MD5
ffbb57869e7c843b9cbf902b18a7a94e

SHA1
34feee7ae338d055b7176a49baa8e23165f2352f

SHA256
d3ceef6f206fd2c0b1768f6767da1accfb2c2870512569169fe4706e56b75736

SHA512
0fa8b38a7e82964a054c8f56911e6276d50921c3659120b8275e5cfd55fc69644beb6a45f29423a14c26f8b7c39141dcbf25a6aac88de2b5f3ee93a2e8c705eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\svhost.exe

Filesize
52KB

MD5
a64daca3cfbcd039df3ec29d3eddd001

SHA1
eee8b2573f71e8d5c3ee7e53af3e6772e090d0f3

SHA256
403752009f29381d5e4036b8be94589c89188f9ce8ef5f86959eaaada019ed36

SHA512
b6fe2d0ae3fcd4442579ecf10d498d61e0f042813c8fc4be8019da77d849cfcf0b168507139a1b5697227c272de9091788f8e03cf1ce13d5b5077568cfa6a479

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp3E61.tmp

Filesize
1KB

MD5
24de2170a8dce23ab327cf07c00cd17e

SHA1
c759a98d8447e9674d0707da64cd97204720c0ae

SHA256
fa98fbb5ddd9fcbcdc76196d8dc524602815d90d244eb43f7f983a829b7d3b3d

SHA512
83ea8711513efbd1a4045b27fcd916cab7c9b6ab3e519500db114287b8a42103f44142e1c350f1f7a0bb76d291bfc838834d423338a23a30ff2f15066ff87d2b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WMIhook.exe.lnk

Filesize
908B

MD5
d7c288d9bacec13a0897d6d14df31b30

SHA1
2bfbac17932b3eadecb10118590f245ae653d226

SHA256
b9b922decdb6ce43dcba3ec599041e9960a8656496425a27afd219f94ffc306b

SHA512
bf43ec2413123660c97edb5db0873334a7c9de84936c4bf20cd5305d13c87c28991f42c5ce89cd66ce4e2b243c68a153287baa92fcf8e22bd7e24696e8eff7ad

Download Submit
C:\Users\Admin\AppData\Roaming\WMIHost\WMIhook.exe.bat

Filesize
190B

MD5
7940fc58219887a93fd5ec25cb249429

SHA1
86a8f8971dcfb9d6411bf0376a68ff11f1cf5272

SHA256
a4bb7d456f665ce87b608df3ad11c684d231553a511ef0050b197c1dc632b1db

SHA512
0adcaf63ec2920082b9ff81ab992aad6c80f9498ada61b88b6fbcef26b667ca6ebb9414354bc7faeaecb0d3c0d5a21313a8e94ca9b440327be68289128d573cb

Download Submit
C:\Users\Admin\AppData\Roaming\WMIHost\melt.bat

Filesize
100B

MD5
2aa15a8028ab63147ea2c88ced182f8c

SHA1
ed98166113b2952ff5d61fb2211f6d20d1c39e1d

SHA256
28cb990a5b7789117a735e842c8a6345ff20e4c2662ec4ae6d664d759bf6dfe1

SHA512
f3a13023ab0f06e0abb398d0dec2638ff12d180ad816d23fda257fba091cb347ca174c4c4f0bc6f193bb838c29bae64ad662389c313e07f1fec33a30b5435e64

Download Submit
C:\Users\Admin\AppData\Roaming\tmp.exe

Filesize
349KB

MD5
4a00f1474bf08339715d1fbc3c7d72b0

SHA1
92459a6ac28efe4b6ef89e73de1de29ae3d59ce0

SHA256
f6b061ab8081596317876f9c7b776cb6466e0c2a19398c31d1a83741d2f94b6c

SHA512
4f46d7d00065d1a16ad3db88a6633f0665f2a4fda6041d657b2ea5dfc634d58947e44c3e0957fca30f3e4c473100e28cd77d60e8eea73a1f9a16c3a110b68266

Download Submit
memory/516-18-0x00000000747C0000-0x0000000074D71000-memory.dmp

Filesize
5.7MB

Download
memory/516-62-0x00000000747C0000-0x0000000074D71000-memory.dmp

Filesize
5.7MB

Download
memory/516-15-0x00000000009E0000-0x00000000009F0000-memory.dmp

Filesize
64KB

Download
memory/516-14-0x00000000747C0000-0x0000000074D71000-memory.dmp

Filesize
5.7MB

Download
memory/816-41-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2888-21-0x00000000747C0000-0x0000000074D71000-memory.dmp

Filesize
5.7MB

Download
memory/2888-19-0x0000000000630000-0x0000000000640000-memory.dmp

Filesize
64KB

Download
memory/2888-26-0x0000000000630000-0x0000000000640000-memory.dmp

Filesize
64KB

Download
memory/2888-20-0x00000000747C0000-0x0000000074D71000-memory.dmp

Filesize
5.7MB

Download
memory/2888-82-0x0000000000630000-0x0000000000640000-memory.dmp

Filesize
64KB

Download
memory/2888-83-0x00000000747C0000-0x0000000074D71000-memory.dmp

Filesize
5.7MB

Download
memory/2888-85-0x00000000747C0000-0x0000000074D71000-memory.dmp

Filesize
5.7MB

Download
memory/2888-88-0x0000000000630000-0x0000000000640000-memory.dmp

Filesize
64KB

Download
memory/4528-46-0x00000000747C0000-0x0000000074D71000-memory.dmp

Filesize
5.7MB

Download
memory/4528-0-0x00000000747C0000-0x0000000074D71000-memory.dmp

Filesize
5.7MB

Download
memory/4528-2-0x00000000747C0000-0x0000000074D71000-memory.dmp

Filesize
5.7MB

Download
memory/4528-1-0x0000000001EA0000-0x0000000001EB0000-memory.dmp

Filesize
64KB

Download