3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 326KB
Sample240520-vtp53aab73
SHA256 3b50fe74f6b83d53efab2ee7e197026977dac17fdd3302c7df454fac19abb12d
MD5 a59664f37c25edaa69c39a65490ed3a9
SHA1 01bb46541bc678fe9d97cea31cb61f3db861ba68
SHA512 76ba5fea9e63bf091ac2f2234447ad48c93b1b21594fd2c737d24073efc2871265c83622364764c886769d579c727784c045d3d4b2fc0a6e778dc30e64f1f393
SSDEEP 6144:Rj8KWXflIwycVYUcBrcisb765kohreOCSYA/U:+Kkfl3x0BrcdEkoWCc
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery exploit upx

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
5004	takeown.exe
3628	icacls.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	file.exe

Executes dropped EXE 2 IoCs

pid	Process
1656	wmpnetwk.exe
1828	wmixedwk.exe

Loads dropped DLL 2 IoCs

pid	Process
1656	wmpnetwk.exe
1828	wmixedwk.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5004	takeown.exe
3628	icacls.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1624-79-0x0000000140000000-0x000000014011B000-memory.dmp	upx
behavioral2/memory/1624-78-0x0000000140000000-0x000000014011B000-memory.dmp	upx
behavioral2/memory/1624-83-0x0000000140000000-0x000000014011B000-memory.dmp	upx
behavioral2/memory/1624-88-0x0000000180000000-0x0000000180033000-memory.dmp	upx
behavioral2/memory/1624-87-0x0000000180000000-0x0000000180033000-memory.dmp	upx
behavioral2/memory/1624-82-0x0000000140000000-0x000000014011B000-memory.dmp	upx
behavioral2/memory/1624-80-0x0000000140000000-0x000000014011B000-memory.dmp	upx
behavioral2/memory/1624-84-0x0000000180000000-0x0000000180033000-memory.dmp	upx

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\4332.hecate	svchost.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\1452.hecate	svchost.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\5104.hecate	svchost.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\1956.hecate	svchost.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\3308.hecate	svchost.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\5088.hecate	svchost.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\228.hecate	svchost.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\1624.hecate	svchost.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\3740.hecate	svchost.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\560.hecate	svchost.exe

Suspicious use of SetThreadContext 12 IoCs

description	pid	Process	procid_target
PID 1828 set thread context of 2088	1828	wmixedwk.exe	101
PID 2088 set thread context of 1624	2088	svchost.exe	102
PID 2088 set thread context of 1080	2088	svchost.exe	103
PID 2088 set thread context of 1452	2088	svchost.exe	104
PID 2088 set thread context of 5104	2088	svchost.exe	109
PID 2088 set thread context of 3740	2088	svchost.exe	110
PID 2088 set thread context of 560	2088	svchost.exe	112
PID 2088 set thread context of 3308	2088	svchost.exe	113
PID 2088 set thread context of 1956	2088	svchost.exe	114
PID 2088 set thread context of 5088	2088	svchost.exe	118
PID 2088 set thread context of 228	2088	svchost.exe	122
PID 2088 set thread context of 4332	2088	svchost.exe	123

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Media Player\wmixedwk.exe	file.exe
File opened for modification	C:\Program Files\Windows Media Player\ppqqxpp	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\ppqqxpp	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\ppqqxpp	svchost.exe
File created	C:\Program Files\Windows Media Player\background.jpg	file.exe
File created	C:\Program Files\Windows Media Player\wmpnetwk.exe	file.exe
File created	C:\Program Files\Windows Media Player\wmixedwk.exe	file.exe
File opened for modification	C:\Program Files\Windows Media Player\ppqqxpp	svchost.exe
File created	C:\Program Files\Windows Media Player\mpsvc.dll	file.exe
File opened for modification	C:\Program Files\Windows Media Player\ppqqxpa	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\ppqqxpp	svchost.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\ppqqxpb	svchost.exe
File opened for modification	\??\c:\windows\ppqqxpb	svchost.exe
File opened for modification	\??\c:\windows\ppqqxpb	svchost.exe
File opened for modification	\??\c:\windows\ppqqxpb	svchost.exe
File opened for modification	\??\c:\windows\ppqqxpb	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\yzzg\c = "㤸7"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f4cc8c98d9aada01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cc06a798d9aada01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e7919198d9aada01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009405c698d9aada01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\yzzg	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a8501299d9aada01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009f69a998d9aada01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e2ba7998d9aada01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5004	takeown.exe
Token: 33	3008	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3008	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3008	SearchIndexer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 3000	2216	file.exe	94
PID 2216 wrote to memory of 3000	2216	file.exe	94
PID 3000 wrote to memory of 5004	3000	cmd.exe	96
PID 3000 wrote to memory of 5004	3000	cmd.exe	96
PID 3000 wrote to memory of 3628	3000	cmd.exe	97
PID 3000 wrote to memory of 3628	3000	cmd.exe	97
PID 1828 wrote to memory of 2088	1828	wmixedwk.exe	101
PID 1828 wrote to memory of 2088	1828	wmixedwk.exe	101
PID 1828 wrote to memory of 2088	1828	wmixedwk.exe	101
PID 1828 wrote to memory of 2088	1828	wmixedwk.exe	101
PID 1828 wrote to memory of 2088	1828	wmixedwk.exe	101
PID 1828 wrote to memory of 2088	1828	wmixedwk.exe	101
PID 1828 wrote to memory of 2088	1828	wmixedwk.exe	101
PID 1828 wrote to memory of 2088	1828	wmixedwk.exe	101
PID 1828 wrote to memory of 2088	1828	wmixedwk.exe	101
PID 1828 wrote to memory of 2088	1828	wmixedwk.exe	101
PID 1828 wrote to memory of 2088	1828	wmixedwk.exe	101
PID 2088 wrote to memory of 1624	2088	svchost.exe	102
PID 2088 wrote to memory of 1624	2088	svchost.exe	102
PID 2088 wrote to memory of 1624	2088	svchost.exe	102
PID 2088 wrote to memory of 1624	2088	svchost.exe	102
PID 2088 wrote to memory of 1624	2088	svchost.exe	102
PID 2088 wrote to memory of 1624	2088	svchost.exe	102
PID 2088 wrote to memory of 1624	2088	svchost.exe	102
PID 2088 wrote to memory of 1080	2088	svchost.exe	103
PID 2088 wrote to memory of 1080	2088	svchost.exe	103
PID 2088 wrote to memory of 1080	2088	svchost.exe	103
PID 2088 wrote to memory of 1080	2088	svchost.exe	103
PID 2088 wrote to memory of 1080	2088	svchost.exe	103
PID 2088 wrote to memory of 1080	2088	svchost.exe	103
PID 2088 wrote to memory of 1080	2088	svchost.exe	103
PID 2088 wrote to memory of 1080	2088	svchost.exe	103
PID 2088 wrote to memory of 1080	2088	svchost.exe	103
PID 2088 wrote to memory of 1080	2088	svchost.exe	103
PID 2088 wrote to memory of 1080	2088	svchost.exe	103
PID 2088 wrote to memory of 1452	2088	svchost.exe	104
PID 2088 wrote to memory of 1452	2088	svchost.exe	104
PID 2088 wrote to memory of 1452	2088	svchost.exe	104
PID 2088 wrote to memory of 1452	2088	svchost.exe	104
PID 2088 wrote to memory of 1452	2088	svchost.exe	104
PID 2088 wrote to memory of 1452	2088	svchost.exe	104
PID 2088 wrote to memory of 1452	2088	svchost.exe	104
PID 3008 wrote to memory of 4120	3008	SearchIndexer.exe	105
PID 3008 wrote to memory of 4120	3008	SearchIndexer.exe	105
PID 3008 wrote to memory of 2628	3008	SearchIndexer.exe	106
PID 3008 wrote to memory of 2628	3008	SearchIndexer.exe	106
PID 2088 wrote to memory of 5104	2088	svchost.exe	109
PID 2088 wrote to memory of 5104	2088	svchost.exe	109
PID 2088 wrote to memory of 5104	2088	svchost.exe	109
PID 2088 wrote to memory of 5104	2088	svchost.exe	109
PID 2088 wrote to memory of 5104	2088	svchost.exe	109
PID 2088 wrote to memory of 5104	2088	svchost.exe	109
PID 2088 wrote to memory of 5104	2088	svchost.exe	109
PID 2088 wrote to memory of 3740	2088	svchost.exe	110
PID 2088 wrote to memory of 3740	2088	svchost.exe	110
PID 2088 wrote to memory of 3740	2088	svchost.exe	110
PID 2088 wrote to memory of 3740	2088	svchost.exe	110
PID 2088 wrote to memory of 3740	2088	svchost.exe	110
PID 2088 wrote to memory of 3740	2088	svchost.exe	110
PID 2088 wrote to memory of 3740	2088	svchost.exe	110
PID 2088 wrote to memory of 560	2088	svchost.exe	112
PID 2088 wrote to memory of 560	2088	svchost.exe	112
PID 2088 wrote to memory of 560	2088	svchost.exe	112
PID 2088 wrote to memory of 560	2088	svchost.exe	112

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd /c takeown /f "C:\Program Files\Windows Media Player\wmpnetwk.exe" && icacls "C:\Program Files\Windows Media Player\wmpnetwk.exe" /grant administrators:F
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Program Files\Windows Media Player\wmpnetwk.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:5004
- - C:\Windows\system32\icacls.exe
    icacls "C:\Program Files\Windows Media Player\wmpnetwk.exe" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3628

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4120
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 804 808 816 8192 812 788
  2⤵
  - Modifies data under HKEY_USERS
  PID:2628

C:\Program Files\Windows Media Player\wmpnetwk.exe
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656

C:\Program Files\Windows Media Player\wmixedwk.exe
"C:\Program Files\Windows Media Player\wmixedwk.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2088
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Drops file in System32 directory
    - Drops file in Program Files directory
    PID:1624
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Drops file in Program Files directory
    - Modifies data under HKEY_USERS
    PID:1080
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:1452
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Drops file in System32 directory
    - Drops file in Program Files directory
    PID:5104
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:3740
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Drops file in System32 directory
    - Drops file in Program Files directory
    PID:560
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:3308
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Drops file in System32 directory
    - Drops file in Program Files directory
    PID:1956
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:5088
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Drops file in System32 directory
    - Drops file in Program Files directory
    PID:228
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:4332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

background.jpg

Path C:\Program Files\Windows Media Player\background.jpg
Size 1.9MB
SHA256 ac4c16749c6d77dd153327c18c4bf6d48c8268efcbbb9d0515ea582e0fed19d2
MD5 2ae78a18e71d4696964e021f3241287a
SHA1 562ac6a611ef5b44abd61db261a11289950f7efb
SHA512 a7d1bcee4296fa1569d401b1886022da2384a33080baa1ab82cf86ff708351fe3784297d9e104927b7f581ad351bc7c900db5953e22dbd262ce76b9ee62c11ca
SSDEEP 49152:r8muDxB4WPmoVqwiTYjLJq3LSjnQHwPiQ4a/X31D1+:wmGxyoVqxYRq3GjyPa/3d
MD5 SHA1 SHA512 SSDEEP

Submit Download

mpsvc.dll

Path C:\Program Files\Windows Media Player\mpsvc.dll
Size 126KB
SHA256 1ec23649104d52fe4bd81868896ace1860c2b579c07b1ff3ae8bf9b544cf093d
MD5 51835bc0013021fac02572d2a4f371c3
SHA1 1c5dc6300992e0410a469280c7384d2dee1033f0
SHA512 beb67411146a72c610a298547e86934ef48258d9caaa0f7c024a9914d0e010dde5ddd9699e25baddbbe0c6b9cb3d43124de3673c4bae4fe45f61d7d7f0f99f68
SSDEEP 3072:IRnA1GUOnO1sQ6cbdAZuQ8khkuydvahEMcEqfW:LGUOnO1sQ6cbSD80kukvLf
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 23KB
SHA256 ed0dc979eed9ab9933c49204d362de575c7112a792633fda75bb5d1dab50a5c2
MD5 90b85ffbdeead1be861d59134ea985b0
SHA1 55e9859aa7dba87678e7c529b571fdf6b7181339
SHA512 8a1c10bbfe5651ab25bf36f4e8f2f65424c8e1004696c8141498b99ea2fbd7b3e5fae4d2cfee6835f7ff46bd2333602f4d8ac4a0f5b8e9757adb176332a3afce
SSDEEP 384:P+5qcWB2iWZ1q//0GftpBjWfbtxO4HRN7k3ayeleAp8xlqSvmaI0:G4Sm8iUekkIpKZV
MD5 SHA1 SHA512 SSDEEP

Submit Download

aad9f05a9a826b65ff2b94740ca196c2

Path C:\Windows\Temp\aad9f05a9a826b65ff2b94740ca196c2
Size 28KB
SHA256 3d8aee8a0c95d9a3532c6d1cb8dc6b123e046310086690b74221cd3c815b1559
MD5 f1e16cd4d890121e2ffdf2303842754c
SHA1 c17308591eb92da532cea5124bf9e79edec234c5
SHA512 056f01052ef517f555bc7da9b758c1b05c7fa531012cb74f992dc70f96ced8c719fb7801273c6dc1f949a3dec12c0dc16e6aacf1705dfca507ae96f659d45518
SSDEEP 384:7q+lOTWZqvrJ0hRVfmjWTa72PCyvXOH32RaNVTvoi0fzNZNbS:7CTXihRvxPO9NhQiuz3FS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1624-87-0x0000000180000000-0x0000000180033000-memory.dmp

Download

memory/1624-82-0x0000000140000000-0x000000014011B000-memory.dmp

Download

memory/1624-80-0x0000000140000000-0x000000014011B000-memory.dmp

Download

memory/1624-84-0x0000000180000000-0x0000000180033000-memory.dmp

Download

memory/1624-88-0x0000000180000000-0x0000000180033000-memory.dmp

Download

memory/1624-89-0x000001B4B3580000-0x000001B4B359F000-memory.dmp

Download

memory/1624-83-0x0000000140000000-0x000000014011B000-memory.dmp

Download

memory/1624-78-0x0000000140000000-0x000000014011B000-memory.dmp

Download

memory/1624-79-0x0000000140000000-0x000000014011B000-memory.dmp

Download

memory/1656-75-0x00007FFF11490000-0x00007FFF114B6000-memory.dmp

Download

memory/1828-74-0x00007FFF11490000-0x00007FFF114B6000-memory.dmp

Download

memory/2088-73-0x0000000140000000-0x0000000140026000-memory.dmp

Download

memory/2088-67-0x0000000140000000-0x0000000140026000-memory.dmp

Download

memory/2088-69-0x0000000140000000-0x0000000140026000-memory.dmp

Download

memory/2088-68-0x0000000140000000-0x0000000140026000-memory.dmp

Download

memory/2088-70-0x0000000140000000-0x0000000140026000-memory.dmp

Download

memory/2088-72-0x0000000140000000-0x0000000140026000-memory.dmp

Download

memory/2088-66-0x0000000140000000-0x0000000140026000-memory.dmp

Download

memory/2088-64-0x0000000140000000-0x0000000140026000-memory.dmp

Download

memory/2088-65-0x0000000140000000-0x0000000140026000-memory.dmp

Download

memory/2216-76-0x000001D75BA20000-0x000001D75BA49000-memory.dmp

Download

memory/2216-0-0x00007FF6749EA000-0x00007FF6749EB000-memory.dmp

Download

memory/2216-5-0x00007FF6749D0000-0x00007FF674A26000-memory.dmp

Download

memory/2216-3-0x000001D75BA20000-0x000001D75BA49000-memory.dmp

Download

memory/3008-52-0x0000017458FB0000-0x0000017458FB8000-memory.dmp

Download

memory/3008-35-0x0000017454AC0000-0x0000017454AD0000-memory.dmp

Download

memory/3008-19-0x00000174549C0000-0x00000174549D0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads