e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 01:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe
Size 223KB
Sample240524-b8pnashb86
SHA256 e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16
MD5 3955af54fbac1e43c945f447d92e4108
SHA1 53c5552c3649619e4e8c6a907b94573f47130fa4
SHA512 fa028a040a5f075296aebab7f63a59b6cbba32ee0964dfc08768396cc012ff5d861191e2478914d79d4a424c3bba110505a58b97376c44c716f0b1ea70551037
SSDEEP 3072:tneBqhy5aVLOwqI8sgwoEHXfwaNUM+/ORSs5G2Ms4f6TFZbhgvbUxzJ8Y:tETlsgOfDt+/V6JQO98
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

discovery execution exploit persistence upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 5 IoCs

resource	yara_rule
behavioral2/memory/4856-74-0x0000000140000000-0x000000014011B000-memory.dmp	UPX
behavioral2/memory/4856-86-0x000001A50B610000-0x000001A50B62F000-memory.dmp	UPX
behavioral2/memory/4856-78-0x0000000140000000-0x000000014011B000-memory.dmp	UPX
behavioral2/memory/4856-77-0x0000000140000000-0x000000014011B000-memory.dmp	UPX
behavioral2/memory/4856-75-0x0000000140000000-0x000000014011B000-memory.dmp	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
1828	takeown.exe
4844	icacls.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe

Executes dropped EXE 2 IoCs

pid	Process
4616	wmpnetwk.exe
1172	wmixedwk.exe

Loads dropped DLL 2 IoCs

pid	Process
4616	wmpnetwk.exe
1172	wmixedwk.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4844	icacls.exe
1828	takeown.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4856-74-0x0000000140000000-0x000000014011B000-memory.dmp	upx
behavioral2/memory/4856-85-0x0000000180000000-0x0000000180033000-memory.dmp	upx
behavioral2/memory/4856-84-0x0000000180000000-0x0000000180033000-memory.dmp	upx
behavioral2/memory/4856-81-0x0000000180000000-0x0000000180033000-memory.dmp	upx
behavioral2/memory/4856-78-0x0000000140000000-0x000000014011B000-memory.dmp	upx
behavioral2/memory/4856-77-0x0000000140000000-0x000000014011B000-memory.dmp	upx
behavioral2/memory/4856-75-0x0000000140000000-0x000000014011B000-memory.dmp	upx
behavioral2/memory/4856-73-0x0000000140000000-0x000000014011B000-memory.dmp	upx

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\1640.hecate	svchost.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\4616.hecate	svchost.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\3980.hecate	svchost.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\4856.hecate	svchost.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\4488.hecate	svchost.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\info	svchost.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\1592.hecate	svchost.exe

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 1172 set thread context of 2096	1172	wmixedwk.exe	104
PID 2096 set thread context of 4856	2096	svchost.exe	105
PID 2096 set thread context of 2816	2096	svchost.exe	106
PID 2096 set thread context of 4488	2096	svchost.exe	108
PID 2096 set thread context of 1592	2096	svchost.exe	118
PID 2096 set thread context of 1640	2096	svchost.exe	120
PID 2096 set thread context of 4616	2096	svchost.exe	121
PID 2096 set thread context of 3980	2096	svchost.exe	128

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Media Player\ppqqxpb	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\ppqqxpb	svchost.exe
File created	C:\Program Files\Windows Media Player\wmpnetwk.exe	e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe
File opened for modification	C:\Program Files\Windows Media Player\mpsvc.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\ppqqxpb	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\ppqqxpp	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\ppqqxpa	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\ppqqxpb	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\ppqqxpb	svchost.exe
File created	C:\Program Files\Windows Media Player\background.jpg	e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe
File created	C:\Program Files\Windows Media Player\mpsvc.dll	e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe
File created	C:\Program Files\Windows Media Player\wmixedwk.exe	e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe
File opened for modification	C:\Program Files\Windows Media Player\wmixedwk.exe	e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe
File opened for modification	C:\Program Files\Windows Media Player\ppqqxds	svchost.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2440	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007c33a59f7cadda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009c1cef9f7cadda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007c33a59f7cadda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000022ab7c9f7cadda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000815347a07cadda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000088a7d99f7cadda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dbd1839f7cadda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\yzzg	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003120929f7cadda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4600	PING.EXE

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1828	takeown.exe
Token: 33	1680	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1680	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1680	SearchIndexer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 3468	4256	e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe	97
PID 4256 wrote to memory of 3468	4256	e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe	97
PID 3468 wrote to memory of 1828	3468	cmd.exe	99
PID 3468 wrote to memory of 1828	3468	cmd.exe	99
PID 3468 wrote to memory of 4844	3468	cmd.exe	100
PID 3468 wrote to memory of 4844	3468	cmd.exe	100
PID 1172 wrote to memory of 2096	1172	wmixedwk.exe	104
PID 1172 wrote to memory of 2096	1172	wmixedwk.exe	104
PID 1172 wrote to memory of 2096	1172	wmixedwk.exe	104
PID 1172 wrote to memory of 2096	1172	wmixedwk.exe	104
PID 1172 wrote to memory of 2096	1172	wmixedwk.exe	104
PID 1172 wrote to memory of 2096	1172	wmixedwk.exe	104
PID 1172 wrote to memory of 2096	1172	wmixedwk.exe	104
PID 1172 wrote to memory of 2096	1172	wmixedwk.exe	104
PID 1172 wrote to memory of 2096	1172	wmixedwk.exe	104
PID 1172 wrote to memory of 2096	1172	wmixedwk.exe	104
PID 1172 wrote to memory of 2096	1172	wmixedwk.exe	104
PID 2096 wrote to memory of 4856	2096	svchost.exe	105
PID 2096 wrote to memory of 4856	2096	svchost.exe	105
PID 2096 wrote to memory of 4856	2096	svchost.exe	105
PID 2096 wrote to memory of 4856	2096	svchost.exe	105
PID 2096 wrote to memory of 4856	2096	svchost.exe	105
PID 2096 wrote to memory of 4856	2096	svchost.exe	105
PID 2096 wrote to memory of 4856	2096	svchost.exe	105
PID 2096 wrote to memory of 2816	2096	svchost.exe	106
PID 2096 wrote to memory of 2816	2096	svchost.exe	106
PID 4256 wrote to memory of 4940	4256	e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe	107
PID 4256 wrote to memory of 4940	4256	e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe	107
PID 2096 wrote to memory of 2816	2096	svchost.exe	106
PID 2096 wrote to memory of 2816	2096	svchost.exe	106
PID 2096 wrote to memory of 2816	2096	svchost.exe	106
PID 2096 wrote to memory of 2816	2096	svchost.exe	106
PID 2096 wrote to memory of 2816	2096	svchost.exe	106
PID 2096 wrote to memory of 2816	2096	svchost.exe	106
PID 2096 wrote to memory of 2816	2096	svchost.exe	106
PID 2096 wrote to memory of 2816	2096	svchost.exe	106
PID 2096 wrote to memory of 2816	2096	svchost.exe	106
PID 2096 wrote to memory of 4488	2096	svchost.exe	108
PID 2096 wrote to memory of 4488	2096	svchost.exe	108
PID 2096 wrote to memory of 4488	2096	svchost.exe	108
PID 2096 wrote to memory of 4488	2096	svchost.exe	108
PID 2096 wrote to memory of 4488	2096	svchost.exe	108
PID 2096 wrote to memory of 4488	2096	svchost.exe	108
PID 2096 wrote to memory of 4488	2096	svchost.exe	108
PID 4256 wrote to memory of 1220	4256	e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe	110
PID 4256 wrote to memory of 1220	4256	e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe	110
PID 4940 wrote to memory of 2440	4940	cmd.exe	112
PID 4940 wrote to memory of 2440	4940	cmd.exe	112
PID 1220 wrote to memory of 4600	1220	cmd.exe	113
PID 1220 wrote to memory of 4600	1220	cmd.exe	113
PID 1680 wrote to memory of 4508	1680	SearchIndexer.exe	114
PID 1680 wrote to memory of 4508	1680	SearchIndexer.exe	114
PID 1680 wrote to memory of 1104	1680	SearchIndexer.exe	115
PID 1680 wrote to memory of 1104	1680	SearchIndexer.exe	115
PID 2096 wrote to memory of 1592	2096	svchost.exe	118
PID 2096 wrote to memory of 1592	2096	svchost.exe	118
PID 2096 wrote to memory of 1592	2096	svchost.exe	118
PID 2096 wrote to memory of 1592	2096	svchost.exe	118
PID 2096 wrote to memory of 1592	2096	svchost.exe	118
PID 2096 wrote to memory of 1592	2096	svchost.exe	118
PID 2096 wrote to memory of 1592	2096	svchost.exe	118
PID 2096 wrote to memory of 1640	2096	svchost.exe	120
PID 2096 wrote to memory of 1640	2096	svchost.exe	120
PID 2096 wrote to memory of 1640	2096	svchost.exe	120

C:\Users\Admin\AppData\Local\Temp\e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe
"C:\Users\Admin\AppData\Local\Temp\e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd /c takeown /f "C:\Program Files\Windows Media Player\wmpnetwk.exe" && icacls "C:\Program Files\Windows Media Player\wmpnetwk.exe" /grant administrators:F
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3468
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Program Files\Windows Media Player\wmpnetwk.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:1828
- - C:\Windows\system32\icacls.exe
    icacls "C:\Program Files\Windows Media Player\wmpnetwk.exe" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4844
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd /c sc create "Accecss Auto Connetcion Manager" binPath= "C:\Program Files\Windows Media Player\wmixedwk.exe" START= auto DISPLAYNAME= "WebServer" TYPE= own
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Windows\system32\sc.exe
    sc create "Accecss Auto Connetcion Manager" binPath= "C:\Program Files\Windows Media Player\wmixedwk.exe" START= auto DISPLAYNAME= "WebServer" TYPE= own
    3⤵
    - Launches sc.exe
    PID:2440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\kkxqbh.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1220
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - Runs ping.exe
    PID:4600

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4508
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1104

C:\Program Files\Windows Media Player\wmpnetwk.exe
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4616

C:\Program Files\Windows Media Player\wmixedwk.exe
"C:\Program Files\Windows Media Player\wmixedwk.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Modifies data under HKEY_USERS
    PID:4856
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Drops file in Program Files directory
    - Modifies data under HKEY_USERS
    PID:2816
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Drops file in System32 directory
    - Drops file in Program Files directory
    PID:4488
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Drops file in System32 directory
    - Drops file in Program Files directory
    PID:1592
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Drops file in System32 directory
    - Drops file in Program Files directory
    PID:1640
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Drops file in System32 directory
    - Drops file in Program Files directory
    PID:4616
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Drops file in System32 directory
    - Drops file in Program Files directory
    PID:3980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

background.jpg

Path C:\Program Files\Windows Media Player\background.jpg
Size 1.9MB
SHA256 9f8f9457950e10770f96239f3fbcc35239b3459456c992b51a80c50d257acb36
MD5 e37e46d9eb3834d3e8845166e1828568
SHA1 a875d07db50b10131a5c3675501de2d805e742a1
SHA512 7b95e1e861bece9b5cb7205b52edbe2230b883e76c8188c41107a116e987f122e80a5299c595a692127e42663fddedd27df9074f70b1836d6c305e855bce2021
SSDEEP 49152:r8Bu6jeTAcNmspkiTYh2zmlr7hT91hoavGtHJBpCbqag/8PTUC:wBDC7VpNYhu2PhTXh78aq8b
MD5 SHA1 SHA512 SSDEEP

Submit Download

mpsvc.dll

Path C:\Program Files\Windows Media Player\mpsvc.dll
Size 126KB
SHA256 757af7a540628004b446117be432342674f7830fa008f97a5f4a1ac386954bc2
MD5 7b207ce9f9d71dfc2eaa2e959634a54d
SHA1 8222daa0c820e50d02ffabdc55dfb7461bbaa1e5
SHA512 6ffbe6e33768e2fbea8c7cee428eb4b61e3eb1dd12e470de363f1d6e274296adabc8d1e681fe5a5f2b1dc8e8eb08bd360572bfd34706e82580c51be57f6fcf5a
SSDEEP 3072:+RnA1GUOnO1sQ6cbdAZuQ8khkuydvahEMXEqfW:ZGUOnO1sQ6cbSD80kukvcf
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 23KB
SHA256 ed0dc979eed9ab9933c49204d362de575c7112a792633fda75bb5d1dab50a5c2
MD5 90b85ffbdeead1be861d59134ea985b0
SHA1 55e9859aa7dba87678e7c529b571fdf6b7181339
SHA512 8a1c10bbfe5651ab25bf36f4e8f2f65424c8e1004696c8141498b99ea2fbd7b3e5fae4d2cfee6835f7ff46bd2333602f4d8ac4a0f5b8e9757adb176332a3afce
SSDEEP 384:P+5qcWB2iWZ1q//0GftpBjWfbtxO4HRN7k3ayeleAp8xlqSvmaI0:G4Sm8iUekkIpKZV
MD5 SHA1 SHA512 SSDEEP

Submit Download

aad9f05a9a826b65ff2b94740ca196c2

Path C:\Windows\Temp\aad9f05a9a826b65ff2b94740ca196c2
Size 53KB
SHA256 b2fa9ff616235af2fbdd992cc7e1e783f2248ccdc31d7ecea63182dc6009d436
MD5 a0a1e5badb37befefb8ee3ea3dffddb2
SHA1 43d25b7cee752c1a50227270bbffab1249b4034d
SHA512 c400ea17645ca3650562a272b5cd3b5f4ea6821d534c8eb49d63a996033aedeeeab9b30f19156cc6609f0b058af98c2e9b2386f506f06ab1376becc6bc7cc9bb
SSDEEP 768:5hxNOPh1oUytk0l1IeLSpumGBfi9N4EjP9HKISAJ4w2Kxub+Bd/rc/y/by0N:5crSdl1NH05jPQMLub6djcIby0N
MD5 SHA1 SHA512 SSDEEP

Submit Download

kkxqbh.bat

Path C:\kkxqbh.bat
Size 135B
SHA256 471ff503db8bd1d39701d587ec4f2d3c97c2843a53e812fe726c970f7306fbb4
MD5 44a3af72a2e7efad7f05b5b264f2b133
SHA1 cfd7c8451a0c6e8123328b18f96bec50d04b50ab
SHA512 3d2009c7d4b82fd970ced78fe97b0d5ed08ca7a33480969deb5345195e50877e5efe8f80eeca86c63c5f87cc3779f7f9aba47eb1cca1c29656cb4f74bfd4e14a
MD5 SHA1 SHA512

Submit Download

memory/1680-19-0x0000017592BB0000-0x0000017592BC0000-memory.dmp

Download

memory/1680-35-0x0000017592CB0000-0x0000017592CC0000-memory.dmp

Download

memory/1680-51-0x00000175971A0000-0x00000175971A8000-memory.dmp

Download

memory/2096-72-0x0000000140000000-0x0000000140026000-memory.dmp

Download

memory/2096-69-0x0000000140000000-0x0000000140026000-memory.dmp

Download

memory/2096-71-0x0000000140000000-0x0000000140026000-memory.dmp

Download

memory/2096-63-0x0000000140000000-0x0000000140026000-memory.dmp

Download

memory/2096-64-0x0000000140000000-0x0000000140026000-memory.dmp

Download

memory/2096-65-0x0000000140000000-0x0000000140026000-memory.dmp

Download

memory/2096-66-0x0000000140000000-0x0000000140026000-memory.dmp

Download

memory/2096-67-0x0000000140000000-0x0000000140026000-memory.dmp

Download

memory/2096-68-0x0000000140000000-0x0000000140026000-memory.dmp

Download

memory/4256-5-0x00007FF6FEFB0000-0x00007FF6FEFEC000-memory.dmp

Download

memory/4256-0-0x00007FF6FEFBD000-0x00007FF6FEFBF000-memory.dmp

Download

memory/4256-3-0x0000023A47390000-0x0000023A473BC000-memory.dmp

Download

memory/4856-85-0x0000000180000000-0x0000000180033000-memory.dmp

Download

memory/4856-73-0x0000000140000000-0x000000014011B000-memory.dmp

Download

memory/4856-75-0x0000000140000000-0x000000014011B000-memory.dmp

Download

memory/4856-77-0x0000000140000000-0x000000014011B000-memory.dmp

Download

memory/4856-78-0x0000000140000000-0x000000014011B000-memory.dmp

Download

memory/4856-81-0x0000000180000000-0x0000000180033000-memory.dmp

Download

memory/4856-84-0x0000000180000000-0x0000000180033000-memory.dmp

Download

memory/4856-86-0x000001A50B610000-0x000001A50B62F000-memory.dmp

Download

memory/4856-91-0x000001A50B630000-0x000001A50B6E6000-memory.dmp

Download

memory/4856-74-0x0000000140000000-0x000000014011B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads