Analysis
-
max time kernel
48s -
max time network
45s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
05/05/2024, 11:05
Static task
static1
Behavioral task
behavioral1
Sample
aimware.exe
Resource
win11-20240426-en
General
-
Target
aimware.exe
-
Size
5.3MB
-
MD5
0a4a28190d8424b8fb649b08df21e393
-
SHA1
ddc5beb62651bf496e33d8be636b805f0458107c
-
SHA256
1626b2b77cd3e63b5f78852f0d67aca413f8435eaf4674415fbde211c4c96450
-
SHA512
11483ce4f36de6adffbf6396ce903b06f5359a47c38eba35fa599359c1e6df6a91dd599a7bf4bd3f78746f1bfd2d96cd8e001214a3f035a8cc772ae47e9ffcb4
-
SSDEEP
98304:G7Nj/bUgNkPWw+5wVP+/pS9qBn9yPyL0K7BysqrgKYTP8OpV/a:2hL+PWw+5WPcSwB9yP+j84D8
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1752 powershell.exe 3888 powershell.exe -
Creates new service(s) 2 TTPs
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\etc\hosts aimware.exe -
Executes dropped EXE 1 IoCs
pid Process 3736 installer.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\MRT.exe aimware.exe File opened for modification C:\Windows\System32\Winevt\Logs\Setup.evtx svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 224 set thread context of 4232 224 aimware.exe 98 -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4212 sc.exe 2876 sc.exe 3576 sc.exe 1996 sc.exe 784 sc.exe 2868 sc.exe 5064 sc.exe 2328 sc.exe 1852 sc.exe 3928 sc.exe 2440 sc.exe 1868 sc.exe 644 sc.exe 1932 sc.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier wmiprvse.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wmiprvse.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wmiprvse.exe Key security queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information wmiprvse.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 224 aimware.exe 1752 powershell.exe 1752 powershell.exe 224 aimware.exe 224 aimware.exe 224 aimware.exe 224 aimware.exe 224 aimware.exe 224 aimware.exe 224 aimware.exe 224 aimware.exe 224 aimware.exe 224 aimware.exe 224 aimware.exe 224 aimware.exe 4232 dialer.exe 4232 dialer.exe 4232 dialer.exe 4232 dialer.exe 224 aimware.exe 224 aimware.exe 224 aimware.exe 224 aimware.exe 3888 powershell.exe 3888 powershell.exe 4232 dialer.exe 4232 dialer.exe 4232 dialer.exe 4232 dialer.exe 4232 dialer.exe 4232 dialer.exe 4232 dialer.exe 4232 dialer.exe 4232 dialer.exe 4232 dialer.exe 3888 powershell.exe 4232 dialer.exe 4232 dialer.exe 4232 dialer.exe 4232 dialer.exe 4232 dialer.exe 4232 dialer.exe 4232 dialer.exe 4232 dialer.exe 3888 powershell.exe 4232 dialer.exe 4232 dialer.exe 4232 dialer.exe 4232 dialer.exe 4232 dialer.exe 4232 dialer.exe 3952 dialer.exe 3952 dialer.exe 4232 dialer.exe 4232 dialer.exe 4232 dialer.exe 4232 dialer.exe 3952 dialer.exe 3952 dialer.exe 3952 dialer.exe 3952 dialer.exe 3952 dialer.exe 3952 dialer.exe 3952 dialer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3280 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1752 powershell.exe Token: SeDebugPrivilege 224 aimware.exe Token: SeDebugPrivilege 4232 dialer.exe Token: SeShutdownPrivilege 1528 powercfg.exe Token: SeCreatePagefilePrivilege 1528 powercfg.exe Token: SeShutdownPrivilege 4772 powercfg.exe Token: SeCreatePagefilePrivilege 4772 powercfg.exe Token: SeShutdownPrivilege 2352 powercfg.exe Token: SeCreatePagefilePrivilege 2352 powercfg.exe Token: SeShutdownPrivilege 4760 powercfg.exe Token: SeCreatePagefilePrivilege 4760 powercfg.exe Token: SeDebugPrivilege 3888 powershell.exe Token: SeDebugPrivilege 3952 dialer.exe Token: SeShutdownPrivilege 1844 powercfg.exe Token: SeCreatePagefilePrivilege 1844 powercfg.exe Token: SeShutdownPrivilege 4912 powercfg.exe Token: SeCreatePagefilePrivilege 4912 powercfg.exe Token: SeShutdownPrivilege 2924 powercfg.exe Token: SeCreatePagefilePrivilege 2924 powercfg.exe Token: SeShutdownPrivilege 3372 powercfg.exe Token: SeCreatePagefilePrivilege 3372 powercfg.exe Token: SeLockMemoryPrivilege 4648 dialer.exe Token: SeAssignPrimaryTokenPrivilege 2608 svchost.exe Token: SeIncreaseQuotaPrivilege 2608 svchost.exe Token: SeSecurityPrivilege 2608 svchost.exe Token: SeTakeOwnershipPrivilege 2608 svchost.exe Token: SeLoadDriverPrivilege 2608 svchost.exe Token: SeSystemtimePrivilege 2608 svchost.exe Token: SeBackupPrivilege 2608 svchost.exe Token: SeRestorePrivilege 2608 svchost.exe Token: SeShutdownPrivilege 2608 svchost.exe Token: SeSystemEnvironmentPrivilege 2608 svchost.exe Token: SeUndockPrivilege 2608 svchost.exe Token: SeManageVolumePrivilege 2608 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2608 svchost.exe Token: SeIncreaseQuotaPrivilege 2608 svchost.exe Token: SeSecurityPrivilege 2608 svchost.exe Token: SeTakeOwnershipPrivilege 2608 svchost.exe Token: SeLoadDriverPrivilege 2608 svchost.exe Token: SeSystemtimePrivilege 2608 svchost.exe Token: SeBackupPrivilege 2608 svchost.exe Token: SeRestorePrivilege 2608 svchost.exe Token: SeShutdownPrivilege 2608 svchost.exe Token: SeSystemEnvironmentPrivilege 2608 svchost.exe Token: SeUndockPrivilege 2608 svchost.exe Token: SeManageVolumePrivilege 2608 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2608 svchost.exe Token: SeIncreaseQuotaPrivilege 2608 svchost.exe Token: SeSecurityPrivilege 2608 svchost.exe Token: SeTakeOwnershipPrivilege 2608 svchost.exe Token: SeLoadDriverPrivilege 2608 svchost.exe Token: SeSystemtimePrivilege 2608 svchost.exe Token: SeBackupPrivilege 2608 svchost.exe Token: SeRestorePrivilege 2608 svchost.exe Token: SeShutdownPrivilege 2608 svchost.exe Token: SeSystemEnvironmentPrivilege 2608 svchost.exe Token: SeUndockPrivilege 2608 svchost.exe Token: SeManageVolumePrivilege 2608 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2608 svchost.exe Token: SeIncreaseQuotaPrivilege 2608 svchost.exe Token: SeSecurityPrivilege 2608 svchost.exe Token: SeTakeOwnershipPrivilege 2608 svchost.exe Token: SeLoadDriverPrivilege 2608 svchost.exe Token: SeSystemtimePrivilege 2608 svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2412 wrote to memory of 1824 2412 cmd.exe 84 PID 2412 wrote to memory of 1824 2412 cmd.exe 84 PID 224 wrote to memory of 4232 224 aimware.exe 98 PID 224 wrote to memory of 4232 224 aimware.exe 98 PID 224 wrote to memory of 4232 224 aimware.exe 98 PID 224 wrote to memory of 4232 224 aimware.exe 98 PID 224 wrote to memory of 4232 224 aimware.exe 98 PID 224 wrote to memory of 4232 224 aimware.exe 98 PID 224 wrote to memory of 4232 224 aimware.exe 98 PID 4232 wrote to memory of 636 4232 dialer.exe 5 PID 4232 wrote to memory of 684 4232 dialer.exe 7 PID 4232 wrote to memory of 996 4232 dialer.exe 12 PID 4232 wrote to memory of 424 4232 dialer.exe 13 PID 4232 wrote to memory of 760 4232 dialer.exe 14 PID 4232 wrote to memory of 680 4232 dialer.exe 15 PID 684 wrote to memory of 2564 684 lsass.exe 44 PID 684 wrote to memory of 2564 684 lsass.exe 44 PID 4232 wrote to memory of 1044 4232 dialer.exe 16 PID 4232 wrote to memory of 1052 4232 dialer.exe 17 PID 4232 wrote to memory of 1148 4232 dialer.exe 19 PID 4232 wrote to memory of 1196 4232 dialer.exe 20 PID 4232 wrote to memory of 1240 4232 dialer.exe 21 PID 4232 wrote to memory of 1284 4232 dialer.exe 22 PID 4232 wrote to memory of 1336 4232 dialer.exe 23 PID 684 wrote to memory of 2564 684 lsass.exe 44 PID 684 wrote to memory of 2564 684 lsass.exe 44 PID 684 wrote to memory of 2564 684 lsass.exe 44 PID 684 wrote to memory of 2564 684 lsass.exe 44 PID 4232 wrote to memory of 1396 4232 dialer.exe 24 PID 4232 wrote to memory of 1408 4232 dialer.exe 25 PID 4232 wrote to memory of 1440 4232 dialer.exe 26 PID 4232 wrote to memory of 1472 4232 dialer.exe 27 PID 4232 wrote to memory of 1652 4232 dialer.exe 28 PID 4232 wrote to memory of 1696 4232 dialer.exe 29 PID 4232 wrote to memory of 1724 4232 dialer.exe 30 PID 4232 wrote to memory of 1784 4232 dialer.exe 31 PID 4232 wrote to memory of 1832 4232 dialer.exe 32 PID 4232 wrote to memory of 1956 4232 dialer.exe 33 PID 4232 wrote to memory of 2000 4232 dialer.exe 34 PID 4232 wrote to memory of 2008 4232 dialer.exe 35 PID 4232 wrote to memory of 2052 4232 dialer.exe 36 PID 4232 wrote to memory of 2160 4232 dialer.exe 37 PID 4232 wrote to memory of 2276 4232 dialer.exe 39 PID 684 wrote to memory of 2564 684 lsass.exe 44 PID 684 wrote to memory of 2564 684 lsass.exe 44 PID 4232 wrote to memory of 2340 4232 dialer.exe 40 PID 4232 wrote to memory of 2464 4232 dialer.exe 41 PID 4232 wrote to memory of 2476 4232 dialer.exe 42 PID 4232 wrote to memory of 2520 4232 dialer.exe 43 PID 4232 wrote to memory of 2564 4232 dialer.exe 44 PID 4232 wrote to memory of 2588 4232 dialer.exe 45 PID 4232 wrote to memory of 2608 4232 dialer.exe 46 PID 4232 wrote to memory of 2624 4232 dialer.exe 47 PID 4232 wrote to memory of 2760 4232 dialer.exe 48 PID 4232 wrote to memory of 2964 4232 dialer.exe 50 PID 4232 wrote to memory of 3036 4232 dialer.exe 51 PID 684 wrote to memory of 2564 684 lsass.exe 44 PID 4232 wrote to memory of 720 4232 dialer.exe 52 PID 4232 wrote to memory of 3280 4232 dialer.exe 53 PID 4232 wrote to memory of 3436 4232 dialer.exe 54 PID 684 wrote to memory of 2564 684 lsass.exe 44 PID 4232 wrote to memory of 3468 4232 dialer.exe 55 PID 684 wrote to memory of 2564 684 lsass.exe 44 PID 4056 wrote to memory of 3924 4056 cmd.exe 115
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:636
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:424
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
- Suspicious use of WriteProcessMemory
PID:684
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:996
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:760
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:680
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1044
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1052
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1148
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1196
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1240
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netprofm -p -s netprofm1⤵PID:1284
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1336
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Drops file in System32 directory
PID:1396
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1408
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:2964
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1440
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1472
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1652
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1696
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵PID:1724
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1784
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1832
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:1956
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:2000
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:2008
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:2052
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:2160
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2276
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2340
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2464
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2476
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵PID:2520
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵PID:2564
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2588
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2608
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2624
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵PID:2760
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:3036
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:720
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\aimware.exe"C:\Users\Admin\AppData\Local\Temp\aimware.exe"2⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1752
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart3⤵
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart4⤵PID:1824
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc3⤵
- Launches sc.exe
PID:1996
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc3⤵
- Launches sc.exe
PID:784
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv3⤵
- Launches sc.exe
PID:3928
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits3⤵
- Launches sc.exe
PID:2868
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc3⤵
- Launches sc.exe
PID:5064
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:1528
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:4772
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:4760
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:2352
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4232
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "operaa"3⤵
- Launches sc.exe
PID:2440
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "operaa" binpath= "C:\ProgramData\opera.gx\installer.exe" start= "auto"3⤵
- Launches sc.exe
PID:2328
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog3⤵
- Launches sc.exe
PID:1868
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "operaa"3⤵
- Launches sc.exe
PID:4212 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:536
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\aimware.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:4412
-
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:3924
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3436
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵PID:3468
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3856
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3936
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵PID:3996
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:4020
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵PID:4252
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc1⤵PID:4364
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:3120
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:728
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:2088
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵PID:4972
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:1452
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵PID:4996
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:2424
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:1040
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3728
-
C:\ProgramData\opera.gx\installer.exeC:\ProgramData\opera.gx\installer.exe1⤵
- Executes dropped EXE
PID:3736 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3888 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:5036
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵PID:380
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:892
-
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:944
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:644 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:2376
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:1852
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:1932
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:2876 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:2356
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:3576
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:1844 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:4496
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2924 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:4204
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:3372 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:1964
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:4912 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:4572
-
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3952
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe2⤵PID:4144
-
-
C:\Windows\system32\dialer.exedialer.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4648
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
- Checks processor information in registry
PID:4296
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.3MB
MD50a4a28190d8424b8fb649b08df21e393
SHA1ddc5beb62651bf496e33d8be636b805f0458107c
SHA2561626b2b77cd3e63b5f78852f0d67aca413f8435eaf4674415fbde211c4c96450
SHA51211483ce4f36de6adffbf6396ce903b06f5359a47c38eba35fa599359c1e6df6a91dd599a7bf4bd3f78746f1bfd2d96cd8e001214a3f035a8cc772ae47e9ffcb4
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
3KB
MD500930b40cba79465b7a38ed0449d1449
SHA14b25a89ee28b20ba162f23772ddaf017669092a5
SHA256eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01
SHA512cbe4760ec041e7da7ab86474d5c82969cfccb8ccc5dbdac9436862d5b1b86210ab90754d3c8da5724176570d8842e57a716a281acba8719e90098a6f61a17c62