e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16

Analysis

max time kernel
299s
max time network
300s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
30/05/2024, 23:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe
Size 223KB
Sample240530-3mepraee2y
SHA256 e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16
MD5 3955af54fbac1e43c945f447d92e4108
SHA1 53c5552c3649619e4e8c6a907b94573f47130fa4
SHA512 fa028a040a5f075296aebab7f63a59b6cbba32ee0964dfc08768396cc012ff5d861191e2478914d79d4a424c3bba110505a58b97376c44c716f0b1ea70551037
SSDEEP 3072:tneBqhy5aVLOwqI8sgwoEHXfwaNUM+/ORSs5G2Ms4f6TFZbhgvbUxzJ8Y:tETlsgOfDt+/V6JQO98
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery execution exploit persistence upx

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
792	takeown.exe
4584	icacls.exe

Executes dropped EXE 2 IoCs

pid	Process
4128	wmpnetwk.exe
1976	wmixedwk.exe

Loads dropped DLL 2 IoCs

pid	Process
4128	wmpnetwk.exe
1976	wmixedwk.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
792	takeown.exe
4584	icacls.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4936-80-0x0000000140000000-0x000000014011B000-memory.dmp	upx
behavioral2/memory/4936-79-0x0000000140000000-0x000000014011B000-memory.dmp	upx
behavioral2/memory/4936-83-0x0000000140000000-0x000000014011B000-memory.dmp	upx
behavioral2/memory/1612-93-0x0000000140000000-0x000000014011B000-memory.dmp	upx
behavioral2/memory/1612-94-0x0000000140000000-0x000000014011B000-memory.dmp	upx
behavioral2/memory/1612-92-0x0000000140000000-0x000000014011B000-memory.dmp	upx
behavioral2/memory/4936-82-0x0000000140000000-0x000000014011B000-memory.dmp	upx
behavioral2/memory/4936-78-0x0000000140000000-0x000000014011B000-memory.dmp	upx

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\1612.hecate	svchost.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\240.hecate	svchost.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\1276.hecate	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	SearchProtocolHost.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\4428.hecate	svchost.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\700.hecate	svchost.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\4960.hecate	svchost.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\2684.hecate	svchost.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\2468.hecate	svchost.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\4936.hecate	svchost.exe
File created	C:\Windows\System32\config\systemprofile\AppData\Local\info	svchost.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\1580.hecate	svchost.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\2108.hecate	svchost.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\804.hecate	svchost.exe

Suspicious use of SetThreadContext 14 IoCs

description	pid	Process	procid_target
PID 1976 set thread context of 4992	1976	wmixedwk.exe	82
PID 4992 set thread context of 4936	4992	svchost.exe	87
PID 4992 set thread context of 656	4992	svchost.exe	88
PID 4992 set thread context of 1612	4992	svchost.exe	90
PID 4992 set thread context of 4428	4992	svchost.exe	93
PID 4992 set thread context of 2684	4992	svchost.exe	94
PID 4992 set thread context of 1580	4992	svchost.exe	95
PID 4992 set thread context of 700	4992	svchost.exe	96
PID 4992 set thread context of 4960	4992	svchost.exe	97
PID 4992 set thread context of 2108	4992	svchost.exe	98
PID 4992 set thread context of 2468	4992	svchost.exe	99
PID 4992 set thread context of 240	4992	svchost.exe	100
PID 4992 set thread context of 1276	4992	svchost.exe	101
PID 4992 set thread context of 804	4992	svchost.exe	104

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Media Player\ppqqxpb	svchost.exe
File created	C:\Program Files\Windows Media Player\wmixedwk.exe	e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe
File opened for modification	C:\Program Files\Windows Media Player\mpsvc.dll	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\ppqqxpa	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\ppqqxpb	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\ppqqxpb	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\ppqqxpb	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\ppqqxpb	svchost.exe
File created	C:\Program Files\Windows Media Player\background.jpg	e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe
File created	C:\Program Files\Windows Media Player\mpsvc.dll	e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe
File opened for modification	C:\Program Files\Windows Media Player\wmixedwk.exe	e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe
File opened for modification	C:\Program Files\Windows Media Player\ppqqxpb	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\ppqqxpb	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\ppqqxds	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\ppqqxpp	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\ppqqxpb	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\ppqqxpb	svchost.exe
File created	C:\Program Files\Windows Media Player\wmpnetwk.exe	e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe
File opened for modification	C:\Program Files\Windows Media Player\ppqqxpb	svchost.exe
File opened for modification	C:\Program Files\Windows Media Player\ppqqxpb	svchost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\ESE.TXT	SearchIndexer.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2256	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\UserChoice\Hash = "KUxeViXgfZ0="	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000979cc668eab2da01	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\FileAssociations\ProgIds\_.3g2 = "1"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mts\UserChoice\ProgId = "AppX6eg8h5sxqq90pv53845wmnbewywdqq5h"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\FileAssociations\ProgIds\_.raw = "1"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice\Hash = "hcWxZID/+P4="	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\UserChoice\Hash = "I/zSEvi/eRs="	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\FileAssociations\ProgIds\_.TS = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\UserChoice	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\UserChoice	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\UserChoice	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\UserChoice\Hash = "1OHwB4nWAgk="	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m2ts\UserChoice	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\UserChoice\Hash = "yXPQ4YxOPpk="	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice\ProgId = "AppX4hxtad77fbk3jkkeerkrm0ze94wjf3s9"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d1315f69eab2da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000091fbb7f6eab2da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\UserChoice\Hash = "70ehGIqrwIU="	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001562ac68eab2da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004b481569eab2da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\UserChoice\ProgId = "AppX6eg8h5sxqq90pv53845wmnbewywdqq5h"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Program Files\Common Files\System\wab32res.dll,-4602 = "Contact file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\UserChoice	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\yzzg	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\UserChoice\ProgId = "AppX43hnxtbyyps62jhe9sqpdzxn1790zetc"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\UserChoice	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.adts\UserChoice\ProgId = "AppXqj98qxeaynz6dv4459ayz6bnqxbyaqcs"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm\UserChoice	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\UserChoice\Hash = "/OQEch02awE="	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice\ProgId = "AppX43hnxtbyyps62jhe9sqpdzxn1790zetc"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cd008b68eab2da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\UserChoice\ProgId = "AppX43hnxtbyyps62jhe9sqpdzxn1790zetc"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\UserChoice\Hash = "snhtDXLVLCI="	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\UserChoice\ProgId = "AppX6eg8h5sxqq90pv53845wmnbewywdqq5h"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\FileAssociations\ProgIds\_.m4v = "1"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\FileAssociations\ProgIds\_.dib = "1"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\FileAssociations\ProgIds\_.bmp = "1"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice\ProgId = "AppX43hnxtbyyps62jhe9sqpdzxn1790zetc"	SearchProtocolHost.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2472	PING.EXE

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	792	takeown.exe
Token: 33	2932	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2932	SearchIndexer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 1028	748	e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe	74
PID 748 wrote to memory of 1028	748	e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe	74
PID 1028 wrote to memory of 792	1028	cmd.exe	76
PID 1028 wrote to memory of 792	1028	cmd.exe	76
PID 1028 wrote to memory of 4584	1028	cmd.exe	77
PID 1028 wrote to memory of 4584	1028	cmd.exe	77
PID 2932 wrote to memory of 2228	2932	SearchIndexer.exe	80
PID 2932 wrote to memory of 2228	2932	SearchIndexer.exe	80
PID 1976 wrote to memory of 4992	1976	wmixedwk.exe	82
PID 1976 wrote to memory of 4992	1976	wmixedwk.exe	82
PID 1976 wrote to memory of 4992	1976	wmixedwk.exe	82
PID 1976 wrote to memory of 4992	1976	wmixedwk.exe	82
PID 2932 wrote to memory of 3892	2932	SearchIndexer.exe	83
PID 2932 wrote to memory of 3892	2932	SearchIndexer.exe	83
PID 1976 wrote to memory of 4992	1976	wmixedwk.exe	82
PID 1976 wrote to memory of 4992	1976	wmixedwk.exe	82
PID 1976 wrote to memory of 4992	1976	wmixedwk.exe	82
PID 1976 wrote to memory of 4992	1976	wmixedwk.exe	82
PID 1976 wrote to memory of 4992	1976	wmixedwk.exe	82
PID 1976 wrote to memory of 4992	1976	wmixedwk.exe	82
PID 1976 wrote to memory of 4992	1976	wmixedwk.exe	82
PID 748 wrote to memory of 4344	748	e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe	84
PID 748 wrote to memory of 4344	748	e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe	84
PID 748 wrote to memory of 2236	748	e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe	86
PID 748 wrote to memory of 2236	748	e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe	86
PID 4992 wrote to memory of 4936	4992	svchost.exe	87
PID 4992 wrote to memory of 4936	4992	svchost.exe	87
PID 4992 wrote to memory of 4936	4992	svchost.exe	87
PID 4992 wrote to memory of 4936	4992	svchost.exe	87
PID 4992 wrote to memory of 4936	4992	svchost.exe	87
PID 4992 wrote to memory of 4936	4992	svchost.exe	87
PID 4992 wrote to memory of 4936	4992	svchost.exe	87
PID 4992 wrote to memory of 656	4992	svchost.exe	88
PID 4992 wrote to memory of 656	4992	svchost.exe	88
PID 4992 wrote to memory of 656	4992	svchost.exe	88
PID 4992 wrote to memory of 656	4992	svchost.exe	88
PID 4992 wrote to memory of 656	4992	svchost.exe	88
PID 4992 wrote to memory of 656	4992	svchost.exe	88
PID 4992 wrote to memory of 656	4992	svchost.exe	88
PID 4992 wrote to memory of 656	4992	svchost.exe	88
PID 4992 wrote to memory of 656	4992	svchost.exe	88
PID 4992 wrote to memory of 656	4992	svchost.exe	88
PID 4992 wrote to memory of 656	4992	svchost.exe	88
PID 4992 wrote to memory of 1612	4992	svchost.exe	90
PID 4992 wrote to memory of 1612	4992	svchost.exe	90
PID 4992 wrote to memory of 1612	4992	svchost.exe	90
PID 4992 wrote to memory of 1612	4992	svchost.exe	90
PID 4992 wrote to memory of 1612	4992	svchost.exe	90
PID 4992 wrote to memory of 1612	4992	svchost.exe	90
PID 4992 wrote to memory of 1612	4992	svchost.exe	90
PID 4344 wrote to memory of 2256	4344	cmd.exe	91
PID 4344 wrote to memory of 2256	4344	cmd.exe	91
PID 2236 wrote to memory of 2472	2236	cmd.exe	92
PID 2236 wrote to memory of 2472	2236	cmd.exe	92
PID 4992 wrote to memory of 4428	4992	svchost.exe	93
PID 4992 wrote to memory of 4428	4992	svchost.exe	93
PID 4992 wrote to memory of 4428	4992	svchost.exe	93
PID 4992 wrote to memory of 4428	4992	svchost.exe	93
PID 4992 wrote to memory of 4428	4992	svchost.exe	93
PID 4992 wrote to memory of 4428	4992	svchost.exe	93
PID 4992 wrote to memory of 4428	4992	svchost.exe	93
PID 4992 wrote to memory of 2684	4992	svchost.exe	94
PID 4992 wrote to memory of 2684	4992	svchost.exe	94
PID 4992 wrote to memory of 2684	4992	svchost.exe	94

C:\Users\Admin\AppData\Local\Temp\e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe
"C:\Users\Admin\AppData\Local\Temp\e6de332ad778f7a7cf160efa60656c3ac960dc77806905493d5cffe58ee1de16.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:748
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd /c takeown /f "C:\Program Files\Windows Media Player\wmpnetwk.exe" && icacls "C:\Program Files\Windows Media Player\wmpnetwk.exe" /grant administrators:F
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1028
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Program Files\Windows Media Player\wmpnetwk.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:792
- - C:\Windows\system32\icacls.exe
    icacls "C:\Program Files\Windows Media Player\wmpnetwk.exe" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4584
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd /c sc create "Accecss Auto Connetcion Manager" binPath= "C:\Program Files\Windows Media Player\wmixedwk.exe" START= auto DISPLAYNAME= "WebServer" TYPE= own
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Windows\system32\sc.exe
    sc create "Accecss Auto Connetcion Manager" binPath= "C:\Program Files\Windows Media Player\wmixedwk.exe" START= auto DISPLAYNAME= "WebServer" TYPE= own
    3⤵
    - Launches sc.exe
    PID:2256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\kkxqbh.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2236
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - Runs ping.exe
    PID:2472

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:2228
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 684 688 696 8192 692
  2⤵
  - Modifies data under HKEY_USERS
  PID:3892
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4668
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 684 688 696 8192 692
  2⤵
  PID:4184

C:\Program Files\Windows Media Player\wmpnetwk.exe
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4128

C:\Program Files\Windows Media Player\wmixedwk.exe
"C:\Program Files\Windows Media Player\wmixedwk.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Modifies data under HKEY_USERS
    PID:4936
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Drops file in Program Files directory
    - Modifies data under HKEY_USERS
    PID:656
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Drops file in System32 directory
    - Drops file in Program Files directory
    PID:1612
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Drops file in System32 directory
    - Drops file in Program Files directory
    PID:4428
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Drops file in System32 directory
    - Drops file in Program Files directory
    PID:2684
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Drops file in System32 directory
    - Drops file in Program Files directory
    PID:1580
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Drops file in System32 directory
    - Drops file in Program Files directory
    PID:700
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Drops file in System32 directory
    - Drops file in Program Files directory
    PID:4960
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Drops file in System32 directory
    - Drops file in Program Files directory
    PID:2108
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Drops file in System32 directory
    - Drops file in Program Files directory
    PID:2468
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Drops file in System32 directory
    - Drops file in Program Files directory
    PID:240
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Drops file in System32 directory
    - Drops file in Program Files directory
    PID:1276
- - C:\Windows\system32\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Drops file in System32 directory
    - Drops file in Program Files directory
    PID:804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

background.jpg

Path C:\Program Files\Windows Media Player\background.jpg
Size 1.8MB
SHA256 a76ae040e6bac7e2a55acd35549e8f51fea02e525631334ca092f82e1ba26908
MD5 9ba59c9cdc78e180449aa174c12449de
SHA1 4e3b16fedae56779fd46b1e1eef4be9787d29d35
SHA512 f47f2f1961eb157fe587ed565c9c579a4a48b8633fa72e16ab31911f7c75fe3704b5bbafa98d6f09945bb6a6652530ffbfe569de6474d182266ad8e619b9a1e2
SSDEEP 49152:r8hM6jeTAcNmspQVp17N3CNGzQqahH1UGtHJBpCbqag/8PTUC:whtC7VpQVv0NGzQbhH1Faq8b
MD5 SHA1 SHA512 SSDEEP

Submit Download

mpsvc.dll

Path C:\Program Files\Windows Media Player\mpsvc.dll
Size 126KB
SHA256 757af7a540628004b446117be432342674f7830fa008f97a5f4a1ac386954bc2
MD5 7b207ce9f9d71dfc2eaa2e959634a54d
SHA1 8222daa0c820e50d02ffabdc55dfb7461bbaa1e5
SHA512 6ffbe6e33768e2fbea8c7cee428eb4b61e3eb1dd12e470de363f1d6e274296adabc8d1e681fe5a5f2b1dc8e8eb08bd360572bfd34706e82580c51be57f6fcf5a
SSDEEP 3072:+RnA1GUOnO1sQ6cbdAZuQ8khkuydvahEMXEqfW:ZGUOnO1sQ6cbSD80kukvcf
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 23KB
SHA256 ed0dc979eed9ab9933c49204d362de575c7112a792633fda75bb5d1dab50a5c2
MD5 90b85ffbdeead1be861d59134ea985b0
SHA1 55e9859aa7dba87678e7c529b571fdf6b7181339
SHA512 8a1c10bbfe5651ab25bf36f4e8f2f65424c8e1004696c8141498b99ea2fbd7b3e5fae4d2cfee6835f7ff46bd2333602f4d8ac4a0f5b8e9757adb176332a3afce
SSDEEP 384:P+5qcWB2iWZ1q//0GftpBjWfbtxO4HRN7k3ayeleAp8xlqSvmaI0:G4Sm8iUekkIpKZV
MD5 SHA1 SHA512 SSDEEP

Submit Download

aad9f05a9a826b65ff2b94740ca196c2

Path C:\Windows\Temp\aad9f05a9a826b65ff2b94740ca196c2
Size 50KB
SHA256 60e60279a0ec2bb915c564b47c6f8aca8de702a7e1b3ec0712d415dc8c559890
MD5 e31b6384f95f1bea7a1083557a05001e
SHA1 d711a24f5ab7dfd64565c1b5d8ec174cc7322800
SHA512 74a691e526432c01b7495709f672d66fd3246d7e6299234181c56a9de25aee8c590616cae3d9796201368a47c205a017f499df32cf7f5358f2c3a6f58e90a641
SSDEEP 768:5xYi3b8iPIr+kICljR23iJ+WI6uhG3zBm1kshYBFBVv+qzb:5xYi4iPITBdU3iJ+WIdAB3FPb
MD5 SHA1 SHA512 SSDEEP

Submit Download

kkxqbh.bat

Path C:\kkxqbh.bat
Size 135B
SHA256 471ff503db8bd1d39701d587ec4f2d3c97c2843a53e812fe726c970f7306fbb4
MD5 44a3af72a2e7efad7f05b5b264f2b133
SHA1 cfd7c8451a0c6e8123328b18f96bec50d04b50ab
SHA512 3d2009c7d4b82fd970ced78fe97b0d5ed08ca7a33480969deb5345195e50877e5efe8f80eeca86c63c5f87cc3779f7f9aba47eb1cca1c29656cb4f74bfd4e14a
MD5 SHA1 SHA512

Submit Download

memory/656-84-0x0000000140000000-0x00000001400D1000-memory.dmp

Download

memory/656-91-0x0000000140000000-0x00000001400D1000-memory.dmp

Download

memory/656-87-0x0000000140000000-0x00000001400D1000-memory.dmp

Download

memory/656-85-0x0000000140000000-0x00000001400D1000-memory.dmp

Download

memory/656-86-0x0000000140000000-0x00000001400D1000-memory.dmp

Download

memory/656-88-0x0000000140000000-0x00000001400D1000-memory.dmp

Download

memory/656-89-0x0000000140000000-0x00000001400D1000-memory.dmp

Download

memory/748-0-0x00007FF68914D000-0x00007FF68914F000-memory.dmp

Download

memory/748-3-0x00000201799F0000-0x0000020179A1C000-memory.dmp

Download

memory/748-76-0x00000201799F0000-0x0000020179A1C000-memory.dmp

Download

memory/748-5-0x00007FF689140000-0x00007FF68917C000-memory.dmp

Download

memory/1612-93-0x0000000140000000-0x000000014011B000-memory.dmp

Download

memory/1612-94-0x0000000140000000-0x000000014011B000-memory.dmp

Download

memory/1612-92-0x0000000140000000-0x000000014011B000-memory.dmp

Download

memory/2932-19-0x00000158C7770000-0x00000158C7780000-memory.dmp

Download

memory/2932-51-0x00000158CBD90000-0x00000158CBD98000-memory.dmp

Download

memory/2932-35-0x00000158C7870000-0x00000158C7880000-memory.dmp

Download

memory/4936-78-0x0000000140000000-0x000000014011B000-memory.dmp

Download

memory/4936-80-0x0000000140000000-0x000000014011B000-memory.dmp

Download

memory/4936-79-0x0000000140000000-0x000000014011B000-memory.dmp

Download

memory/4936-82-0x0000000140000000-0x000000014011B000-memory.dmp

Download

memory/4936-83-0x0000000140000000-0x000000014011B000-memory.dmp

Download

memory/4992-71-0x0000000140000000-0x0000000140026000-memory.dmp

Download

memory/4992-68-0x0000000140000000-0x0000000140026000-memory.dmp

Download

memory/4992-69-0x0000000140000000-0x0000000140026000-memory.dmp

Download

memory/4992-67-0x0000000140000000-0x0000000140026000-memory.dmp

Download

memory/4992-66-0x0000000140000000-0x0000000140026000-memory.dmp

Download

memory/4992-65-0x0000000140000000-0x0000000140026000-memory.dmp

Download

memory/4992-64-0x0000000140000000-0x0000000140026000-memory.dmp

Download

memory/4992-63-0x0000000140000000-0x0000000140026000-memory.dmp

Download

memory/4992-72-0x0000000140000000-0x0000000140026000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads