e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16

General

Target

e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe
Size

223KB
MD5

3955af54fbac1e43c945f447d92e4108
SHA1

53c5552c3649619e4e8c6a907b94573f47130fa4
SHA256

e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16
SHA512

fa028a040a5f075296aebab7f63a59b6cbba32ee0964dfc08768396cc012ff5d861191e2478914d79d4a424c3bba110505a58b97376c44c716f0b1ea70551037
SSDEEP

3072:tneBqhy5aVLOwqI8sgwoEHXfwaNUM+/ORSs5G2Ms4f6TFZbhgvbUxzJ8Y:tETlsgOfDt+/V6JQO98

Score

8^/10

discovery execution exploit persistence upx

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Possible privilege escalation attempt 2 IoCs
exploit

Processes:

takeown.exeicacls.exe

pid process

2044 takeown.exe
5092 icacls.exe

pid	process
2044	takeown.exe
5092	icacls.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe

Executes dropped EXE 2 IoCs

Processes:

wmpnetwk.exewmixedwk.exe

pid process

2388 wmpnetwk.exe
4696 wmixedwk.exe
Loads dropped DLL 2 IoCs

Processes:

wmpnetwk.exewmixedwk.exe

pid process

2388 wmpnetwk.exe
4696 wmixedwk.exe
Modifies file permissions 1 TTPs 2 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exetakeown.exe

pid process

5092 icacls.exe
2044 takeown.exe

pid	process
2388	wmpnetwk.exe
4696	wmixedwk.exe

pid	process
2388	wmpnetwk.exe
4696	wmixedwk.exe

pid	process
5092	icacls.exe
2044	takeown.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2284-79-0x0000000140000000-0x000000014011B000-memory.dmp	upx
behavioral2/memory/2284-84-0x0000000180000000-0x0000000180033000-memory.dmp	upx
behavioral2/memory/2284-83-0x0000000180000000-0x0000000180033000-memory.dmp	upx
behavioral2/memory/2284-80-0x0000000180000000-0x0000000180033000-memory.dmp	upx
behavioral2/memory/2284-78-0x0000000140000000-0x000000014011B000-memory.dmp	upx
behavioral2/memory/2284-76-0x0000000140000000-0x000000014011B000-memory.dmp	upx
behavioral2/memory/2284-75-0x0000000140000000-0x000000014011B000-memory.dmp	upx
behavioral2/memory/2284-74-0x0000000140000000-0x000000014011B000-memory.dmp	upx

Drops file in System32 directory 13 IoCs

Processes:

svchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\3596.hecate	svchost.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\812.hecate	svchost.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\4944.hecate	svchost.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\1596.hecate	svchost.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\3172.hecate	svchost.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\5112.hecate	svchost.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\2284.hecate	svchost.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\4076.hecate	svchost.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\info	svchost.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\2852.hecate	svchost.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\4748.hecate	svchost.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\1732.hecate	svchost.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\2388.hecate	svchost.exe

Suspicious use of SetThreadContext 14 IoCs

Processes:

wmixedwk.exesvchost.exe

description	pid	process	target process
PID 4696 set thread context of 4900	4696	wmixedwk.exe	svchost.exe
PID 4900 set thread context of 2284	4900	svchost.exe	svchost.exe
PID 4900 set thread context of 4048	4900	svchost.exe	svchost.exe
PID 4900 set thread context of 4944	4900	svchost.exe	svchost.exe
PID 4900 set thread context of 4076	4900	svchost.exe	svchost.exe
PID 4900 set thread context of 3596	4900	svchost.exe	svchost.exe
PID 4900 set thread context of 1596	4900	svchost.exe	svchost.exe
PID 4900 set thread context of 3172	4900	svchost.exe	svchost.exe
PID 4900 set thread context of 2852	4900	svchost.exe	svchost.exe
PID 4900 set thread context of 5112	4900	svchost.exe	svchost.exe
PID 4900 set thread context of 4748	4900	svchost.exe	svchost.exe
PID 4900 set thread context of 812	4900	svchost.exe	svchost.exe
PID 4900 set thread context of 1732	4900	svchost.exe	svchost.exe
PID 4900 set thread context of 2388	4900	svchost.exe	svchost.exe

Drops file in Program Files directory 20 IoCs

Processes:

e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exe

description	ioc	process
File opened for modification	C:\Program Files\Windows Media Player\wmixedwk.exe	e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe
File opened for modification	C:\Program Files\Windows Media Player\ppqqxpb	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\ppqqxpb	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\ppqqxpb	svchost.exe
File created	C:\Program Files\Windows Media Player\background.jpg	e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe
File created	C:\Program Files\Windows Media Player\wmpnetwk.exe	e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe
File opened for modification	C:\Program Files\Windows Media Player\mpsvc.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\ppqqxpb	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\ppqqxpb	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\ppqqxpb	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\ppqqxpb	svchost.exe
File created	C:\Program Files\Windows Media Player\wmixedwk.exe	e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe
File opened for modification	C:\Program Files\Windows Media Player\ppqqxds	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\ppqqxpp	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\ppqqxpa	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\ppqqxpb	svchost.exe
File created	C:\Program Files\Windows Media Player\mpsvc.dll	e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe
File opened for modification	C:\Program Files\Windows Media Player\ppqqxpb	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\ppqqxpb	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\ppqqxpb	svchost.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

2032 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2032	sc.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

SearchIndexer.exeSearchProtocolHost.exesvchost.exesvchost.exeSearchFilterHost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\yzzg	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001b5df69380adda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000041c2ba9380adda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000054aec69380adda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000a7d989480adda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3392 PING.EXE

pid	process
3392	PING.EXE

Suspicious use of AdjustPrivilegeToken 27 IoCs

Processes:

takeown.exeSearchIndexer.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	2044	takeown.exe
Token: 33	4908	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.execmd.exewmixedwk.exesvchost.execmd.execmd.exeSearchIndexer.exe

description	pid	process	target process
PID 1144 wrote to memory of 1088	1144	e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe	cmd.exe
PID 1144 wrote to memory of 1088	1144	e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe	cmd.exe
PID 1088 wrote to memory of 2044	1088	cmd.exe	takeown.exe
PID 1088 wrote to memory of 2044	1088	cmd.exe	takeown.exe
PID 1088 wrote to memory of 5092	1088	cmd.exe	icacls.exe
PID 1088 wrote to memory of 5092	1088	cmd.exe	icacls.exe
PID 4696 wrote to memory of 4900	4696	wmixedwk.exe	svchost.exe
PID 4696 wrote to memory of 4900	4696	wmixedwk.exe	svchost.exe
PID 4696 wrote to memory of 4900	4696	wmixedwk.exe	svchost.exe
PID 4696 wrote to memory of 4900	4696	wmixedwk.exe	svchost.exe
PID 4696 wrote to memory of 4900	4696	wmixedwk.exe	svchost.exe
PID 4696 wrote to memory of 4900	4696	wmixedwk.exe	svchost.exe
PID 4696 wrote to memory of 4900	4696	wmixedwk.exe	svchost.exe
PID 4696 wrote to memory of 4900	4696	wmixedwk.exe	svchost.exe
PID 4696 wrote to memory of 4900	4696	wmixedwk.exe	svchost.exe
PID 4696 wrote to memory of 4900	4696	wmixedwk.exe	svchost.exe
PID 4696 wrote to memory of 4900	4696	wmixedwk.exe	svchost.exe
PID 1144 wrote to memory of 2128	1144	e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe	cmd.exe
PID 1144 wrote to memory of 2128	1144	e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe	cmd.exe
PID 4900 wrote to memory of 2284	4900	svchost.exe	svchost.exe
PID 4900 wrote to memory of 2284	4900	svchost.exe	svchost.exe
PID 4900 wrote to memory of 2284	4900	svchost.exe	svchost.exe
PID 4900 wrote to memory of 2284	4900	svchost.exe	svchost.exe
PID 4900 wrote to memory of 2284	4900	svchost.exe	svchost.exe
PID 4900 wrote to memory of 2284	4900	svchost.exe	svchost.exe
PID 4900 wrote to memory of 2284	4900	svchost.exe	svchost.exe
PID 4900 wrote to memory of 4048	4900	svchost.exe	svchost.exe
PID 4900 wrote to memory of 4048	4900	svchost.exe	svchost.exe
PID 1144 wrote to memory of 4416	1144	e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe	cmd.exe
PID 1144 wrote to memory of 4416	1144	e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe	cmd.exe
PID 4900 wrote to memory of 4048	4900	svchost.exe	svchost.exe
PID 4900 wrote to memory of 4048	4900	svchost.exe	svchost.exe
PID 4900 wrote to memory of 4048	4900	svchost.exe	svchost.exe
PID 4900 wrote to memory of 4048	4900	svchost.exe	svchost.exe
PID 4900 wrote to memory of 4048	4900	svchost.exe	svchost.exe
PID 4900 wrote to memory of 4048	4900	svchost.exe	svchost.exe
PID 4900 wrote to memory of 4048	4900	svchost.exe	svchost.exe
PID 4900 wrote to memory of 4048	4900	svchost.exe	svchost.exe
PID 4900 wrote to memory of 4048	4900	svchost.exe	svchost.exe
PID 4900 wrote to memory of 4944	4900	svchost.exe	svchost.exe
PID 4900 wrote to memory of 4944	4900	svchost.exe	svchost.exe
PID 4900 wrote to memory of 4944	4900	svchost.exe	svchost.exe
PID 4900 wrote to memory of 4944	4900	svchost.exe	svchost.exe
PID 4900 wrote to memory of 4944	4900	svchost.exe	svchost.exe
PID 4900 wrote to memory of 4944	4900	svchost.exe	svchost.exe
PID 4900 wrote to memory of 4944	4900	svchost.exe	svchost.exe
PID 2128 wrote to memory of 2032	2128	cmd.exe	sc.exe
PID 2128 wrote to memory of 2032	2128	cmd.exe	sc.exe
PID 4416 wrote to memory of 3392	4416	cmd.exe	PING.EXE
PID 4416 wrote to memory of 3392	4416	cmd.exe	PING.EXE
PID 4908 wrote to memory of 5048	4908	SearchIndexer.exe	SearchProtocolHost.exe
PID 4908 wrote to memory of 5048	4908	SearchIndexer.exe	SearchProtocolHost.exe
PID 4908 wrote to memory of 1304	4908	SearchIndexer.exe	SearchFilterHost.exe
PID 4908 wrote to memory of 1304	4908	SearchIndexer.exe	SearchFilterHost.exe
PID 4900 wrote to memory of 4076	4900	svchost.exe	svchost.exe
PID 4900 wrote to memory of 4076	4900	svchost.exe	svchost.exe
PID 4900 wrote to memory of 4076	4900	svchost.exe	svchost.exe
PID 4900 wrote to memory of 4076	4900	svchost.exe	svchost.exe
PID 4900 wrote to memory of 4076	4900	svchost.exe	svchost.exe
PID 4900 wrote to memory of 4076	4900	svchost.exe	svchost.exe
PID 4900 wrote to memory of 4076	4900	svchost.exe	svchost.exe
PID 4900 wrote to memory of 3596	4900	svchost.exe	svchost.exe
PID 4900 wrote to memory of 3596	4900	svchost.exe	svchost.exe
PID 4900 wrote to memory of 3596	4900	svchost.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe
"C:\Users\Admin\AppData\Local\Temp\e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd /c takeown /f "C:\Program Files\Windows Media Player\wmpnetwk.exe" && icacls "C:\Program Files\Windows Media Player\wmpnetwk.exe" /grant administrators:F
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1088
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Program Files\Windows Media Player\wmpnetwk.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2044
- - C:\Windows\system32\icacls.exe
    icacls "C:\Program Files\Windows Media Player\wmpnetwk.exe" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5092
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd /c sc create "Accecss Auto Connetcion Manager" binPath= "C:\Program Files\Windows Media Player\wmixedwk.exe" START= auto DISPLAYNAME= "WebServer" TYPE= own
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Windows\system32\sc.exe
    sc create "Accecss Auto Connetcion Manager" binPath= "C:\Program Files\Windows Media Player\wmixedwk.exe" START= auto DISPLAYNAME= "WebServer" TYPE= own
    3⤵
    - Launches sc.exe
    PID:2032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\kkxqbh.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4416
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - Runs ping.exe
    PID:3392

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5048
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1304

C:\Program Files\Windows Media Player\wmpnetwk.exe
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2388

C:\Program Files\Windows Media Player\wmixedwk.exe
"C:\Program Files\Windows Media Player\wmixedwk.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Modifies data under HKEY_USERS
    PID:2284
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Drops file in Program Files directory
    - Modifies data under HKEY_USERS
    PID:4048
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Drops file in System32 directory
    - Drops file in Program Files directory
    PID:4944
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Drops file in System32 directory
    - Drops file in Program Files directory
    PID:4076
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Drops file in System32 directory
    - Drops file in Program Files directory
    PID:3596
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Drops file in System32 directory
    - Drops file in Program Files directory
    PID:1596
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Drops file in System32 directory
    - Drops file in Program Files directory
    PID:3172
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Drops file in System32 directory
    - Drops file in Program Files directory
    PID:2852
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Drops file in System32 directory
    - Drops file in Program Files directory
    PID:5112
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Drops file in System32 directory
    - Drops file in Program Files directory
    PID:4748
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Drops file in System32 directory
    - Drops file in Program Files directory
    PID:812
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Drops file in System32 directory
    - Drops file in Program Files directory
    PID:1732
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Drops file in System32 directory
    - Drops file in Program Files directory
    PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

File and Directory Permissions Modification

1

T1222

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Media Player\background.jpg

Filesize
1.9MB

MD5
e37e46d9eb3834d3e8845166e1828568

SHA1
a875d07db50b10131a5c3675501de2d805e742a1

SHA256
9f8f9457950e10770f96239f3fbcc35239b3459456c992b51a80c50d257acb36

SHA512
7b95e1e861bece9b5cb7205b52edbe2230b883e76c8188c41107a116e987f122e80a5299c595a692127e42663fddedd27df9074f70b1836d6c305e855bce2021

Download Submit
C:\Program Files\Windows Media Player\mpsvc.dll

Filesize
126KB

MD5
7b207ce9f9d71dfc2eaa2e959634a54d

SHA1
8222daa0c820e50d02ffabdc55dfb7461bbaa1e5

SHA256
757af7a540628004b446117be432342674f7830fa008f97a5f4a1ac386954bc2

SHA512
6ffbe6e33768e2fbea8c7cee428eb4b61e3eb1dd12e470de363f1d6e274296adabc8d1e681fe5a5f2b1dc8e8eb08bd360572bfd34706e82580c51be57f6fcf5a

Download Submit
C:\Program Files\Windows Media Player\wmpnetwk.exe

Filesize
23KB

MD5
90b85ffbdeead1be861d59134ea985b0

SHA1
55e9859aa7dba87678e7c529b571fdf6b7181339

SHA256
ed0dc979eed9ab9933c49204d362de575c7112a792633fda75bb5d1dab50a5c2

SHA512
8a1c10bbfe5651ab25bf36f4e8f2f65424c8e1004696c8141498b99ea2fbd7b3e5fae4d2cfee6835f7ff46bd2333602f4d8ac4a0f5b8e9757adb176332a3afce

Download Submit
C:\Windows\Temp\aad9f05a9a826b65ff2b94740ca196c2

Filesize
55KB

MD5
d39122bc111a1013fbaf9380fcc34ce8

SHA1
fb61a7dfe577a4eee6521f8ca524455dbc3ad189

SHA256
32666d8a3a86a99caf875c7d067b8573b56534e25da8c5dea3271b492ae0a78a

SHA512
806df4b5617252fec2ab4b4dc9415be4f9f09a3f362437f05ef9996895b343c63be4bb2575a72830e34310260dadbe2834dec372bf9c3d5ad0232902cf5ecf84

Download Submit
C:\kkxqbh.bat

Filesize
135B

MD5
44a3af72a2e7efad7f05b5b264f2b133

SHA1
cfd7c8451a0c6e8123328b18f96bec50d04b50ab

SHA256
471ff503db8bd1d39701d587ec4f2d3c97c2843a53e812fe726c970f7306fbb4

SHA512
3d2009c7d4b82fd970ced78fe97b0d5ed08ca7a33480969deb5345195e50877e5efe8f80eeca86c63c5f87cc3779f7f9aba47eb1cca1c29656cb4f74bfd4e14a

Download Submit
memory/1144-3-0x0000025CA9880000-0x0000025CA98AC000-memory.dmp

Filesize
176KB

Download
memory/1144-0-0x00007FF989C10000-0x00007FF989C32000-memory.dmp

Filesize
136KB

Download
memory/2284-80-0x0000000180000000-0x0000000180033000-memory.dmp

Filesize
204KB

Download
memory/2284-75-0x0000000140000000-0x000000014011B000-memory.dmp

Filesize
1.1MB

Download
memory/2284-79-0x0000000140000000-0x000000014011B000-memory.dmp

Filesize
1.1MB

Download
memory/2284-90-0x000002D778E20000-0x000002D778ED6000-memory.dmp

Filesize
728KB

Download
memory/2284-85-0x000002D778E00000-0x000002D778E1F000-memory.dmp

Filesize
124KB

Download
memory/2284-84-0x0000000180000000-0x0000000180033000-memory.dmp

Filesize
204KB

Download
memory/2284-83-0x0000000180000000-0x0000000180033000-memory.dmp

Filesize
204KB

Download
memory/2284-74-0x0000000140000000-0x000000014011B000-memory.dmp

Filesize
1.1MB

Download
memory/2284-78-0x0000000140000000-0x000000014011B000-memory.dmp

Filesize
1.1MB

Download
memory/2284-76-0x0000000140000000-0x000000014011B000-memory.dmp

Filesize
1.1MB

Download
memory/4900-68-0x0000000140000000-0x0000000140026000-memory.dmp

Filesize
152KB

Download
memory/4900-71-0x0000000140000000-0x0000000140026000-memory.dmp

Filesize
152KB

Download
memory/4900-70-0x0000000140000000-0x0000000140026000-memory.dmp

Filesize
152KB

Download
memory/4900-67-0x0000000140000000-0x0000000140026000-memory.dmp

Filesize
152KB

Download
memory/4900-66-0x0000000140000000-0x0000000140026000-memory.dmp

Filesize
152KB

Download
memory/4900-65-0x0000000140000000-0x0000000140026000-memory.dmp

Filesize
152KB

Download
memory/4900-64-0x0000000140000000-0x0000000140026000-memory.dmp

Filesize
152KB

Download
memory/4900-63-0x0000000140000000-0x0000000140026000-memory.dmp

Filesize
152KB

Download
memory/4900-62-0x0000000140000000-0x0000000140026000-memory.dmp

Filesize
152KB

Download
memory/4908-34-0x000001F961E00000-0x000001F961E10000-memory.dmp

Filesize
64KB

Download
memory/4908-50-0x000001F966150000-0x000001F966158000-memory.dmp

Filesize
32KB

Download
memory/4908-18-0x000001F961B60000-0x000001F961B70000-memory.dmp

Filesize
64KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads