Malware Analysis Report

2024-09-11 05:55

Sample ID 240606-q61ecafa2y
Target 0f2f8df833c6909b4f0b27556d07eda23bfcce84a365c667cdaef22f3fba008f
SHA256 0f2f8df833c6909b4f0b27556d07eda23bfcce84a365c667cdaef22f3fba008f
Tags
discovery execution exploit persistence upx
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

0f2f8df833c6909b4f0b27556d07eda23bfcce84a365c667cdaef22f3fba008f

Threat Level: Likely malicious

The file 0f2f8df833c6909b4f0b27556d07eda23bfcce84a365c667cdaef22f3fba008f was found to be: Likely malicious.

Malicious Activity Summary

discovery execution exploit persistence upx

Creates new service(s)

Possible privilege escalation attempt

Checks computer location settings

UPX packed file

Executes dropped EXE

Loads dropped DLL

Modifies file permissions

Enumerates connected drives

Drops file in System32 directory

Suspicious use of SetThreadContext

Drops file in Program Files directory

Launches sc.exe

Unsigned PE

Enumerates physical storage devices

Modifies data under HKEY_USERS

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Runs ping.exe

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
System Services
T1569
Service Execution
T1569.002
Persistence
TA0003
Create or Modify System Process
T1543
Windows Service
T1543.003
Privilege Escalation
TA0004
Create or Modify System Process
T1543
Windows Service
T1543.003
Defense Evasion
TA0005
File and Directory Permissions Modification
T1222
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Remote System Discovery
T1018
Peripheral Device Discovery
T1120
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-06 13:53

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-06 13:53

Reported

2024-06-06 13:55

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0f2f8df833c6909b4f0b27556d07eda23bfcce84a365c667cdaef22f3fba008f.exe"

Signatures

Creates new service(s)

persistence execution

Possible privilege escalation attempt

exploit
Description Indicator Process Target
N/A N/A C:\Windows\system32\takeown.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\0f2f8df833c6909b4f0b27556d07eda23bfcce84a365c667cdaef22f3fba008f.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
N/A N/A C:\Program Files\Windows Media Player\wmixedwk.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
N/A N/A C:\Program Files\Windows Media Player\wmixedwk.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\takeown.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\config\systemprofile\AppData\Local\4544.hecate C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\Local\404.hecate C:\Windows\system32\svchost.exe N/A
File created C:\Windows\System32\config\systemprofile\AppData\Local\info C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\Local\3212.hecate C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\Local\2232.hecate C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\Local\4300.hecate C:\Windows\system32\svchost.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 8 set thread context of 4620 N/A C:\Program Files\Windows Media Player\wmixedwk.exe C:\Windows\system32\svchost.exe
PID 4620 set thread context of 404 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 4620 set thread context of 544 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 4620 set thread context of 4544 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 4620 set thread context of 3212 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 4620 set thread context of 2232 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 4620 set thread context of 4300 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Windows Media Player\mpsvc.dll C:\Users\Admin\AppData\Local\Temp\0f2f8df833c6909b4f0b27556d07eda23bfcce84a365c667cdaef22f3fba008f.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmixedwk.exe C:\Users\Admin\AppData\Local\Temp\0f2f8df833c6909b4f0b27556d07eda23bfcce84a365c667cdaef22f3fba008f.exe N/A
File opened for modification C:\Program Files\Windows Media Player\ppqqxds C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Program Files\Windows Media Player\ppqqxpb C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Program Files\Windows Media Player\ppqqxpb C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Program Files\Windows Media Player\mpsvc.dll C:\Windows\system32\svchost.exe N/A
File created C:\Program Files\Windows Media Player\down_info C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Program Files\Windows Media Player\ppqqxpp C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Program Files\Windows Media Player\ppqqxpb C:\Windows\system32\svchost.exe N/A
File created C:\Program Files\Windows Media Player\background.jpg C:\Users\Admin\AppData\Local\Temp\0f2f8df833c6909b4f0b27556d07eda23bfcce84a365c667cdaef22f3fba008f.exe N/A
File created C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Users\Admin\AppData\Local\Temp\0f2f8df833c6909b4f0b27556d07eda23bfcce84a365c667cdaef22f3fba008f.exe N/A
File created C:\Program Files\Windows Media Player\wmixedwk.exe C:\Users\Admin\AppData\Local\Temp\0f2f8df833c6909b4f0b27556d07eda23bfcce84a365c667cdaef22f3fba008f.exe N/A
File opened for modification C:\Program Files\Windows Media Player\ppqqxpa C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Program Files\Windows Media Player\ppqqxpb C:\Windows\system32\svchost.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A

Enumerates physical storage devices

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fe9a12fa18b8da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\svchost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cd1e98fa18b8da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000befb33fa18b8da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008e8ac1f918b8da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bed7eef918b8da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009563baf918b8da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e2ffd6f918b8da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001d215afa18b8da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000086827bfa18b8da01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" C:\Windows\system32\SearchProtocolHost.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\takeown.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4476 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\0f2f8df833c6909b4f0b27556d07eda23bfcce84a365c667cdaef22f3fba008f.exe C:\Windows\System32\cmd.exe
PID 4476 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\0f2f8df833c6909b4f0b27556d07eda23bfcce84a365c667cdaef22f3fba008f.exe C:\Windows\System32\cmd.exe
PID 2544 wrote to memory of 3356 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\takeown.exe
PID 2544 wrote to memory of 3356 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\takeown.exe
PID 2544 wrote to memory of 1000 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\icacls.exe
PID 2544 wrote to memory of 1000 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\icacls.exe
PID 8 wrote to memory of 4620 N/A C:\Program Files\Windows Media Player\wmixedwk.exe C:\Windows\system32\svchost.exe
PID 8 wrote to memory of 4620 N/A C:\Program Files\Windows Media Player\wmixedwk.exe C:\Windows\system32\svchost.exe
PID 8 wrote to memory of 4620 N/A C:\Program Files\Windows Media Player\wmixedwk.exe C:\Windows\system32\svchost.exe
PID 8 wrote to memory of 4620 N/A C:\Program Files\Windows Media Player\wmixedwk.exe C:\Windows\system32\svchost.exe
PID 8 wrote to memory of 4620 N/A C:\Program Files\Windows Media Player\wmixedwk.exe C:\Windows\system32\svchost.exe
PID 8 wrote to memory of 4620 N/A C:\Program Files\Windows Media Player\wmixedwk.exe C:\Windows\system32\svchost.exe
PID 8 wrote to memory of 4620 N/A C:\Program Files\Windows Media Player\wmixedwk.exe C:\Windows\system32\svchost.exe
PID 8 wrote to memory of 4620 N/A C:\Program Files\Windows Media Player\wmixedwk.exe C:\Windows\system32\svchost.exe
PID 8 wrote to memory of 4620 N/A C:\Program Files\Windows Media Player\wmixedwk.exe C:\Windows\system32\svchost.exe
PID 8 wrote to memory of 4620 N/A C:\Program Files\Windows Media Player\wmixedwk.exe C:\Windows\system32\svchost.exe
PID 8 wrote to memory of 4620 N/A C:\Program Files\Windows Media Player\wmixedwk.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 404 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 404 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 404 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 404 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 404 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 404 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 404 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 4476 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\0f2f8df833c6909b4f0b27556d07eda23bfcce84a365c667cdaef22f3fba008f.exe C:\Windows\System32\cmd.exe
PID 4476 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\0f2f8df833c6909b4f0b27556d07eda23bfcce84a365c667cdaef22f3fba008f.exe C:\Windows\System32\cmd.exe
PID 4620 wrote to memory of 544 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 544 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 4476 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\0f2f8df833c6909b4f0b27556d07eda23bfcce84a365c667cdaef22f3fba008f.exe C:\Windows\system32\cmd.exe
PID 4476 wrote to memory of 892 N/A C:\Users\Admin\AppData\Local\Temp\0f2f8df833c6909b4f0b27556d07eda23bfcce84a365c667cdaef22f3fba008f.exe C:\Windows\system32\cmd.exe
PID 4620 wrote to memory of 544 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 544 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 544 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 544 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 544 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 544 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 544 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 544 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 544 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 4544 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 4544 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 4544 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 4544 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 4544 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 4544 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 4544 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 892 wrote to memory of 3792 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE
PID 892 wrote to memory of 3792 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE
PID 3280 wrote to memory of 3116 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\sc.exe
PID 3280 wrote to memory of 3116 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\sc.exe
PID 4688 wrote to memory of 3824 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 4688 wrote to memory of 3824 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchProtocolHost.exe
PID 4688 wrote to memory of 2432 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 4688 wrote to memory of 2432 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 4620 wrote to memory of 3212 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 3212 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 3212 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 3212 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 3212 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 3212 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 3212 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 2232 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 2232 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 4620 wrote to memory of 2232 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0f2f8df833c6909b4f0b27556d07eda23bfcce84a365c667cdaef22f3fba008f.exe

"C:\Users\Admin\AppData\Local\Temp\0f2f8df833c6909b4f0b27556d07eda23bfcce84a365c667cdaef22f3fba008f.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" cmd /c takeown /f "C:\Program Files\Windows Media Player\wmpnetwk.exe" && icacls "C:\Program Files\Windows Media Player\wmpnetwk.exe" /grant administrators:F

C:\Windows\system32\takeown.exe

takeown /f "C:\Program Files\Windows Media Player\wmpnetwk.exe"

C:\Windows\system32\icacls.exe

icacls "C:\Program Files\Windows Media Player\wmpnetwk.exe" /grant administrators:F

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Program Files\Windows Media Player\wmpnetwk.exe

"C:\Program Files\Windows Media Player\wmpnetwk.exe"

C:\Program Files\Windows Media Player\wmixedwk.exe

"C:\Program Files\Windows Media Player\wmixedwk.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe

"C:\Windows\system32\svchost.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" cmd /c sc create "Accecss Auto Connetcion Manager" binPath= "C:\Program Files\Windows Media Player\wmixedwk.exe" START= auto DISPLAYNAME= "WebServer" TYPE= own

C:\Windows\system32\svchost.exe

"C:\Windows\system32\svchost.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\kkxqbh.bat" "

C:\Windows\system32\svchost.exe

"C:\Windows\system32\svchost.exe"

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 3

C:\Windows\system32\sc.exe

sc create "Accecss Auto Connetcion Manager" binPath= "C:\Program Files\Windows Media Player\wmixedwk.exe" START= auto DISPLAYNAME= "WebServer" TYPE= own

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 804 808 816 8192 812 788

C:\Windows\system32\svchost.exe

"C:\Windows\system32\svchost.exe"

C:\Windows\system32\svchost.exe

"C:\Windows\system32\svchost.exe"

C:\Windows\system32\svchost.exe

"C:\Windows\system32\svchost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 sta.alie3ksgee.com udp
HK 103.146.158.221:80 sta.alie3ksgee.com tcp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 221.158.146.103.in-addr.arpa udp
NL 23.62.61.114:443 www.bing.com tcp
US 8.8.8.8:53 114.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 myxqbh.top udp
CN 106.4.228.137:6666 myxqbh.top udp
US 8.8.8.8:53 137.228.4.106.in-addr.arpa udp
HK 103.146.158.221:80 sta.alie3ksgee.com tcp
US 8.8.8.8:53 cl.alie3ksgff.com udp
US 104.238.164.6:6666 cl.alie3ksgff.com udp
US 8.8.8.8:53 6.164.238.104.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
CN 106.4.228.137:6666 myxqbh.top udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
CN 106.4.228.137:6666 myxqbh.top udp
CN 106.4.228.137:6666 myxqbh.top udp

Files

memory/4476-0-0x00007FF69573D000-0x00007FF69573E000-memory.dmp

memory/4476-3-0x000001EADFB60000-0x000001EADFB8C000-memory.dmp

memory/4476-5-0x00007FF695730000-0x00007FF69577D000-memory.dmp

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 90b85ffbdeead1be861d59134ea985b0
SHA1 55e9859aa7dba87678e7c529b571fdf6b7181339
SHA256 ed0dc979eed9ab9933c49204d362de575c7112a792633fda75bb5d1dab50a5c2
SHA512 8a1c10bbfe5651ab25bf36f4e8f2f65424c8e1004696c8141498b99ea2fbd7b3e5fae4d2cfee6835f7ff46bd2333602f4d8ac4a0f5b8e9757adb176332a3afce

memory/4688-19-0x000002028D180000-0x000002028D190000-memory.dmp

memory/4688-35-0x000002028D280000-0x000002028D290000-memory.dmp

memory/4688-51-0x0000020291770000-0x0000020291778000-memory.dmp

C:\Program Files\Windows Media Player\mpsvc.dll

MD5 7b207ce9f9d71dfc2eaa2e959634a54d
SHA1 8222daa0c820e50d02ffabdc55dfb7461bbaa1e5
SHA256 757af7a540628004b446117be432342674f7830fa008f97a5f4a1ac386954bc2
SHA512 6ffbe6e33768e2fbea8c7cee428eb4b61e3eb1dd12e470de363f1d6e274296adabc8d1e681fe5a5f2b1dc8e8eb08bd360572bfd34706e82580c51be57f6fcf5a

C:\Program Files\Windows Media Player\background.jpg

MD5 b37c3d3ab20f7e8a06232330122d1ed7
SHA1 6daa977d591b1cbb1ecde9fd82e14287a284bdd2
SHA256 e796f0d6d6960af232a1b8f039cd45a703c1743dfd6f4098cdde0a46a69e33a2
SHA512 da26eee1e9f1d594f2f4604838b66dac95db29373a59e347b1cf31022eb0040f5a9ebdd50c12f4af1dbbfd7c5bae20f3937cbdd8016e441d8822f9f86d03e5bb

memory/4620-69-0x0000000140000000-0x0000000140026000-memory.dmp

memory/4620-72-0x0000000140000000-0x0000000140026000-memory.dmp

memory/4476-82-0x000001EADFB60000-0x000001EADFB8C000-memory.dmp

memory/544-85-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/544-89-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/544-93-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/544-92-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/544-88-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/544-87-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/544-84-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/544-83-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/544-86-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/404-78-0x0000000140000000-0x0000000140138000-memory.dmp

memory/404-77-0x0000000140000000-0x0000000140138000-memory.dmp

memory/404-75-0x0000000140000000-0x0000000140138000-memory.dmp

memory/404-74-0x0000000140000000-0x0000000140138000-memory.dmp

memory/404-73-0x0000000140000000-0x0000000140138000-memory.dmp

memory/4620-71-0x0000000140000000-0x0000000140026000-memory.dmp

memory/4620-68-0x0000000140000000-0x0000000140026000-memory.dmp

memory/4620-67-0x0000000140000000-0x0000000140026000-memory.dmp

memory/4620-66-0x0000000140000000-0x0000000140026000-memory.dmp

memory/4620-65-0x0000000140000000-0x0000000140026000-memory.dmp

memory/4620-64-0x0000000140000000-0x0000000140026000-memory.dmp

memory/4620-63-0x0000000140000000-0x0000000140026000-memory.dmp

C:\kkxqbh.bat

MD5 cd2919467d9c30843ae74c4226c5e107
SHA1 8730f46a7e36193fd3a2b9777812184a68efb444
SHA256 be24bb1831d6aa036df0ea77b53456e498f98e8d10098f0eab9dc3f65c4acdab
SHA512 523ef0364e9ae4abebda00df476ffb74db545a73b8eaf937945318c40e96acf933119c409ec009a235b78a4cd09114e93edf877d482999f5156dbc62e6379e6c

C:\Program Files\Windows Media Player\down_info

MD5 ac4e7a4f341e7281b0f6f274f9ec3905
SHA1 eb893c0ea7907618ccb316fd2e7aa6b10ff1ab6e
SHA256 ac3d60f67cb8e0f43595e1875fb4566f43ecb54427a1057345c4024533c17992
SHA512 563a86af52b189bebc910d7368353a2ce3d15f1d9d405ac47ef2f5321c21a76a33a6fe39615a2d786dacdd001e8d5672e1b95165bdb1be81f562eee7d8e7dbe1

C:\Windows\Temp\aad9f05a9a826b65ff2b94740ca196c2

MD5 6818c49c323bf6fe3031220e1d77872a
SHA1 3dc0ff556965ac00f06174e24ed1b0d47f8811f1
SHA256 66ee1faa0050ad0c536d40fba5e6bfa771eddfa40c7b45fb4900492f48e67a96
SHA512 9ac6b687a3edb249b241765390e941301653baf7651ea7416dc36c8c9a0357ca268b848d23c2e96c9802f3a04bf3f2eb336d40e081c29bb852896100c89a28cb

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-06 13:53

Reported

2024-06-06 13:55

Platform

win11-20240426-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0f2f8df833c6909b4f0b27556d07eda23bfcce84a365c667cdaef22f3fba008f.exe"

Signatures

Creates new service(s)

persistence execution

Possible privilege escalation attempt

exploit
Description Indicator Process Target
N/A N/A C:\Windows\system32\takeown.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
N/A N/A C:\Program Files\Windows Media Player\wmixedwk.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Program Files\Windows Media Player\wmpnetwk.exe N/A
N/A N/A C:\Program Files\Windows Media Player\wmixedwk.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\takeown.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\m: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\q: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\x: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\y: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\b: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\i: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\u: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\o: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\l: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\p: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\t: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\g: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\k: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\v: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\z: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\h: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\r: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\s: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\D: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\e: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\w: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\F: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\n: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\a: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\j: C:\Windows\system32\SearchIndexer.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\SearchIndexer.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\config\systemprofile\AppData\Local\2380.hecate C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\Local\5040.hecate C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\Local\1240.hecate C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\Local\812.hecate C:\Windows\system32\svchost.exe N/A
File created C:\Windows\System32\config\systemprofile\AppData\Local\info C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\Local\4668.hecate C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Windows\System32\config\systemprofile\AppData\Local\4084.hecate C:\Windows\system32\svchost.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3080 set thread context of 2396 N/A C:\Program Files\Windows Media Player\wmixedwk.exe C:\Windows\system32\svchost.exe
PID 2396 set thread context of 812 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 2396 set thread context of 1116 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 2396 set thread context of 1240 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 2396 set thread context of 4668 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 2396 set thread context of 4084 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 2396 set thread context of 2380 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 2396 set thread context of 5040 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Windows Media Player\background.jpg C:\Users\Admin\AppData\Local\Temp\0f2f8df833c6909b4f0b27556d07eda23bfcce84a365c667cdaef22f3fba008f.exe N/A
File created C:\Program Files\Windows Media Player\mpsvc.dll C:\Users\Admin\AppData\Local\Temp\0f2f8df833c6909b4f0b27556d07eda23bfcce84a365c667cdaef22f3fba008f.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmixedwk.exe C:\Users\Admin\AppData\Local\Temp\0f2f8df833c6909b4f0b27556d07eda23bfcce84a365c667cdaef22f3fba008f.exe N/A
File created C:\Program Files\Windows Media Player\wmixedwk.exe C:\Users\Admin\AppData\Local\Temp\0f2f8df833c6909b4f0b27556d07eda23bfcce84a365c667cdaef22f3fba008f.exe N/A
File opened for modification C:\Program Files\Windows Media Player\ppqqxpp C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Program Files\Windows Media Player\ppqqxpb C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Program Files\Windows Media Player\ppqqxpb C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Program Files\Windows Media Player\ppqqxpb C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Program Files\Windows Media Player\ppqqxpa C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Program Files\Windows Media Player\ppqqxpb C:\Windows\system32\svchost.exe N/A
File created C:\Program Files\Windows Media Player\down_info C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Program Files\Windows Media Player\ppqqxpb C:\Windows\system32\svchost.exe N/A
File created C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Users\Admin\AppData\Local\Temp\0f2f8df833c6909b4f0b27556d07eda23bfcce84a365c667cdaef22f3fba008f.exe N/A
File opened for modification C:\Program Files\Windows Media Player\ppqqxds C:\Windows\system32\svchost.exe N/A
File opened for modification C:\Program Files\Windows Media Player\mpsvc.dll C:\Windows\system32\svchost.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A

Enumerates physical storage devices

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000094e07f1319b8da01 C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B} C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008ca5841319b8da01 C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2 C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2 C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000065e88a1419b8da01 C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003a7d501019b8da01 C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e9f9351319b8da01 C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" C:\Windows\system32\svchost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d6f4731319b8da01 C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File" C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a6bb591319b8da01 C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000da65e61319b8da01 C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document" C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\System32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" C:\Windows\System32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" C:\Windows\System32\SearchProtocolHost.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\takeown.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 784 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\0f2f8df833c6909b4f0b27556d07eda23bfcce84a365c667cdaef22f3fba008f.exe C:\Windows\System32\cmd.exe
PID 784 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\0f2f8df833c6909b4f0b27556d07eda23bfcce84a365c667cdaef22f3fba008f.exe C:\Windows\System32\cmd.exe
PID 2272 wrote to memory of 4568 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\takeown.exe
PID 2272 wrote to memory of 4568 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\takeown.exe
PID 2272 wrote to memory of 5032 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\icacls.exe
PID 2272 wrote to memory of 5032 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\icacls.exe
PID 3080 wrote to memory of 2396 N/A C:\Program Files\Windows Media Player\wmixedwk.exe C:\Windows\system32\svchost.exe
PID 3080 wrote to memory of 2396 N/A C:\Program Files\Windows Media Player\wmixedwk.exe C:\Windows\system32\svchost.exe
PID 3080 wrote to memory of 2396 N/A C:\Program Files\Windows Media Player\wmixedwk.exe C:\Windows\system32\svchost.exe
PID 3080 wrote to memory of 2396 N/A C:\Program Files\Windows Media Player\wmixedwk.exe C:\Windows\system32\svchost.exe
PID 3080 wrote to memory of 2396 N/A C:\Program Files\Windows Media Player\wmixedwk.exe C:\Windows\system32\svchost.exe
PID 3080 wrote to memory of 2396 N/A C:\Program Files\Windows Media Player\wmixedwk.exe C:\Windows\system32\svchost.exe
PID 3080 wrote to memory of 2396 N/A C:\Program Files\Windows Media Player\wmixedwk.exe C:\Windows\system32\svchost.exe
PID 3080 wrote to memory of 2396 N/A C:\Program Files\Windows Media Player\wmixedwk.exe C:\Windows\system32\svchost.exe
PID 3080 wrote to memory of 2396 N/A C:\Program Files\Windows Media Player\wmixedwk.exe C:\Windows\system32\svchost.exe
PID 3080 wrote to memory of 2396 N/A C:\Program Files\Windows Media Player\wmixedwk.exe C:\Windows\system32\svchost.exe
PID 3080 wrote to memory of 2396 N/A C:\Program Files\Windows Media Player\wmixedwk.exe C:\Windows\system32\svchost.exe
PID 4712 wrote to memory of 4908 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\System32\SearchProtocolHost.exe
PID 4712 wrote to memory of 4908 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\System32\SearchProtocolHost.exe
PID 2396 wrote to memory of 812 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 2396 wrote to memory of 812 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 2396 wrote to memory of 812 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 2396 wrote to memory of 812 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 2396 wrote to memory of 812 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 2396 wrote to memory of 812 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 2396 wrote to memory of 812 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 2396 wrote to memory of 1116 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 2396 wrote to memory of 1116 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 2396 wrote to memory of 1116 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 2396 wrote to memory of 1116 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 2396 wrote to memory of 1116 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 2396 wrote to memory of 1116 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 2396 wrote to memory of 1116 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 2396 wrote to memory of 1116 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 2396 wrote to memory of 1116 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 2396 wrote to memory of 1116 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 2396 wrote to memory of 1116 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 2396 wrote to memory of 1240 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 2396 wrote to memory of 1240 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 2396 wrote to memory of 1240 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 2396 wrote to memory of 1240 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 2396 wrote to memory of 1240 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 2396 wrote to memory of 1240 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 2396 wrote to memory of 1240 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 784 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\0f2f8df833c6909b4f0b27556d07eda23bfcce84a365c667cdaef22f3fba008f.exe C:\Windows\System32\cmd.exe
PID 784 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\0f2f8df833c6909b4f0b27556d07eda23bfcce84a365c667cdaef22f3fba008f.exe C:\Windows\System32\cmd.exe
PID 784 wrote to memory of 4840 N/A C:\Users\Admin\AppData\Local\Temp\0f2f8df833c6909b4f0b27556d07eda23bfcce84a365c667cdaef22f3fba008f.exe C:\Windows\system32\cmd.exe
PID 784 wrote to memory of 4840 N/A C:\Users\Admin\AppData\Local\Temp\0f2f8df833c6909b4f0b27556d07eda23bfcce84a365c667cdaef22f3fba008f.exe C:\Windows\system32\cmd.exe
PID 2688 wrote to memory of 580 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\sc.exe
PID 2688 wrote to memory of 580 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\sc.exe
PID 4840 wrote to memory of 4360 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE
PID 4840 wrote to memory of 4360 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE
PID 4712 wrote to memory of 3512 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 4712 wrote to memory of 3512 N/A C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\SearchFilterHost.exe
PID 2396 wrote to memory of 4668 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 2396 wrote to memory of 4668 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 2396 wrote to memory of 4668 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 2396 wrote to memory of 4668 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 2396 wrote to memory of 4668 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 2396 wrote to memory of 4668 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 2396 wrote to memory of 4668 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 2396 wrote to memory of 4084 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 2396 wrote to memory of 4084 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe
PID 2396 wrote to memory of 4084 N/A C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0f2f8df833c6909b4f0b27556d07eda23bfcce84a365c667cdaef22f3fba008f.exe

"C:\Users\Admin\AppData\Local\Temp\0f2f8df833c6909b4f0b27556d07eda23bfcce84a365c667cdaef22f3fba008f.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" cmd /c takeown /f "C:\Program Files\Windows Media Player\wmpnetwk.exe" && icacls "C:\Program Files\Windows Media Player\wmpnetwk.exe" /grant administrators:F

C:\Windows\system32\takeown.exe

takeown /f "C:\Program Files\Windows Media Player\wmpnetwk.exe"

C:\Windows\system32\icacls.exe

icacls "C:\Program Files\Windows Media Player\wmpnetwk.exe" /grant administrators:F

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Program Files\Windows Media Player\wmpnetwk.exe

"C:\Program Files\Windows Media Player\wmpnetwk.exe"

C:\Program Files\Windows Media Player\wmixedwk.exe

"C:\Program Files\Windows Media Player\wmixedwk.exe"

C:\Windows\System32\SearchProtocolHost.exe

"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe

"C:\Windows\system32\svchost.exe"

C:\Windows\system32\svchost.exe

"C:\Windows\system32\svchost.exe"

C:\Windows\system32\svchost.exe

"C:\Windows\system32\svchost.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" cmd /c sc create "Accecss Auto Connetcion Manager" binPath= "C:\Program Files\Windows Media Player\wmixedwk.exe" START= auto DISPLAYNAME= "WebServer" TYPE= own

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\kkxqbh.bat" "

C:\Windows\system32\sc.exe

sc create "Accecss Auto Connetcion Manager" binPath= "C:\Program Files\Windows Media Player\wmixedwk.exe" START= auto DISPLAYNAME= "WebServer" TYPE= own

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 3

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 828 2532 2620 812 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}

C:\Windows\system32\svchost.exe

"C:\Windows\system32\svchost.exe"

C:\Windows\system32\svchost.exe

"C:\Windows\system32\svchost.exe"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 828 2616 2612 812 {85EE815A-7738-4808-A14A-3AD87E32A3BF}

C:\Windows\system32\svchost.exe

"C:\Windows\system32\svchost.exe"

C:\Windows\system32\svchost.exe

"C:\Windows\system32\svchost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 sta.alie3ksgee.com udp
HK 103.146.158.221:80 sta.alie3ksgee.com tcp
CN 106.4.228.137:6666 myxqbh.top udp
HK 103.146.158.221:80 sta.alie3ksgee.com tcp
US 104.238.164.6:6666 cl.alie3ksgff.com udp
CN 106.4.228.137:6666 myxqbh.top udp
NL 52.111.243.31:443 tcp
CN 106.4.228.137:6666 myxqbh.top udp
CN 106.4.228.137:6666 myxqbh.top udp
CN 106.4.228.137:6666 myxqbh.top udp

Files

memory/784-0-0x00007FF6BC86D000-0x00007FF6BC86E000-memory.dmp

memory/784-4-0x0000023E17A30000-0x0000023E17A5C000-memory.dmp

memory/784-5-0x00007FF6BC860000-0x00007FF6BC8AD000-memory.dmp

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 90b85ffbdeead1be861d59134ea985b0
SHA1 55e9859aa7dba87678e7c529b571fdf6b7181339
SHA256 ed0dc979eed9ab9933c49204d362de575c7112a792633fda75bb5d1dab50a5c2
SHA512 8a1c10bbfe5651ab25bf36f4e8f2f65424c8e1004696c8141498b99ea2fbd7b3e5fae4d2cfee6835f7ff46bd2333602f4d8ac4a0f5b8e9757adb176332a3afce

memory/4712-19-0x0000019EA7770000-0x0000019EA7780000-memory.dmp

memory/4712-36-0x0000019EA7880000-0x0000019EA7890000-memory.dmp

memory/4712-51-0x0000019EABD60000-0x0000019EABD68000-memory.dmp

C:\Program Files\Windows Media Player\mpsvc.dll

MD5 7b207ce9f9d71dfc2eaa2e959634a54d
SHA1 8222daa0c820e50d02ffabdc55dfb7461bbaa1e5
SHA256 757af7a540628004b446117be432342674f7830fa008f97a5f4a1ac386954bc2
SHA512 6ffbe6e33768e2fbea8c7cee428eb4b61e3eb1dd12e470de363f1d6e274296adabc8d1e681fe5a5f2b1dc8e8eb08bd360572bfd34706e82580c51be57f6fcf5a

C:\Program Files\Windows Media Player\background.jpg

MD5 b37c3d3ab20f7e8a06232330122d1ed7
SHA1 6daa977d591b1cbb1ecde9fd82e14287a284bdd2
SHA256 e796f0d6d6960af232a1b8f039cd45a703c1743dfd6f4098cdde0a46a69e33a2
SHA512 da26eee1e9f1d594f2f4604838b66dac95db29373a59e347b1cf31022eb0040f5a9ebdd50c12f4af1dbbfd7c5bae20f3937cbdd8016e441d8822f9f86d03e5bb

memory/2396-68-0x0000000140000000-0x0000000140026000-memory.dmp

memory/2396-72-0x0000000140000000-0x0000000140026000-memory.dmp

memory/2396-71-0x0000000140000000-0x0000000140026000-memory.dmp

memory/2396-69-0x0000000140000000-0x0000000140026000-memory.dmp

memory/812-78-0x0000000140000000-0x0000000140138000-memory.dmp

memory/1240-91-0x0000000140000000-0x000000014011B000-memory.dmp

memory/1240-90-0x0000000140000000-0x000000014011B000-memory.dmp

C:\kkxqbh.bat

MD5 cd2919467d9c30843ae74c4226c5e107
SHA1 8730f46a7e36193fd3a2b9777812184a68efb444
SHA256 be24bb1831d6aa036df0ea77b53456e498f98e8d10098f0eab9dc3f65c4acdab
SHA512 523ef0364e9ae4abebda00df476ffb74db545a73b8eaf937945318c40e96acf933119c409ec009a235b78a4cd09114e93edf877d482999f5156dbc62e6379e6c

memory/1116-88-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/1116-87-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/1116-85-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/1116-84-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/1116-83-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/1116-82-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/1116-81-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/1116-79-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/812-77-0x0000000140000000-0x0000000140138000-memory.dmp

memory/1116-80-0x0000000140000000-0x00000001400D4000-memory.dmp

memory/812-75-0x0000000140000000-0x0000000140138000-memory.dmp

memory/812-74-0x0000000140000000-0x0000000140138000-memory.dmp

memory/812-73-0x0000000140000000-0x0000000140138000-memory.dmp

memory/2396-67-0x0000000140000000-0x0000000140026000-memory.dmp

memory/2396-66-0x0000000140000000-0x0000000140026000-memory.dmp

memory/2396-65-0x0000000140000000-0x0000000140026000-memory.dmp

memory/2396-64-0x0000000140000000-0x0000000140026000-memory.dmp

memory/2396-63-0x0000000140000000-0x0000000140026000-memory.dmp

C:\Program Files\Windows Media Player\down_info

MD5 1625abb8e458a79765c62009235e9d5b
SHA1 b3da4875fff0557da501956724d949823a99cf09
SHA256 d2572ef3561449939bbcfb2fa6ed0fa21b00a2362b271e73280d8f97ee2c02a7
SHA512 2bd3de3c43766b5a9ee6c4c266525321266c92c487e4561496975f2bdbcb2ff25d1f4803be2d8655721151eff8f6f588e62a96f0a36fcb8aa0870e5a5e02755f

C:\Windows\Temp\aad9f05a9a826b65ff2b94740ca196c2

MD5 7f2036ac190fd3d9dc19476d455b94d3
SHA1 2cae888d88599a5f9400e2429951fe8b767aee73
SHA256 b612d28109c96badd483f45bd826fa05a7dd60388894ff6f404cfadd720a9922
SHA512 1e3d2c658b49a1da5c98d36a5cb13e55485de67cfe161ac38e4c00a898843cc30dcee2f136e80f91a0ce9c106116b9954db8cac44361b36f3db98f300c5d7d30