Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
175s -
max time network
189s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03/07/2024, 19:27
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
1800 seconds
Behavioral task
behavioral2
Sample
Client-built.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
17 signatures
1800 seconds
Errors
Reason
Machine shutdown
General
-
Target
Client-built.exe
-
Size
78KB
-
MD5
702e3d2fe467271a3e3f892bfe309cc4
-
SHA1
48694b9e4bd02a1e7c0c68b09cfa3952913f6113
-
SHA256
bb5c3700d7aed3cf8da3e655577f36bd8662566312488cf85035bd310c50f6cb
-
SHA512
0e9e3f0ec6cfe3cff8bbff5dda0ffcf562cfce804552a16e2f2e2ae3897d9c793256ee9196cff4282c467f5ab6758095f69a3dd293a3608f8665968efe49f6ed
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+rPIC:5Zv5PDwbjNrmAE+DIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTI0NzYyMjc1MDMwNzA5NDYwOQ.G75kCj.oUUW-eN7iy9fOSU_z7eZ2sZU33L8Wqa1p6jziw
-
server_id
1247622541909164062
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 4876 created 616 4876 Client-built.exe 5 -
Downloads MZ/PE file
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 24 IoCs
flow ioc 34 discord.com 56 raw.githubusercontent.com 58 discord.com 65 discord.com 15 discord.com 22 discord.com 32 discord.com 57 raw.githubusercontent.com 70 discord.com 78 discord.com 80 raw.githubusercontent.com 35 discord.com 60 discord.com 64 discord.com 66 discord.com 69 discord.com 71 discord.com 16 discord.com 33 discord.com 67 discord.com 68 raw.githubusercontent.com 79 discord.com 85 raw.githubusercontent.com 86 discord.com -
Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187 OfficeClickToRun.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04 svchost.exe File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187 OfficeClickToRun.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml OfficeClickToRun.exe File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx svchost.exe File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A svchost.exe File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4876 set thread context of 1464 4876 Client-built.exe 90 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe -
Checks SCSI registry key(s) 3 TTPs 29 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Mfg wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service wmiprvse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000\LogConf wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags wmiprvse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID RuntimeBroker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID RuntimeBroker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 RuntimeBroker.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Mfg wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName wmiprvse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 RuntimeBroker.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName wmiprvse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 RuntimeBroker.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID RuntimeBroker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID wmiprvse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000\LogConf wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs wmiprvse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 RuntimeBroker.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID RuntimeBroker.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1720034988" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry OfficeClickToRun.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617" OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Wed, 03 Jul 2024 19:29:49 GMT" OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={8B7A11B3-DFB2-4302-BB6C-2DF5F3E835FF}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&" OfficeClickToRun.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 OfficeClickToRun.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ RuntimeBroker.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4876 Client-built.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 4876 Client-built.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 4876 Client-built.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 4876 Client-built.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 4876 Client-built.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 4876 Client-built.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 4876 Client-built.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3448 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4876 Client-built.exe Token: SeDebugPrivilege 4876 Client-built.exe Token: SeDebugPrivilege 1464 dllhost.exe Token: SeAuditPrivilege 2340 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1744 svchost.exe Token: SeIncreaseQuotaPrivilege 1744 svchost.exe Token: SeSecurityPrivilege 1744 svchost.exe Token: SeTakeOwnershipPrivilege 1744 svchost.exe Token: SeLoadDriverPrivilege 1744 svchost.exe Token: SeSystemtimePrivilege 1744 svchost.exe Token: SeBackupPrivilege 1744 svchost.exe Token: SeRestorePrivilege 1744 svchost.exe Token: SeShutdownPrivilege 1744 svchost.exe Token: SeSystemEnvironmentPrivilege 1744 svchost.exe Token: SeUndockPrivilege 1744 svchost.exe Token: SeManageVolumePrivilege 1744 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1744 svchost.exe Token: SeIncreaseQuotaPrivilege 1744 svchost.exe Token: SeSecurityPrivilege 1744 svchost.exe Token: SeTakeOwnershipPrivilege 1744 svchost.exe Token: SeLoadDriverPrivilege 1744 svchost.exe Token: SeSystemtimePrivilege 1744 svchost.exe Token: SeBackupPrivilege 1744 svchost.exe Token: SeRestorePrivilege 1744 svchost.exe Token: SeShutdownPrivilege 1744 svchost.exe Token: SeSystemEnvironmentPrivilege 1744 svchost.exe Token: SeUndockPrivilege 1744 svchost.exe Token: SeManageVolumePrivilege 1744 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1744 svchost.exe Token: SeIncreaseQuotaPrivilege 1744 svchost.exe Token: SeSecurityPrivilege 1744 svchost.exe Token: SeTakeOwnershipPrivilege 1744 svchost.exe Token: SeLoadDriverPrivilege 1744 svchost.exe Token: SeSystemtimePrivilege 1744 svchost.exe Token: SeBackupPrivilege 1744 svchost.exe Token: SeRestorePrivilege 1744 svchost.exe Token: SeShutdownPrivilege 1744 svchost.exe Token: SeSystemEnvironmentPrivilege 1744 svchost.exe Token: SeUndockPrivilege 1744 svchost.exe Token: SeManageVolumePrivilege 1744 svchost.exe Token: SeSecurityPrivilege 2932 TiWorker.exe Token: SeRestorePrivilege 2932 TiWorker.exe Token: SeBackupPrivilege 2932 TiWorker.exe Token: SeShutdownPrivilege 3448 Explorer.EXE Token: SeCreatePagefilePrivilege 3448 Explorer.EXE Token: SeShutdownPrivilege 3448 Explorer.EXE Token: SeCreatePagefilePrivilege 3448 Explorer.EXE Token: SeShutdownPrivilege 3448 Explorer.EXE Token: SeCreatePagefilePrivilege 3448 Explorer.EXE Token: SeShutdownPrivilege 336 dwm.exe Token: SeCreatePagefilePrivilege 336 dwm.exe Token: SeShutdownPrivilege 3448 Explorer.EXE Token: SeCreatePagefilePrivilege 3448 Explorer.EXE Token: SeShutdownPrivilege 3448 Explorer.EXE Token: SeCreatePagefilePrivilege 3448 Explorer.EXE Token: SeManageVolumePrivilege 3676 DllHost.exe Token: SeShutdownPrivilege 3448 Explorer.EXE Token: SeCreatePagefilePrivilege 3448 Explorer.EXE Token: SeShutdownPrivilege 3448 Explorer.EXE Token: SeCreatePagefilePrivilege 3448 Explorer.EXE Token: SeShutdownPrivilege 3448 Explorer.EXE Token: SeCreatePagefilePrivilege 3448 Explorer.EXE Token: SeDebugPrivilege 1532 taskmgr.exe Token: SeSystemProfilePrivilege 1532 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3448 Explorer.EXE 3448 Explorer.EXE 3448 Explorer.EXE 3448 Explorer.EXE 3448 Explorer.EXE 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 3448 Explorer.EXE 3448 Explorer.EXE 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3448 Explorer.EXE 3448 Explorer.EXE 3448 Explorer.EXE 3448 Explorer.EXE 3448 Explorer.EXE 3448 Explorer.EXE 3448 Explorer.EXE 3448 Explorer.EXE 3448 Explorer.EXE 3448 Explorer.EXE 3448 Explorer.EXE 3448 Explorer.EXE 3448 Explorer.EXE 3448 Explorer.EXE 3448 Explorer.EXE 3448 Explorer.EXE 3448 Explorer.EXE 3448 Explorer.EXE 3448 Explorer.EXE 3448 Explorer.EXE 3448 Explorer.EXE 3448 Explorer.EXE 3448 Explorer.EXE 3448 Explorer.EXE 3448 Explorer.EXE 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe 1532 taskmgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4876 wrote to memory of 1464 4876 Client-built.exe 90 PID 4876 wrote to memory of 1464 4876 Client-built.exe 90 PID 4876 wrote to memory of 1464 4876 Client-built.exe 90 PID 4876 wrote to memory of 1464 4876 Client-built.exe 90 PID 4876 wrote to memory of 1464 4876 Client-built.exe 90 PID 4876 wrote to memory of 1464 4876 Client-built.exe 90 PID 4876 wrote to memory of 1464 4876 Client-built.exe 90 PID 4876 wrote to memory of 1464 4876 Client-built.exe 90 PID 4876 wrote to memory of 1464 4876 Client-built.exe 90 PID 4876 wrote to memory of 1464 4876 Client-built.exe 90 PID 4876 wrote to memory of 1464 4876 Client-built.exe 90 PID 1464 wrote to memory of 616 1464 dllhost.exe 5 PID 1464 wrote to memory of 676 1464 dllhost.exe 7 PID 1464 wrote to memory of 956 1464 dllhost.exe 12 PID 1464 wrote to memory of 336 1464 dllhost.exe 13 PID 1464 wrote to memory of 408 1464 dllhost.exe 14 PID 1464 wrote to memory of 1032 1464 dllhost.exe 15 PID 1464 wrote to memory of 1120 1464 dllhost.exe 17 PID 1464 wrote to memory of 1128 1464 dllhost.exe 18 PID 1464 wrote to memory of 1156 1464 dllhost.exe 19 PID 1464 wrote to memory of 1252 1464 dllhost.exe 20 PID 1464 wrote to memory of 1296 1464 dllhost.exe 21 PID 1464 wrote to memory of 1308 1464 dllhost.exe 22 PID 1464 wrote to memory of 1364 1464 dllhost.exe 23 PID 1464 wrote to memory of 1384 1464 dllhost.exe 24 PID 1464 wrote to memory of 1444 1464 dllhost.exe 25 PID 1464 wrote to memory of 1584 1464 dllhost.exe 26 PID 1464 wrote to memory of 1596 1464 dllhost.exe 27 PID 1464 wrote to memory of 1656 1464 dllhost.exe 28 PID 1464 wrote to memory of 1716 1464 dllhost.exe 29 PID 1464 wrote to memory of 1748 1464 dllhost.exe 30 PID 1464 wrote to memory of 1760 1464 dllhost.exe 31 PID 1464 wrote to memory of 1848 1464 dllhost.exe 32 PID 1464 wrote to memory of 1980 1464 dllhost.exe 33 PID 1464 wrote to memory of 2032 1464 dllhost.exe 34 PID 1464 wrote to memory of 1048 1464 dllhost.exe 35 PID 1464 wrote to memory of 1744 1464 dllhost.exe 36 PID 1464 wrote to memory of 1888 1464 dllhost.exe 37 PID 1464 wrote to memory of 2176 1464 dllhost.exe 38 PID 1464 wrote to memory of 2184 1464 dllhost.exe 39 PID 1464 wrote to memory of 2340 1464 dllhost.exe 41 PID 1464 wrote to memory of 2532 1464 dllhost.exe 42 PID 1464 wrote to memory of 2564 1464 dllhost.exe 43 PID 1464 wrote to memory of 2656 1464 dllhost.exe 44 PID 1464 wrote to memory of 2664 1464 dllhost.exe 45 PID 1464 wrote to memory of 2680 1464 dllhost.exe 46 PID 1464 wrote to memory of 2748 1464 dllhost.exe 47 PID 1464 wrote to memory of 2912 1464 dllhost.exe 48 PID 1464 wrote to memory of 2956 1464 dllhost.exe 49 PID 1464 wrote to memory of 2968 1464 dllhost.exe 50 PID 1464 wrote to memory of 2992 1464 dllhost.exe 51 PID 1464 wrote to memory of 3004 1464 dllhost.exe 52 PID 1464 wrote to memory of 3144 1464 dllhost.exe 53 PID 1464 wrote to memory of 3436 1464 dllhost.exe 55 PID 1464 wrote to memory of 3448 1464 dllhost.exe 56 PID 1464 wrote to memory of 3648 1464 dllhost.exe 57 PID 1464 wrote to memory of 3884 1464 dllhost.exe 58 PID 1464 wrote to memory of 4076 1464 dllhost.exe 60 PID 1464 wrote to memory of 4104 1464 dllhost.exe 62 PID 1464 wrote to memory of 4392 1464 dllhost.exe 64 PID 1464 wrote to memory of 5064 1464 dllhost.exe 65 PID 1464 wrote to memory of 2016 1464 dllhost.exe 67 PID 1464 wrote to memory of 3544 1464 dllhost.exe 69 PID 1464 wrote to memory of 3204 1464 dllhost.exe 70
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:616
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:336
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{797017d6-8b99-4940-b3a1-866caff4c69f}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1464
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:676
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:956
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:408
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:1032
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Drops file in System32 directory
PID:1120
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1128
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵PID:2680
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1156
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1252
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1296
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1308
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1364
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1384
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1444
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:2532
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1584
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1596
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1656
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1716
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1748
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1760
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1848
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:1980
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:2032
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1048
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1744
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:1888
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2176
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:2184
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2340
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2564
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2656
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2664
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵PID:2748
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
- Drops file in System32 directory
PID:2912
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵PID:2956
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵PID:2968
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2992
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:3004
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:3144
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:3436
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4876
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /72⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1532
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3648
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3884
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4076
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Checks SCSI registry key(s)
- Modifies registry class
PID:4104
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4392
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:5064
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:2016
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:3544
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
PID:3204
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4212
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵PID:5068
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:968
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1868
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵PID:5100
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
- Checks SCSI registry key(s)
PID:2212
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵PID:4032
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵PID:4512
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵PID:3576
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2932
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵PID:1420
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}1⤵PID:3212
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3676
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵PID:4824