gh0strat | 25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9

Processes:

look2.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\svchcst\Parameters\ServiceDll = "C:\\Windows\\system32\\259427837.bat"	look2.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

ComputerZService.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ComputerZService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	ComputerZService.exe

Executes dropped EXE 6 IoCs

Processes:

look2.exeHD_25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exeHD_25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exe360DrvMgr.exesvchcst.exeComputerZService.exe

pid	process
2940	look2.exe
2516	HD_25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exe
992	HD_25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exe
2304	360DrvMgr.exe
2396	svchcst.exe
2180	ComputerZService.exe

Loads dropped DLL 34 IoCs

Processes:

25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exelook2.exesvchost.exeHD_25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exeHD_25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exe360DrvMgr.exesvchcst.exeComputerZService.exeWerFault.exe

pid	process
2772	25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exe
2940	look2.exe
1616	svchost.exe
2772	25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exe
2516	HD_25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exe
992	HD_25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exe
2304	360DrvMgr.exe
2304	360DrvMgr.exe
2304	360DrvMgr.exe
2304	360DrvMgr.exe
2304	360DrvMgr.exe
2304	360DrvMgr.exe
2304	360DrvMgr.exe
1616	svchost.exe
2396	svchcst.exe
2304	360DrvMgr.exe
2304	360DrvMgr.exe
2304	360DrvMgr.exe
2304	360DrvMgr.exe
2304	360DrvMgr.exe
2304	360DrvMgr.exe
2304	360DrvMgr.exe
2180	ComputerZService.exe
2304	360DrvMgr.exe
2180	ComputerZService.exe
2180	ComputerZService.exe
2180	ComputerZService.exe
684	WerFault.exe
684	WerFault.exe
684	WerFault.exe
684	WerFault.exe
684	WerFault.exe
2180	ComputerZService.exe
2180	ComputerZService.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

ComputerZService.exe360DrvMgr.exe

description	ioc	process
File opened (read-only)	\??\W:	ComputerZService.exe
File opened (read-only)	\??\A:	ComputerZService.exe
File opened (read-only)	\??\E:	ComputerZService.exe
File opened (read-only)	\??\L:	ComputerZService.exe
File opened (read-only)	\??\M:	ComputerZService.exe
File opened (read-only)	\??\S:	ComputerZService.exe
File opened (read-only)	\??\U:	ComputerZService.exe
File opened (read-only)	\??\G:	ComputerZService.exe
File opened (read-only)	\??\K:	ComputerZService.exe
File opened (read-only)	\??\P:	ComputerZService.exe
File opened (read-only)	\??\R:	ComputerZService.exe
File opened (read-only)	\??\X:	ComputerZService.exe
File opened (read-only)	\??\Z:	ComputerZService.exe
File opened (read-only)	\??\B:	ComputerZService.exe
File opened (read-only)	\??\H:	ComputerZService.exe
File opened (read-only)	\??\I:	ComputerZService.exe
File opened (read-only)	\??\J:	ComputerZService.exe
File opened (read-only)	\??\T:	ComputerZService.exe
File opened (read-only)	\??\V:	ComputerZService.exe
File opened (read-only)	\??\F:	360DrvMgr.exe
File opened (read-only)	\??\N:	ComputerZService.exe
File opened (read-only)	\??\O:	ComputerZService.exe
File opened (read-only)	\??\Q:	ComputerZService.exe
File opened (read-only)	\??\Y:	ComputerZService.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

360DrvMgr.exeComputerZService.exe

description ioc process

File opened for modification \??\PhysicalDrive0 360DrvMgr.exe
File opened for modification \??\PhysicalDrive0 ComputerZService.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	360DrvMgr.exe
File opened for modification	\??\PhysicalDrive0	ComputerZService.exe

Drops file in System32 directory 4 IoCs

Processes:

look2.exesvchost.exe

description	ioc	process
File created	C:\Windows\SysWOW64\259427837.bat	look2.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	look2.exe
File created	C:\Windows\SysWOW64\svchcst.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchcst.exe	svchost.exe

Drops file in Program Files directory 1 IoCs

Processes:

25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exe

Drops file in Windows directory 2 IoCs

Processes:

ComputerZService.exe

description	ioc	process
File opened for modification	C:\Windows\INF\setupapi.app.log	ComputerZService.exe
File opened for modification	C:\Windows\	ComputerZService.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

684 2304 WerFault.exe 360DrvMgr.exe

pid	pid_target	process	target process
684	2304	WerFault.exe	360DrvMgr.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

System Information Discovery

Processes:

ComputerZService.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	ComputerZService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate	ComputerZService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	ComputerZService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	ComputerZService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosDate	ComputerZService.exe

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

Processes:

360DrvMgr.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	360DrvMgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\360DrvMgr.exe = "8000"	360DrvMgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DOCUMENT_COMPATIBLE_MODE	360DrvMgr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_DOCUMENT_COMPATIBLE_MODE\360DrvMgr.exe = "8000"	360DrvMgr.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	360DrvMgr.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

Processes:

ComputerZService.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c909000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c01400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e52000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a	ComputerZService.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e51d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af33313353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703030f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c92000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a	ComputerZService.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 040000000100000010000000cb17e431673ee209fe455793f30afa1c0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c909000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c01400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade372000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a	ComputerZService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5	ComputerZService.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exeComputerZService.exe

pid process

2772 25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exe
2180 ComputerZService.exe
Suspicious behavior: LoadsDriver 2 IoCs

Processes:

pid process

468
468

pid	process
468
468

Suspicious use of AdjustPrivilegeToken 28 IoCs

Processes:

ComputerZService.exe360DrvMgr.exe

description	pid	process
Token: SeRestorePrivilege	2180	ComputerZService.exe
Token: SeRestorePrivilege	2180	ComputerZService.exe
Token: SeRestorePrivilege	2180	ComputerZService.exe
Token: SeRestorePrivilege	2180	ComputerZService.exe
Token: SeRestorePrivilege	2180	ComputerZService.exe
Token: SeRestorePrivilege	2180	ComputerZService.exe
Token: SeRestorePrivilege	2180	ComputerZService.exe
Token: SeLoadDriverPrivilege	2304	360DrvMgr.exe
Token: SeIncBasePriorityPrivilege	2180	ComputerZService.exe
Token: SeIncBasePriorityPrivilege	2180	ComputerZService.exe
Token: 33	2180	ComputerZService.exe
Token: SeIncBasePriorityPrivilege	2180	ComputerZService.exe
Token: 33	2180	ComputerZService.exe
Token: SeIncBasePriorityPrivilege	2180	ComputerZService.exe
Token: 33	2180	ComputerZService.exe
Token: SeIncBasePriorityPrivilege	2180	ComputerZService.exe
Token: 33	2180	ComputerZService.exe
Token: SeIncBasePriorityPrivilege	2180	ComputerZService.exe
Token: 33	2180	ComputerZService.exe
Token: SeIncBasePriorityPrivilege	2180	ComputerZService.exe
Token: 33	2180	ComputerZService.exe
Token: SeIncBasePriorityPrivilege	2180	ComputerZService.exe
Token: 33	2180	ComputerZService.exe
Token: SeIncBasePriorityPrivilege	2180	ComputerZService.exe
Token: 33	2180	ComputerZService.exe
Token: SeIncBasePriorityPrivilege	2180	ComputerZService.exe
Token: 33	2180	ComputerZService.exe
Token: SeIncBasePriorityPrivilege	2180	ComputerZService.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exe360DrvMgr.exe

pid	process
2772	25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exe
2772	25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exe
2304	360DrvMgr.exe
2304	360DrvMgr.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exeHD_25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exeHD_25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exesvchost.exe360DrvMgr.exe

description	pid	process	target process
PID 2772 wrote to memory of 2940	2772	25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exe	look2.exe
PID 2772 wrote to memory of 2940	2772	25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exe	look2.exe
PID 2772 wrote to memory of 2940	2772	25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exe	look2.exe
PID 2772 wrote to memory of 2940	2772	25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exe	look2.exe
PID 2772 wrote to memory of 2516	2772	25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exe	HD_25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exe
PID 2772 wrote to memory of 2516	2772	25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exe	HD_25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exe
PID 2772 wrote to memory of 2516	2772	25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exe	HD_25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exe
PID 2772 wrote to memory of 2516	2772	25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exe	HD_25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exe
PID 2516 wrote to memory of 992	2516	HD_25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exe	HD_25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exe
PID 2516 wrote to memory of 992	2516	HD_25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exe	HD_25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exe
PID 2516 wrote to memory of 992	2516	HD_25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exe	HD_25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exe
PID 2516 wrote to memory of 992	2516	HD_25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exe	HD_25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exe
PID 992 wrote to memory of 2304	992	HD_25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exe	360DrvMgr.exe
PID 992 wrote to memory of 2304	992	HD_25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exe	360DrvMgr.exe
PID 992 wrote to memory of 2304	992	HD_25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exe	360DrvMgr.exe
PID 992 wrote to memory of 2304	992	HD_25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exe	360DrvMgr.exe
PID 1616 wrote to memory of 2396	1616	svchost.exe	svchcst.exe
PID 1616 wrote to memory of 2396	1616	svchost.exe	svchcst.exe
PID 1616 wrote to memory of 2396	1616	svchost.exe	svchcst.exe
PID 1616 wrote to memory of 2396	1616	svchost.exe	svchcst.exe
PID 2304 wrote to memory of 2180	2304	360DrvMgr.exe	ComputerZService.exe
PID 2304 wrote to memory of 2180	2304	360DrvMgr.exe	ComputerZService.exe
PID 2304 wrote to memory of 2180	2304	360DrvMgr.exe	ComputerZService.exe
PID 2304 wrote to memory of 2180	2304	360DrvMgr.exe	ComputerZService.exe
PID 2304 wrote to memory of 684	2304	360DrvMgr.exe	WerFault.exe
PID 2304 wrote to memory of 684	2304	360DrvMgr.exe	WerFault.exe
PID 2304 wrote to memory of 684	2304	360DrvMgr.exe	WerFault.exe
PID 2304 wrote to memory of 684	2304	360DrvMgr.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exe
"C:\Users\Admin\AppData\Local\Temp\25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2772

C:\Users\Admin\AppData\Local\Temp\look2.exe
C:\Users\Admin\AppData\Local\Temp\\look2.exe
2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2940

C:\Users\Admin\AppData\Local\Temp\HD_25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exe
C:\Users\Admin\AppData\Local\Temp\HD_25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2516

C:\Users\Admin\AppData\Local\Temp\HD_25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exe
"C:\Users\Admin\AppData\Local\Temp\HD_25bf6bc8d1a3489242813a068f296dfe95b1c15d63327c9e9acc416e95ba7fc9.exe" -sfxwaitall:0 "C:\Users\Admin\AppData\Local\Temp\360DrvMgr\360DrvMgr.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:992

C:\Users\Admin\AppData\Local\Temp\360DrvMgr\360DrvMgr.exe
"C:\Users\Admin\AppData\Local\Temp\360DrvMgr\360DrvMgr.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2304

C:\Users\Admin\AppData\Local\Temp\360DrvMgr\ComputerZService.exe
"C:\Users\Admin\AppData\Local\Temp\360DrvMgr\ComputerZService.exe"
5⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 1936
5⤵
- Loads dropped DLL
- Program crash
PID:684

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "svchcst"
1⤵
PID:940

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "svchcst"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1616

C:\Windows\SysWOW64\svchcst.exe
C:\Windows\system32\svchcst.exe "c:\windows\system32\259427837.bat",MainThread
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery