Analysis
-
max time kernel
15s -
max time network
17s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 22:08
Static task
static1
Behavioral task
behavioral1
Sample
tt.exe
Resource
win10v2004-20240426-en
General
-
Target
tt.exe
-
Size
580KB
-
MD5
2e7532cdc61138393bae66c151b7d6da
-
SHA1
f14d7efb1cdc79c7de7f1e1fee6f142ca5025372
-
SHA256
784b0c7ff69ad51139cf4eab636eeb2b1f1473fa0a65b33769001c4ef2c82cfa
-
SHA512
560e31dad4b36d5a21491ca9bc2b1a951ffccdf6f4ee60f45e1c87119e66e074633ad7e35cf387238762c0b6deea6afba977f382a0487876a47dcd9ff21f3e69
-
SSDEEP
12288:MIHKg1YeCE3LMjed9fXOZKQkU4yv7sRaAODHVrB/lDH8:Mi1YeCFjed9fOZqtyvHAODdB9DH
Malware Config
Extracted
xworm
wiz.bounceme.net:6000
سPيIXNtJمrCWpكxـاطMWEلD21LcبإA
-
Install_directory
%Port%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2128-383-0x000000001B5E0000-0x000000001B5EE000-memory.dmp family_xworm behavioral1/memory/2128-413-0x000000001C930000-0x000000001C93E000-memory.dmp family_xworm -
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 1500 created 388 1500 WerFault.exe dwm.exe -
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
Processes:
svchost.exedescription pid process target process PID 4296 created 388 4296 svchost.exe dwm.exe PID 4296 created 2044 4296 svchost.exe tt.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
WaaSMedicAgent.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DoSvc\ImagePath = "C:\\Windows\\System32\\svchost.exe -k NetworkService -p" WaaSMedicAgent.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
tt.exewzcsapi.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation tt.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation wzcsapi.exe -
Executes dropped EXE 2 IoCs
Processes:
wzcsapi.exewzcsvc.exepid process 2128 wzcsapi.exe 4532 wzcsvc.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
svchost.exedescription ioc process File opened (read-only) \??\Y: svchost.exe File opened (read-only) \??\Z: svchost.exe File opened (read-only) \??\E: svchost.exe File opened (read-only) \??\L: svchost.exe File opened (read-only) \??\O: svchost.exe File opened (read-only) \??\P: svchost.exe File opened (read-only) \??\W: svchost.exe File opened (read-only) \??\R: svchost.exe File opened (read-only) \??\B: svchost.exe File opened (read-only) \??\G: svchost.exe File opened (read-only) \??\I: svchost.exe File opened (read-only) \??\K: svchost.exe File opened (read-only) \??\M: svchost.exe File opened (read-only) \??\N: svchost.exe File opened (read-only) \??\Q: svchost.exe File opened (read-only) \??\X: svchost.exe File opened (read-only) \??\U: svchost.exe File opened (read-only) \??\V: svchost.exe File opened (read-only) \??\A: svchost.exe File opened (read-only) \??\H: svchost.exe File opened (read-only) \??\J: svchost.exe File opened (read-only) \??\S: svchost.exe File opened (read-only) \??\T: svchost.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
wmiprvse.exedescription ioc process File opened for modification \??\PHYSICALDRIVE0 wmiprvse.exe -
Drops file in System32 directory 8 IoCs
Processes:
svchost.exesvchost.exedescription ioc process File opened for modification C:\Windows\System32\Tasks\wzcsapi svchost.exe File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx svchost.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan svchost.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work svchost.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work svchost.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work svchost.exe File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx svchost.exe File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx svchost.exe -
Drops file in Windows directory 5 IoCs
Processes:
svchost.exeTrustedInstaller.exedescription ioc process File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File created C:\Windows\Logs\CBS\CBS.log TrustedInstaller.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TrustedInstaller.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2236 2044 WerFault.exe tt.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
dwm.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 dwm.exe -
Checks processor information in registry 2 TTPs 9 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WerFault.exemousocoreworker.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz mousocoreworker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier mousocoreworker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 mousocoreworker.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mousocoreworker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 mousocoreworker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString mousocoreworker.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 6 IoCs
Processes:
mousocoreworker.exeWerFault.exedwm.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU mousocoreworker.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS dwm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwm.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS mousocoreworker.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
dwm.exeWaaSMedicAgent.exemousocoreworker.exesvchost.exesvchost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb010000009b59417794f68443b05235c3de062c5800000000020000000000106600000001000020000000b6c30c2b7a107f3568de4ee0bae69c6d3d10848c11d2b81aef321d1de813922e000000000e800000000200002000000063258a74a8b5cb107bbb56e9f0870f3880ea04559a5ca18d12f5c0c594482149b0030000003abe85da3b2e4c2a9bb62ee8ad4eaf945603ec09c7de8495c590d1cd3028b02a3dbb482db62c88baf05c7e9db55da1eb810befde1753adf2a285a428fd41af28da91e02f920038cd245c25ebcdf573295d75eaff2ca55aab899db8d77d9761f552c5e5d818f6dcf0ddafa7aec4b6992896b936eefdadb7d9a0fbefdd34e0e2ddf376efbacb12a5b66a21b4b2223a1bad9d1c6f905ebff3cf1149b446c76b7117ae925b266ff59d3650d7560abb15bc1a84dd9941c85fe8fd5a3dfae4ea65aa98b35bc28c66757b9bb4bf6bb403bfbece36ca74e2d4d503b21f9214ad2f8e1561dc804e24b441c6108b40e0d9d18a2e80fe2a99fd20ce2cf4dc4a55f5dd25ac882e105516e41b5bde7b09c88430606bd84f22f5c6bfee6f63a95870aef59e18970451be42e58d6b6bee777844cef86a1d8f179ceab28e471c51202b84e787be33e5a77cbb1d1125f6a34b0bf36a4c86b62850fcbc42879de4313128b6bcead346a4be5764cd2dd960fb6fe87ce3bce611489b815b7618404181a5be7c5451f50195cede774bf0b49b4335ae54e568b36ad6d3a3906eabc3ce38b90d5315055e6276762b39247d4ba1f3a2f3e85810b4e7dc1040f4a823ac55a4a93718ea23c4ad44da8bcd464f1e54d84b9a669ad2e887980b3bdc37336756fbc7f9e4ae484d92b100a8788c166d1d1efe98a6a966ec8c90cc9bbbeb1010a00aaf0292468fc1452707eb2b2fb4acda15ca9e06b122ae2af1208e7fed11be9da53af0514c9e51fb87d4b0900153283bf313141508db4d374d14d31a98a51f3731a7783f71ec99283aac87555d3ac28d5085cb5f2d5ab335fca0017c606b379ad20632c30d1fdf2d72783132bc3ff293b5a5c5f05e77e6668b224286be37f471c807aec37656a5f5067ba9436516bc46d0f54d9cc85bf62f22ee5ca5b59d2df2c38f8f7db76a82b98ca7bc3520700c5752a41c4616212d58cad6c3dd08cdbd5425262f6117e7e2083ab8f5b524a1a3ba22ecf217aedec82067272f9b3880c21d97a502441f09de391bb734ab88b93fd40410f38f38a9e48f09ab5425c8f5f668426dfb016109ca3f443b2726f7f1eab4df84f6bd232ac6055b0bbadb8a13fa5581068207b2fe95e44a4d6d032050c64e2699de45dc7a7108dec28c56c1b6bcf0cfeaf8c95772d751b49d3bc4f644eb11fd15b3ec26df8d119750422ae2ff4f2b952aa49f181f3787dd90d3bbe10793e2127b7943cc626764ab194df9080fd5a6ef3e7db3c6ddd044d6b99a49ed498c1ffcf648d70dc1ff6e672fcc19f2477e548a182350b527d50aea1911d420e0e4da6dd967966ed7ca400000003ff1f87a79818537e8e938b6bd7fc700de8519303715a17ae9956b6385d917df1a22131efb456bb58423382b25a50a8777a0d5a93bd21102a1876b7703f137dc mousocoreworker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}\ApplicationFlags = "1" mousocoreworker.exe Key created \REGISTRY\USER\.DEFAULT\Software dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property\0018800ED45CF5E2 = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb010000009b59417794f68443b05235c3de062c58000000000200000000001066000000010000200000005470ff409845535d26c971b54b33e0d705091979f2d0f0353ac137fb16cf1f3e000000000e80000000020000200000000f45a7b449a53acb81c42bb31c3e4a74052fd39026d3aedca9b522e03a707cff80000000e98723fd37860731ca24cb3d1547c77fb8bcfc2bdde55e666ca41b9fe72b9de92b76bf307ffa7aa6c70c31e8b5a4d6a9ca5a2855d270e5c7627684fe914fece81712190810545aca88f1e896464472dc32029874ea8366e2ec207043a7d13a7ca71c148b611ecaed88bba6004b932dfc7eb5921c80e1146381b46b982b3cae41400000004bbc94c49df2b5f37cf79560b2a6f869e8bb2884f40c36ee98f97548d46672d1931e695bfded80bd8e8b4e81617663b5711f94ba9aa39a5fe075bb870494c6c2 mousocoreworker.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}\DeviceId = "0018800ED45CF5E2" mousocoreworker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\SignalManager\Peek\CacheStore mousocoreworker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ExtendedProperties\LID = "0018800ED45CF5E2" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\SignalManager mousocoreworker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software mousocoreworker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates dwm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property mousocoreworker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\SignalManager\Peek mousocoreworker.exe -
Modifies registry class 12 IoCs
Processes:
RuntimeBroker.exedescription ioc process Key deleted \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8f9472dc-b0aa-4271- RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8f9472dc-b0aa-4271- RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8f9472dc-b0aa-4271- RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8f9472dc-b0aa-4271- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8f9472dc-b0aa-4271- = 0114020000000000c0000000000000464c0000000114020000000000c0000000000000468300000020000000a1ee651ef0aeda018fa9621ff0aeda018fa9621ff0aeda01530400000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000b95818b12000363163653138323735346362303533373832643339636338393031323863626164613834616436633736343063366261306335343131363564363430376135340000b20009000400efbeb95818b1b95818b12e0000000000000000000000000000000000000000000000000067d10900360031006300650031003800320037003500340063006200300035003300370038003200640033003900630063003800390030003100320038006300620061006400610038003400610064003600630037003600340030006300360062006100300063003500340031003100360035006400360034003000370061003500340000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000cbdec34e1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c36316365313832373534636230353337383264333963633839303132386362616461383461643663373634306336626130633534313136356436343037613534000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a058000000000000006e717074746d726d00000000000000000484e3dde442494da300d8c921e18881d650f26ecf03ef11a2d16a665ee13eb60484e3dde442494da300d8c921e18881d650f26ecf03ef11a2d16a665ee13eb6ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d0031003100360032003100380030003500380037002d003900370037003200330031003200350037002d0032003100390034003300340036003800370031002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d000000680000000048000000f9c3b1b8000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8f9472dc-b0aa-4271- = 46bc9120f0aeda01 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8f9472dc-b0aa-4271- = "8324" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8f9472dc-b0aa-4271- = "\\\\?\\Volume{B8B1C3F9-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\61ce182754cb053782d39cc890128cbada84ad6c7640c6ba0c541165d6407a54" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8f9472dc-b0aa-4271- = "0" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\41602b10-123e-430e- RuntimeBroker.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
wzcsvc.exeWerFault.exesvchost.exewmiprvse.exepid process 4532 wzcsvc.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 1860 WerFault.exe 1860 WerFault.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 4296 svchost.exe 4296 svchost.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 4296 svchost.exe 4296 svchost.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 4532 wzcsvc.exe 5156 wmiprvse.exe 5156 wmiprvse.exe 5156 wmiprvse.exe 5156 wmiprvse.exe 5156 wmiprvse.exe 5156 wmiprvse.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3372 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
wzcsapi.exewzcsvc.exeExplorer.EXEdwm.exesvchost.exesvchost.exedescription pid process Token: SeDebugPrivilege 2128 wzcsapi.exe Token: SeDebugPrivilege 4532 wzcsvc.exe Token: SeShutdownPrivilege 3372 Explorer.EXE Token: SeCreatePagefilePrivilege 3372 Explorer.EXE Token: SeShutdownPrivilege 3372 Explorer.EXE Token: SeCreatePagefilePrivilege 3372 Explorer.EXE Token: SeCreateGlobalPrivilege 2500 dwm.exe Token: SeChangeNotifyPrivilege 2500 dwm.exe Token: 33 2500 dwm.exe Token: SeIncBasePriorityPrivilege 2500 dwm.exe Token: SeShutdownPrivilege 3372 Explorer.EXE Token: SeCreatePagefilePrivilege 3372 Explorer.EXE Token: SeShutdownPrivilege 3372 Explorer.EXE Token: SeCreatePagefilePrivilege 3372 Explorer.EXE Token: SeShutdownPrivilege 3372 Explorer.EXE Token: SeCreatePagefilePrivilege 3372 Explorer.EXE Token: SeShutdownPrivilege 2180 svchost.exe Token: SeCreatePagefilePrivilege 2180 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2240 svchost.exe Token: SeIncreaseQuotaPrivilege 2240 svchost.exe Token: SeSecurityPrivilege 2240 svchost.exe Token: SeTakeOwnershipPrivilege 2240 svchost.exe Token: SeLoadDriverPrivilege 2240 svchost.exe Token: SeBackupPrivilege 2240 svchost.exe Token: SeRestorePrivilege 2240 svchost.exe Token: SeShutdownPrivilege 2240 svchost.exe Token: SeSystemEnvironmentPrivilege 2240 svchost.exe Token: SeManageVolumePrivilege 2240 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2240 svchost.exe Token: SeIncreaseQuotaPrivilege 2240 svchost.exe Token: SeSecurityPrivilege 2240 svchost.exe Token: SeTakeOwnershipPrivilege 2240 svchost.exe Token: SeLoadDriverPrivilege 2240 svchost.exe Token: SeSystemtimePrivilege 2240 svchost.exe Token: SeBackupPrivilege 2240 svchost.exe Token: SeRestorePrivilege 2240 svchost.exe Token: SeShutdownPrivilege 2240 svchost.exe Token: SeSystemEnvironmentPrivilege 2240 svchost.exe Token: SeUndockPrivilege 2240 svchost.exe Token: SeManageVolumePrivilege 2240 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2240 svchost.exe Token: SeIncreaseQuotaPrivilege 2240 svchost.exe Token: SeSecurityPrivilege 2240 svchost.exe Token: SeTakeOwnershipPrivilege 2240 svchost.exe Token: SeLoadDriverPrivilege 2240 svchost.exe Token: SeSystemtimePrivilege 2240 svchost.exe Token: SeBackupPrivilege 2240 svchost.exe Token: SeRestorePrivilege 2240 svchost.exe Token: SeShutdownPrivilege 2240 svchost.exe Token: SeSystemEnvironmentPrivilege 2240 svchost.exe Token: SeUndockPrivilege 2240 svchost.exe Token: SeManageVolumePrivilege 2240 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2240 svchost.exe Token: SeIncreaseQuotaPrivilege 2240 svchost.exe Token: SeSecurityPrivilege 2240 svchost.exe Token: SeTakeOwnershipPrivilege 2240 svchost.exe Token: SeLoadDriverPrivilege 2240 svchost.exe Token: SeSystemtimePrivilege 2240 svchost.exe Token: SeBackupPrivilege 2240 svchost.exe Token: SeRestorePrivilege 2240 svchost.exe Token: SeShutdownPrivilege 2240 svchost.exe Token: SeSystemEnvironmentPrivilege 2240 svchost.exe Token: SeUndockPrivilege 2240 svchost.exe Token: SeManageVolumePrivilege 2240 svchost.exe -
Suspicious use of FindShellTrayWindow 16 IoCs
Processes:
Explorer.EXEpid process 3372 Explorer.EXE 3372 Explorer.EXE 3372 Explorer.EXE 3372 Explorer.EXE 3372 Explorer.EXE 3372 Explorer.EXE 3372 Explorer.EXE 3372 Explorer.EXE 3372 Explorer.EXE 3372 Explorer.EXE 3372 Explorer.EXE 3372 Explorer.EXE 3372 Explorer.EXE 3372 Explorer.EXE 3372 Explorer.EXE 3372 Explorer.EXE -
Suspicious use of SendNotifyMessage 5 IoCs
Processes:
Explorer.EXEpid process 3372 Explorer.EXE 3372 Explorer.EXE 3372 Explorer.EXE 3372 Explorer.EXE 3372 Explorer.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Conhost.exepid process 4884 Conhost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
tt.exewzcsvc.exedescription pid process target process PID 2044 wrote to memory of 2128 2044 tt.exe wzcsapi.exe PID 2044 wrote to memory of 2128 2044 tt.exe wzcsapi.exe PID 2044 wrote to memory of 4532 2044 tt.exe wzcsvc.exe PID 2044 wrote to memory of 4532 2044 tt.exe wzcsvc.exe PID 4532 wrote to memory of 616 4532 wzcsvc.exe winlogon.exe PID 4532 wrote to memory of 672 4532 wzcsvc.exe lsass.exe PID 4532 wrote to memory of 960 4532 wzcsvc.exe svchost.exe PID 4532 wrote to memory of 388 4532 wzcsvc.exe dwm.exe PID 4532 wrote to memory of 532 4532 wzcsvc.exe svchost.exe PID 4532 wrote to memory of 748 4532 wzcsvc.exe svchost.exe PID 4532 wrote to memory of 1064 4532 wzcsvc.exe svchost.exe PID 4532 wrote to memory of 1076 4532 wzcsvc.exe svchost.exe PID 4532 wrote to memory of 1088 4532 wzcsvc.exe svchost.exe PID 4532 wrote to memory of 1216 4532 wzcsvc.exe svchost.exe PID 4532 wrote to memory of 1252 4532 wzcsvc.exe svchost.exe PID 4532 wrote to memory of 1344 4532 wzcsvc.exe svchost.exe PID 4532 wrote to memory of 1364 4532 wzcsvc.exe svchost.exe PID 4532 wrote to memory of 1464 4532 wzcsvc.exe svchost.exe PID 4532 wrote to memory of 1480 4532 wzcsvc.exe svchost.exe PID 4532 wrote to memory of 1492 4532 wzcsvc.exe svchost.exe PID 4532 wrote to memory of 1540 4532 wzcsvc.exe svchost.exe PID 4532 wrote to memory of 1612 4532 wzcsvc.exe svchost.exe PID 4532 wrote to memory of 1628 4532 wzcsvc.exe svchost.exe PID 4532 wrote to memory of 1732 4532 wzcsvc.exe svchost.exe PID 4532 wrote to memory of 1804 4532 wzcsvc.exe svchost.exe PID 4532 wrote to memory of 1852 4532 wzcsvc.exe svchost.exe PID 4532 wrote to memory of 1872 4532 wzcsvc.exe svchost.exe PID 4532 wrote to memory of 1884 4532 wzcsvc.exe svchost.exe PID 4532 wrote to memory of 1968 4532 wzcsvc.exe svchost.exe PID 4532 wrote to memory of 1976 4532 wzcsvc.exe svchost.exe PID 4532 wrote to memory of 1424 4532 wzcsvc.exe spoolsv.exe PID 4532 wrote to memory of 2072 4532 wzcsvc.exe svchost.exe PID 4532 wrote to memory of 2240 4532 wzcsvc.exe svchost.exe PID 4532 wrote to memory of 2292 4532 wzcsvc.exe svchost.exe PID 4532 wrote to memory of 2312 4532 wzcsvc.exe svchost.exe PID 4532 wrote to memory of 2324 4532 wzcsvc.exe svchost.exe PID 4532 wrote to memory of 2372 4532 wzcsvc.exe svchost.exe PID 4532 wrote to memory of 2456 4532 wzcsvc.exe sysmon.exe PID 4532 wrote to memory of 2520 4532 wzcsvc.exe svchost.exe PID 4532 wrote to memory of 2528 4532 wzcsvc.exe svchost.exe PID 4532 wrote to memory of 2536 4532 wzcsvc.exe svchost.exe PID 4532 wrote to memory of 2872 4532 wzcsvc.exe unsecapp.exe PID 4532 wrote to memory of 3052 4532 wzcsvc.exe sihost.exe PID 4532 wrote to memory of 2624 4532 wzcsvc.exe svchost.exe PID 4532 wrote to memory of 3140 4532 wzcsvc.exe taskhostw.exe PID 4532 wrote to memory of 3196 4532 wzcsvc.exe svchost.exe PID 4532 wrote to memory of 3372 4532 wzcsvc.exe Explorer.EXE PID 4532 wrote to memory of 3380 4532 wzcsvc.exe svchost.exe PID 4532 wrote to memory of 3552 4532 wzcsvc.exe svchost.exe PID 4532 wrote to memory of 3756 4532 wzcsvc.exe DllHost.exe PID 4532 wrote to memory of 3944 4532 wzcsvc.exe RuntimeBroker.exe PID 4532 wrote to memory of 3788 4532 wzcsvc.exe RuntimeBroker.exe PID 4532 wrote to memory of 3808 4532 wzcsvc.exe svchost.exe PID 4532 wrote to memory of 4188 4532 wzcsvc.exe svchost.exe PID 4532 wrote to memory of 3656 4532 wzcsvc.exe svchost.exe PID 4532 wrote to memory of 3636 4532 wzcsvc.exe svchost.exe PID 4532 wrote to memory of 4684 4532 wzcsvc.exe OfficeClickToRun.exe PID 4532 wrote to memory of 4208 4532 wzcsvc.exe SppExtComObj.exe PID 4532 wrote to memory of 3928 4532 wzcsvc.exe svchost.exe PID 4532 wrote to memory of 920 4532 wzcsvc.exe DllHost.exe PID 4532 wrote to memory of 2644 4532 wzcsvc.exe RuntimeBroker.exe PID 4532 wrote to memory of 1744 4532 wzcsvc.exe RuntimeBroker.exe PID 4532 wrote to memory of 2984 4532 wzcsvc.exe RuntimeBroker.exe PID 4532 wrote to memory of 3644 4532 wzcsvc.exe DllHost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 388 -s 5643⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Drops file in System32 directory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
- Drops file in System32 directory
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
- Enumerates connected drives
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\tt.exe"C:\Users\Admin\AppData\Local\Temp\tt.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\wzcsapi.exe"C:\Users\Admin\AppData\Local\Temp\wzcsapi.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /rl highest /tn "wzcsapi" /tr "%Current%\wzcsapi.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\wzcsvc.exe"C:\Users\Admin\AppData\Local\Temp\wzcsvc.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 17683⤵
- Program crash
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 504 -p 388 -ip 3882⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2044 -ip 20442⤵
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe f58af6eba405c08de4ffa100e28a32fd 0mQ7wiZhTk213F0UNUZu3Q.0.1.0.0.01⤵
- Sets service image path in registry
- Modifies data under HKEY_USERS
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵
- Drops file in Windows directory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3EFD.tmp.csvFilesize
39KB
MD56f8485b3d057223327f14cdcf32beaa0
SHA109ae64e6a41ea21bbae60c2842482245ba27aec1
SHA256540ce762e00aa37c19de8a59953edee9883f7d247c2bb0b82c608eb9df3a168d
SHA512b11986666f0b9d664efef821dcb14264d19036dd399e6f1e2b43a98452ed49470ea8f4538cb5d0d0b7b431dd3a61376b852daa8731ceb367f09d9cad08937389
-
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3F1D.tmp.txtFilesize
13KB
MD5cc85d5257ad8e0f2ebf3654995bd672e
SHA170481c044e418af0e6aa8aecef2a046149e6c9dd
SHA2562bfaf8ee7717cccdbae2c5f65beba66a8475f8ff4bf04d15664fa1faf2647ba0
SHA512521b880281d4897f0cd6f8ee3425425bcd6b334e6d650fd3d16f1903faf4c08c3787091c8ef8157a43f9b3c7ad42490dbe7b263813280586133d3e267597cf75
-
C:\Users\Admin\AppData\Local\Temp\wzcsapi.exeFilesize
34KB
MD564ffe7c0fa6ac22f5acafd3ceb4aca5b
SHA1104182708267ee1a6da0e9e83cb04df83edae120
SHA2566b5c2e9a2ef36412b2636236ade5530c59573b51b07fe224fd980911cbb7b976
SHA512f136d69bb6be51cf7e1e6f0e4538cb951337cb278344b348e749f67a6f08c1df01264bd3275ed9a36b776dfb1b9b75f31f8bcec102f8b50d50913aa883b13066
-
C:\Users\Admin\AppData\Local\Temp\wzcsvc.exeFilesize
161KB
MD5a69c6e092d415063a9fb80f8fe4e3444
SHA18b26a0fd01b1e48f7110cffecf6bc3b9d0822e9a
SHA256f7dd8d6299c108a3221c31bf33637f59f0e19703aaa88b1e3a4f1093e7209a5d
SHA5124e69b49d65f68ff913afbc991f06509645ac69850182f557ca625ad5cf92832059ddadb4af547cfb4fd84c4b24cf55a1ce3d9d6d466112e9581908d4e4d2da38
-
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance WorkFilesize
2KB
MD5f313c5b4f95605026428425586317353
SHA106be66fa06e1cffc54459c38d3d258f46669d01a
SHA256129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b
SHA512b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890
-
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To WorkFilesize
2KB
MD57d612892b20e70250dbd00d0cdd4f09b
SHA163251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5
SHA256727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02
SHA512f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1
-
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule WorkFilesize
2KB
MD51e8e2076314d54dd72e7ee09ff8a52ab
SHA15fd0a67671430f66237f483eef39ff599b892272
SHA25655f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f
SHA5125b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6
-
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule WorkFilesize
2KB
MD50b990e24f1e839462c0ac35fef1d119e
SHA19e17905f8f68f9ce0a2024d57b537aa8b39c6708
SHA256a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a
SHA512c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4
-
memory/388-137-0x00007FFE4304D000-0x00007FFE4304E000-memory.dmpFilesize
4KB
-
memory/388-349-0x00007FFE4304F000-0x00007FFE43050000-memory.dmpFilesize
4KB
-
memory/388-41-0x000001AC93B90000-0x000001AC93BBB000-memory.dmpFilesize
172KB
-
memory/388-135-0x000001AC93B90000-0x000001AC93BBB000-memory.dmpFilesize
172KB
-
memory/616-132-0x00007FFE4304D000-0x00007FFE4304E000-memory.dmpFilesize
4KB
-
memory/616-130-0x00000212FB490000-0x00000212FB4BB000-memory.dmpFilesize
172KB
-
memory/616-34-0x00000212FB460000-0x00000212FB485000-memory.dmpFilesize
148KB
-
memory/616-38-0x00000212FB490000-0x00000212FB4BB000-memory.dmpFilesize
172KB
-
memory/616-39-0x00007FFE03030000-0x00007FFE03040000-memory.dmpFilesize
64KB
-
memory/672-42-0x0000013800850000-0x000001380087B000-memory.dmpFilesize
172KB
-
memory/672-43-0x00007FFE03030000-0x00007FFE03040000-memory.dmpFilesize
64KB
-
memory/672-140-0x0000013800850000-0x000001380087B000-memory.dmpFilesize
172KB
-
memory/2044-0-0x00000000751BE000-0x00000000751BF000-memory.dmpFilesize
4KB
-
memory/2044-348-0x00000000751BE000-0x00000000751BF000-memory.dmpFilesize
4KB
-
memory/2044-1-0x0000000000010000-0x00000000000A8000-memory.dmpFilesize
608KB
-
memory/2044-2-0x0000000005170000-0x0000000005714000-memory.dmpFilesize
5.6MB
-
memory/2044-278-0x00000000751B0000-0x0000000075960000-memory.dmpFilesize
7.7MB
-
memory/2044-3-0x0000000004A90000-0x0000000004B22000-memory.dmpFilesize
584KB
-
memory/2044-4-0x00000000026B0000-0x00000000026DA000-memory.dmpFilesize
168KB
-
memory/2044-358-0x00000000751B0000-0x0000000075960000-memory.dmpFilesize
7.7MB
-
memory/2044-33-0x0000000005F20000-0x0000000005F2A000-memory.dmpFilesize
40KB
-
memory/2044-7-0x0000000004C60000-0x0000000004CFC000-memory.dmpFilesize
624KB
-
memory/2044-6-0x00000000751B0000-0x0000000075960000-memory.dmpFilesize
7.7MB
-
memory/2044-5-0x00000000026F0000-0x0000000002710000-memory.dmpFilesize
128KB
-
memory/2128-30-0x00000000009F0000-0x00000000009FE000-memory.dmpFilesize
56KB
-
memory/2128-382-0x00007FFE42FB0000-0x00007FFE431A5000-memory.dmpFilesize
2.0MB
-
memory/2128-383-0x000000001B5E0000-0x000000001B5EE000-memory.dmpFilesize
56KB
-
memory/2128-413-0x000000001C930000-0x000000001C93E000-memory.dmpFilesize
56KB
-
memory/2128-28-0x00007FFE22FF3000-0x00007FFE22FF5000-memory.dmpFilesize
8KB
-
memory/3372-94-0x00007FFE03030000-0x00007FFE03040000-memory.dmpFilesize
64KB
-
memory/3372-92-0x0000000008DE0000-0x0000000008E0B000-memory.dmpFilesize
172KB
-
memory/4532-31-0x00007FFE42FB0000-0x00007FFE431A5000-memory.dmpFilesize
2.0MB
-
memory/4532-32-0x00007FFE41620000-0x00007FFE416DE000-memory.dmpFilesize
760KB