Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2024, 21:09
Static task
static1
Behavioral task
behavioral1
Sample
c196bc76f26382b9b96289276693a53f_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
c196bc76f26382b9b96289276693a53f_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
c196bc76f26382b9b96289276693a53f_JaffaCakes118.dll
-
Size
5.0MB
-
MD5
c196bc76f26382b9b96289276693a53f
-
SHA1
8a51e97077a789dfa26dbb7f271a12c5974d7e56
-
SHA256
b9ffda82a201a7185fcdbfaa56e246f95f131059a2f1849aa1eb741e0b443c18
-
SHA512
1ced4e95837aa1d886871755cbf18612a64f24b91bb947197c891f3a598ba54f259c3e83bf6d03ad2a075950e3d037ce5bdc9c3597a1579db1edf5a9ad25e256
-
SSDEEP
98304:0DqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:0DqPe1Cxcxk3ZAEUadzR8yc4H
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\WINDOWS\mssecsvc.exe = "C:\\WINDOWS\\mssecsvc.exe:*:enabled:@shell32.dll,-1" mssecsvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List mssecsvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile mssecsvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications mssecsvc.exe -
Wannacry
WannaCry is a ransomware cryptoworm.
-
Contacts a large (3030) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 2 IoCs
pid Process 1640 mssecsvc.exe 1496 mssecsvc.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\mssecsvc.exe rundll32.exe File created C:\WINDOWS\tasksche.exe mssecsvc.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2488 1640 WerFault.exe 87 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mssecsvc.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" mssecsvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mssecsvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" mssecsvc.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1640 mssecsvc.exe 1640 mssecsvc.exe 1496 mssecsvc.exe 1496 mssecsvc.exe -
Suspicious behavior: MapViewOfSection 64 IoCs
pid Process 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe 1640 mssecsvc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1640 mssecsvc.exe Token: SeDebugPrivilege 1496 mssecsvc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2308 wrote to memory of 2552 2308 rundll32.exe 86 PID 2308 wrote to memory of 2552 2308 rundll32.exe 86 PID 2308 wrote to memory of 2552 2308 rundll32.exe 86 PID 2552 wrote to memory of 1640 2552 rundll32.exe 87 PID 2552 wrote to memory of 1640 2552 rundll32.exe 87 PID 2552 wrote to memory of 1640 2552 rundll32.exe 87 PID 1640 wrote to memory of 612 1640 mssecsvc.exe 5 PID 1640 wrote to memory of 612 1640 mssecsvc.exe 5 PID 1640 wrote to memory of 612 1640 mssecsvc.exe 5 PID 1640 wrote to memory of 612 1640 mssecsvc.exe 5 PID 1640 wrote to memory of 612 1640 mssecsvc.exe 5 PID 1640 wrote to memory of 612 1640 mssecsvc.exe 5 PID 1640 wrote to memory of 676 1640 mssecsvc.exe 7 PID 1640 wrote to memory of 676 1640 mssecsvc.exe 7 PID 1640 wrote to memory of 676 1640 mssecsvc.exe 7 PID 1640 wrote to memory of 676 1640 mssecsvc.exe 7 PID 1640 wrote to memory of 676 1640 mssecsvc.exe 7 PID 1640 wrote to memory of 676 1640 mssecsvc.exe 7 PID 1640 wrote to memory of 784 1640 mssecsvc.exe 8 PID 1640 wrote to memory of 784 1640 mssecsvc.exe 8 PID 1640 wrote to memory of 784 1640 mssecsvc.exe 8 PID 1640 wrote to memory of 784 1640 mssecsvc.exe 8 PID 1640 wrote to memory of 784 1640 mssecsvc.exe 8 PID 1640 wrote to memory of 784 1640 mssecsvc.exe 8 PID 1640 wrote to memory of 788 1640 mssecsvc.exe 9 PID 1640 wrote to memory of 788 1640 mssecsvc.exe 9 PID 1640 wrote to memory of 788 1640 mssecsvc.exe 9 PID 1640 wrote to memory of 788 1640 mssecsvc.exe 9 PID 1640 wrote to memory of 788 1640 mssecsvc.exe 9 PID 1640 wrote to memory of 788 1640 mssecsvc.exe 9 PID 1640 wrote to memory of 800 1640 mssecsvc.exe 10 PID 1640 wrote to memory of 800 1640 mssecsvc.exe 10 PID 1640 wrote to memory of 800 1640 mssecsvc.exe 10 PID 1640 wrote to memory of 800 1640 mssecsvc.exe 10 PID 1640 wrote to memory of 800 1640 mssecsvc.exe 10 PID 1640 wrote to memory of 800 1640 mssecsvc.exe 10 PID 1640 wrote to memory of 904 1640 mssecsvc.exe 11 PID 1640 wrote to memory of 904 1640 mssecsvc.exe 11 PID 1640 wrote to memory of 904 1640 mssecsvc.exe 11 PID 1640 wrote to memory of 904 1640 mssecsvc.exe 11 PID 1640 wrote to memory of 904 1640 mssecsvc.exe 11 PID 1640 wrote to memory of 904 1640 mssecsvc.exe 11 PID 1640 wrote to memory of 956 1640 mssecsvc.exe 12 PID 1640 wrote to memory of 956 1640 mssecsvc.exe 12 PID 1640 wrote to memory of 956 1640 mssecsvc.exe 12 PID 1640 wrote to memory of 956 1640 mssecsvc.exe 12 PID 1640 wrote to memory of 956 1640 mssecsvc.exe 12 PID 1640 wrote to memory of 956 1640 mssecsvc.exe 12 PID 1640 wrote to memory of 64 1640 mssecsvc.exe 13 PID 1640 wrote to memory of 64 1640 mssecsvc.exe 13 PID 1640 wrote to memory of 64 1640 mssecsvc.exe 13 PID 1640 wrote to memory of 64 1640 mssecsvc.exe 13 PID 1640 wrote to memory of 64 1640 mssecsvc.exe 13 PID 1640 wrote to memory of 64 1640 mssecsvc.exe 13 PID 1640 wrote to memory of 732 1640 mssecsvc.exe 14 PID 1640 wrote to memory of 732 1640 mssecsvc.exe 14 PID 1640 wrote to memory of 732 1640 mssecsvc.exe 14 PID 1640 wrote to memory of 732 1640 mssecsvc.exe 14 PID 1640 wrote to memory of 732 1640 mssecsvc.exe 14 PID 1640 wrote to memory of 732 1640 mssecsvc.exe 14 PID 1640 wrote to memory of 876 1640 mssecsvc.exe 15 PID 1640 wrote to memory of 876 1640 mssecsvc.exe 15 PID 1640 wrote to memory of 876 1640 mssecsvc.exe 15 PID 1640 wrote to memory of 876 1640 mssecsvc.exe 15
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:612
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"2⤵PID:788
-
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:64
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:676
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵PID:800
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding2⤵PID:2804
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:3824
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca2⤵PID:3944
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:4008
-
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca2⤵PID:2936
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:4136
-
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding2⤵PID:2904
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:1148
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca2⤵PID:1108
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:4428
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca2⤵PID:1044
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca2⤵PID:2896
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:1380
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:4584
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵PID:904
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:956
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:732
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:876
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵PID:1032
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵PID:1116
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1128
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1136
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1184
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵PID:2736
-
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe2⤵PID:3940
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1248
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1268
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1344
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1420
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1444
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:2596
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1540
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1548
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1624
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1688
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1744
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1764
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1884
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:1968
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:1092
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1336
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵PID:1636
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:1784
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:2116
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵PID:2144
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2204
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2256
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2404
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2412
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2620
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵PID:2708
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵PID:2752
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2808
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2816
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵PID:2844
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵PID:2888
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3460
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c196bc76f26382b9b96289276693a53f_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c196bc76f26382b9b96289276693a53f_JaffaCakes118.dll,#13⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe4⤵
- Modifies firewall policy service
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 14325⤵
- Program crash
PID:2488
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:3468
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3640
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:4540
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:1060
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵PID:4124
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:2880
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:4976
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:3276
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵PID:3840
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵PID:4436
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵PID:4984
-
C:\WINDOWS\mssecsvc.exeC:\WINDOWS\mssecsvc.exe -m security1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1496
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1640 -ip 16401⤵PID:4564
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD5212e427d5110c73222dc7184744ea40c
SHA1ab51fce268ae6c4065d10dc40f39054b3c2908b6
SHA25606ea37d862694d2a2ff0b6199a99afae9eccf01da3f7bd0b764642ad36b7ed30
SHA5125e578cd6c1951d4766f8150ff63471b6f8d94d78762ff35d016b9b894d61eaf2a8f2814cea00a839f986860df0e2b07be4462a2a5bda42730f050076f4b0dea9