Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16/10/2024, 01:06
Static task
static1
Behavioral task
behavioral1
Sample
03c95970bb3d91530aa29f9199ac1b2d7082672909e9c1a30804f99ebc9643b7.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
03c95970bb3d91530aa29f9199ac1b2d7082672909e9c1a30804f99ebc9643b7.exe
Resource
win10v2004-20241007-en
General
-
Target
03c95970bb3d91530aa29f9199ac1b2d7082672909e9c1a30804f99ebc9643b7.exe
-
Size
558KB
-
MD5
dc50baff9f1bab10f1ebc24e0d77afc3
-
SHA1
29f4429939e57666b8a57c2d7b95a4801fa7ca20
-
SHA256
03c95970bb3d91530aa29f9199ac1b2d7082672909e9c1a30804f99ebc9643b7
-
SHA512
6249ae2e738515d2f453310ad8e9730334997796477f88f0e1a72086154b0348b07da7c651b835f8e8b84ac43452fd0d87b5c40400d8a9a6297e802ae045a152
-
SSDEEP
6144:mujuIGjAOphSW579i8fB106f91hYC1l+W8GSAZ2nxKdn3wGK570:LRaAODHVrB/lDH8gZhdAY
Malware Config
Extracted
xworm
سPيIXNtJمrCWpكxـاطMWEلD21LcبإA
-
Install_directory
%Port%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/2752-247-0x000000001ABA0000-0x000000001ABAE000-memory.dmp family_xworm -
Modifies security service 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MpsSvc\Parameters\PortKeywords\DHCP svchost.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP\Collection svchost.exe -
Executes dropped EXE 2 IoCs
pid Process 2752 wzcsapi.exe 2804 wzcsvc.exe -
Loads dropped DLL 2 IoCs
pid Process 2088 03c95970bb3d91530aa29f9199ac1b2d7082672909e9c1a30804f99ebc9643b7.exe 2088 03c95970bb3d91530aa29f9199ac1b2d7082672909e9c1a30804f99ebc9643b7.exe -
Drops file in System32 directory 19 IoCs
description ioc Process File created C:\Windows\system32\perfc010.dat WMIADAP.EXE File created C:\Windows\system32\PerfStringBackup.TMP WMIADAP.EXE File created C:\Windows\system32\wbem\Performance\WmiApRpl_new.h WMIADAP.EXE File created C:\Windows\system32\perfc00A.dat WMIADAP.EXE File created C:\Windows\system32\perfc00C.dat WMIADAP.EXE File created C:\Windows\system32\perfh010.dat WMIADAP.EXE File created C:\Windows\system32\perfh011.dat WMIADAP.EXE File opened for modification C:\Windows\system32\PerfStringBackup.INI WMIADAP.EXE File opened for modification C:\Windows\system32\wbem\Logs\wmiprov.log wmiprvse.exe File created C:\Windows\System32\Tasks\wzcsapi svchost.exe File created C:\Windows\system32\perfc009.dat WMIADAP.EXE File created C:\Windows\system32\perfh00A.dat WMIADAP.EXE File created C:\Windows\system32\perfc011.dat WMIADAP.EXE File opened for modification C:\Windows\System32\Tasks\wzcsapi svchost.exe File created C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini WMIADAP.EXE File created C:\Windows\system32\perfh00C.dat WMIADAP.EXE File created C:\Windows\system32\perfc007.dat WMIADAP.EXE File created C:\Windows\system32\perfh007.dat WMIADAP.EXE File created C:\Windows\system32\perfh009.dat WMIADAP.EXE -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\appcompat\programs\RecentFileCache.bcf svchost.exe File created C:\Windows\inf\WmiApRpl\WmiApRpl.h WMIADAP.EXE File opened for modification C:\Windows\inf\WmiApRpl\WmiApRpl.h WMIADAP.EXE File created C:\Windows\inf\WmiApRpl\0009\WmiApRpl.ini WMIADAP.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 wzcsapi.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 wzcsapi.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2216 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 1272 WerFault.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe 2804 wzcsvc.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2752 wzcsapi.exe Token: SeDebugPrivilege 2804 wzcsvc.exe Token: SeDebugPrivilege 1272 WerFault.exe Token: SeShutdownPrivilege 1200 Explorer.EXE Token: SeShutdownPrivilege 1200 Explorer.EXE Token: SeShutdownPrivilege 1200 Explorer.EXE Token: SeAuditPrivilege 848 svchost.exe Token: SeAssignPrimaryTokenPrivilege 848 svchost.exe Token: SeIncreaseQuotaPrivilege 848 svchost.exe Token: SeSecurityPrivilege 848 svchost.exe Token: SeTakeOwnershipPrivilege 848 svchost.exe Token: SeLoadDriverPrivilege 848 svchost.exe Token: SeSystemtimePrivilege 848 svchost.exe Token: SeBackupPrivilege 848 svchost.exe Token: SeRestorePrivilege 848 svchost.exe Token: SeShutdownPrivilege 848 svchost.exe Token: SeSystemEnvironmentPrivilege 848 svchost.exe Token: SeUndockPrivilege 848 svchost.exe Token: SeManageVolumePrivilege 848 svchost.exe Token: SeAssignPrimaryTokenPrivilege 848 svchost.exe Token: SeIncreaseQuotaPrivilege 848 svchost.exe Token: SeSecurityPrivilege 848 svchost.exe Token: SeTakeOwnershipPrivilege 848 svchost.exe Token: SeLoadDriverPrivilege 848 svchost.exe Token: SeSystemtimePrivilege 848 svchost.exe Token: SeBackupPrivilege 848 svchost.exe Token: SeRestorePrivilege 848 svchost.exe Token: SeShutdownPrivilege 848 svchost.exe Token: SeSystemEnvironmentPrivilege 848 svchost.exe Token: SeUndockPrivilege 848 svchost.exe Token: SeManageVolumePrivilege 848 svchost.exe Token: SeAssignPrimaryTokenPrivilege 848 svchost.exe Token: SeIncreaseQuotaPrivilege 848 svchost.exe Token: SeSecurityPrivilege 848 svchost.exe Token: SeTakeOwnershipPrivilege 848 svchost.exe Token: SeLoadDriverPrivilege 848 svchost.exe Token: SeSystemtimePrivilege 848 svchost.exe Token: SeBackupPrivilege 848 svchost.exe Token: SeRestorePrivilege 848 svchost.exe Token: SeShutdownPrivilege 848 svchost.exe Token: SeSystemEnvironmentPrivilege 848 svchost.exe Token: SeUndockPrivilege 848 svchost.exe Token: SeManageVolumePrivilege 848 svchost.exe Token: SeAssignPrimaryTokenPrivilege 848 svchost.exe Token: SeIncreaseQuotaPrivilege 848 svchost.exe Token: SeSecurityPrivilege 848 svchost.exe Token: SeTakeOwnershipPrivilege 848 svchost.exe Token: SeLoadDriverPrivilege 848 svchost.exe Token: SeSystemtimePrivilege 848 svchost.exe Token: SeBackupPrivilege 848 svchost.exe Token: SeRestorePrivilege 848 svchost.exe Token: SeShutdownPrivilege 848 svchost.exe Token: SeSystemEnvironmentPrivilege 848 svchost.exe Token: SeUndockPrivilege 848 svchost.exe Token: SeManageVolumePrivilege 848 svchost.exe Token: SeAssignPrimaryTokenPrivilege 848 svchost.exe Token: SeIncreaseQuotaPrivilege 848 svchost.exe Token: SeSecurityPrivilege 848 svchost.exe Token: SeTakeOwnershipPrivilege 848 svchost.exe Token: SeLoadDriverPrivilege 848 svchost.exe Token: SeSystemtimePrivilege 848 svchost.exe Token: SeBackupPrivilege 848 svchost.exe Token: SeRestorePrivilege 848 svchost.exe Token: SeShutdownPrivilege 848 svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2088 wrote to memory of 2752 2088 03c95970bb3d91530aa29f9199ac1b2d7082672909e9c1a30804f99ebc9643b7.exe 30 PID 2088 wrote to memory of 2752 2088 03c95970bb3d91530aa29f9199ac1b2d7082672909e9c1a30804f99ebc9643b7.exe 30 PID 2088 wrote to memory of 2752 2088 03c95970bb3d91530aa29f9199ac1b2d7082672909e9c1a30804f99ebc9643b7.exe 30 PID 2088 wrote to memory of 2804 2088 03c95970bb3d91530aa29f9199ac1b2d7082672909e9c1a30804f99ebc9643b7.exe 31 PID 2088 wrote to memory of 2804 2088 03c95970bb3d91530aa29f9199ac1b2d7082672909e9c1a30804f99ebc9643b7.exe 31 PID 2088 wrote to memory of 2804 2088 03c95970bb3d91530aa29f9199ac1b2d7082672909e9c1a30804f99ebc9643b7.exe 31 PID 2804 wrote to memory of 432 2804 wzcsvc.exe 5 PID 2804 wrote to memory of 476 2804 wzcsvc.exe 6 PID 2804 wrote to memory of 492 2804 wzcsvc.exe 7 PID 2804 wrote to memory of 500 2804 wzcsvc.exe 8 PID 2804 wrote to memory of 592 2804 wzcsvc.exe 9 PID 2804 wrote to memory of 668 2804 wzcsvc.exe 10 PID 2804 wrote to memory of 756 2804 wzcsvc.exe 11 PID 2804 wrote to memory of 808 2804 wzcsvc.exe 12 PID 2804 wrote to memory of 848 2804 wzcsvc.exe 13 PID 2804 wrote to memory of 960 2804 wzcsvc.exe 15 PID 2804 wrote to memory of 236 2804 wzcsvc.exe 16 PID 2804 wrote to memory of 344 2804 wzcsvc.exe 17 PID 2804 wrote to memory of 1064 2804 wzcsvc.exe 18 PID 2804 wrote to memory of 1112 2804 wzcsvc.exe 19 PID 2804 wrote to memory of 1172 2804 wzcsvc.exe 20 PID 2804 wrote to memory of 1200 2804 wzcsvc.exe 21 PID 2804 wrote to memory of 2036 2804 wzcsvc.exe 23 PID 2804 wrote to memory of 824 2804 wzcsvc.exe 24 PID 2804 wrote to memory of 1196 2804 wzcsvc.exe 25 PID 2804 wrote to memory of 2128 2804 wzcsvc.exe 26 PID 2804 wrote to memory of 1700 2804 wzcsvc.exe 27 PID 2804 wrote to memory of 2088 2804 wzcsvc.exe 29 PID 2804 wrote to memory of 2752 2804 wzcsvc.exe 30 PID 2088 wrote to memory of 1272 2088 03c95970bb3d91530aa29f9199ac1b2d7082672909e9c1a30804f99ebc9643b7.exe 32 PID 2088 wrote to memory of 1272 2088 03c95970bb3d91530aa29f9199ac1b2d7082672909e9c1a30804f99ebc9643b7.exe 32 PID 2088 wrote to memory of 1272 2088 03c95970bb3d91530aa29f9199ac1b2d7082672909e9c1a30804f99ebc9643b7.exe 32 PID 2804 wrote to memory of 1272 2804 wzcsvc.exe 32 PID 2804 wrote to memory of 2088 2804 wzcsvc.exe 29 PID 2804 wrote to memory of 2088 2804 wzcsvc.exe 29 PID 2804 wrote to memory of 2088 2804 wzcsvc.exe 29 PID 2804 wrote to memory of 2088 2804 wzcsvc.exe 29 PID 2804 wrote to memory of 2088 2804 wzcsvc.exe 29 PID 2804 wrote to memory of 2088 2804 wzcsvc.exe 29 PID 2804 wrote to memory of 1272 2804 wzcsvc.exe 32 PID 2804 wrote to memory of 2088 2804 wzcsvc.exe 29 PID 2752 wrote to memory of 2216 2752 wzcsapi.exe 33 PID 2752 wrote to memory of 2216 2752 wzcsapi.exe 33 PID 2752 wrote to memory of 2216 2752 wzcsapi.exe 33 PID 2804 wrote to memory of 2216 2804 wzcsvc.exe 33 PID 2804 wrote to memory of 2688 2804 wzcsvc.exe 34 PID 492 wrote to memory of 2752 492 lsass.exe 30 PID 492 wrote to memory of 2752 492 lsass.exe 30 PID 492 wrote to memory of 2752 492 lsass.exe 30 PID 492 wrote to memory of 2752 492 lsass.exe 30 PID 492 wrote to memory of 2752 492 lsass.exe 30 PID 492 wrote to memory of 2752 492 lsass.exe 30 PID 492 wrote to memory of 2752 492 lsass.exe 30 PID 492 wrote to memory of 2752 492 lsass.exe 30 PID 492 wrote to memory of 2752 492 lsass.exe 30 PID 2804 wrote to memory of 2088 2804 wzcsvc.exe 29 PID 2804 wrote to memory of 2088 2804 wzcsvc.exe 29 PID 2804 wrote to memory of 2088 2804 wzcsvc.exe 29 PID 2804 wrote to memory of 2088 2804 wzcsvc.exe 29 PID 2804 wrote to memory of 2088 2804 wzcsvc.exe 29 PID 2804 wrote to memory of 2088 2804 wzcsvc.exe 29 PID 848 wrote to memory of 2768 848 svchost.exe 35 PID 848 wrote to memory of 2768 848 svchost.exe 35 PID 848 wrote to memory of 2768 848 svchost.exe 35 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:432
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵PID:476
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵PID:592
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe3⤵
- Drops file in System32 directory
PID:824
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}3⤵PID:1196
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵PID:668
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵
- Modifies security service
PID:756
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵PID:808
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"3⤵PID:1172
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R3⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:2768
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {DA79F11A-1032-445B-BE09-AB397F63084B} S-1-5-21-1846800975-3917212583-2893086201-1000:ZQABOPWE\Admin:Interactive:[1]3⤵PID:1612
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵PID:960
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵PID:236
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵PID:344
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵PID:1064
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵PID:1112
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"2⤵PID:2036
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵PID:2128
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵PID:1700
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
- Suspicious use of WriteProcessMemory
PID:492
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe1⤵PID:500
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\03c95970bb3d91530aa29f9199ac1b2d7082672909e9c1a30804f99ebc9643b7.exe"C:\Users\Admin\AppData\Local\Temp\03c95970bb3d91530aa29f9199ac1b2d7082672909e9c1a30804f99ebc9643b7.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\wzcsapi.exe"C:\Users\Admin\AppData\Local\Temp\wzcsapi.exe"3⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /rl highest /tn "wzcsapi" /tr "%Current%\wzcsapi.exe"4⤵
- Scheduled Task/Job: Scheduled Task
PID:2216
-
-
-
C:\Users\Admin\AppData\Local\Temp\wzcsvc.exe"C:\Users\Admin\AppData\Local\Temp\wzcsvc.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2804
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2088 -s 7843⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1272
-
-
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1265893036-1602445984-277767434-105589196215767837131921833493-5095607711299266280"1⤵PID:2688
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
34KB
MD564ffe7c0fa6ac22f5acafd3ceb4aca5b
SHA1104182708267ee1a6da0e9e83cb04df83edae120
SHA2566b5c2e9a2ef36412b2636236ade5530c59573b51b07fe224fd980911cbb7b976
SHA512f136d69bb6be51cf7e1e6f0e4538cb951337cb278344b348e749f67a6f08c1df01264bd3275ed9a36b776dfb1b9b75f31f8bcec102f8b50d50913aa883b13066
-
Filesize
3KB
MD5300d054988447b260f9de0083d1f9ace
SHA1e49af49e988961b8e1d16f76230b64f5cdc4d4db
SHA2569de6a87751e0b83b937860198bf27e4fbfe915396f4c222ee6dd6ccb3cf3be64
SHA512d6ab9c70dcd8430250b5b29a00ec1057eab752c0f12c737a15023fc2a195fd34d5b6ce55440a5aadc2fc9bf2e24797f1fd981144764073d6984a56e1eb27099a
-
Filesize
141KB
MD50f3d76321f0a7986b42b25a3aa554f82
SHA17036bba62109cc25da5d6a84d22b6edb954987c0
SHA256dfad62e3372760d303f7337fe290e4cb28e714caadd3c59294b77968d81fe460
SHA512bb02a3f14d47d233fbda046f61bbf5612ebc6213b156af9c47f56733a03df1bb484d1c3576569eb4499d7b378eb01f4d6e906c36c6f71738482584c2e84b47d0
-
Filesize
150KB
MD5540138285295c68de32a419b7d9de687
SHA11cf6a2a0f53f0516ff9fe5ac733dbb5a9255ae56
SHA25633867c52f756f2b0f645f4bd503c65969d73676dcb14e6a6fdb2ffb11c7562eb
SHA5127c17c10d4b6165aa0c208811dc6d98e2f4e75e3da1cc2313cc7da9d657626beb3e4ec00b07b71376a7c549725d40db20d8952753e70acc86e87a8390e224a64a
-
Filesize
145KB
MD5ce233fa5dc5adcb87a5185617a0ff6ac
SHA12e2747284b1204d3ab08733a29fdbabdf8dc55b9
SHA25668d4de5e72cfd117151c44dd6ec74cf46fafd6c51357895d3025d7dac570ce31
SHA5121e9c8e7f12d7c87b4faa0d587a8b374e491cd44f23e13fdb64bde3bc6bf3f2a2d3aba5444a13b199a19737a8170ee8d4ead17a883fbaee66b8b32b35b7577fc2
-
Filesize
142KB
MD5d73172c6cb697755f87cd047c474cf91
SHA1abc5c7194abe32885a170ca666b7cce8251ac1d6
SHA2569de801eebbe32699630f74082c9adea15069acd5afb138c9ecd5d4904e3cdc57
SHA5127c9e4126bed6bc94a211281eed45cee30452519f125b82b143f78da32a3aac72d94d31757e1da22fb2f8a25099ffddec992e2c60987efb9da9b7a17831eafdf6
-
Filesize
114KB
MD51f998386566e5f9b7f11cc79254d1820
SHA1e1da5fe1f305099b94de565d06bc6f36c6794481
SHA2561665d97fb8786b94745295feb616a30c27af84e8a5e1d25cd1bcaf70723040ea
SHA512a7c9702dd5833f4d6d27ce293efb9507948a3b05db350fc9909af6a48bd649c7578f856b4d64d87df451d0efbe202c62da7fffcac03b3fe72c7caaea553de75f
-
Filesize
668KB
MD55026297c7c445e7f6f705906a6f57c02
SHA14ec3b66d44b0d44ec139bd1475afd100748f9e91
SHA256506d3bec72805973df3b2e11aba4d074aeb4b26b7335536e79ea1145108817cc
SHA5125be8e51ecacda465b905df3e38ac114240d8fa6bae5bb17e8e53a87630454b57514ca0abbd8afefd798d450cd4ee89caf4391eeb837ced384260c188482fb48d
-
Filesize
634KB
MD51c678ee06bd02b5d9e4d51c3a4ec2d2b
SHA190aa7fdfaaa37fb4f2edfc8efc3994871087dedb
SHA2562d168ab31836a08d8ca00aab9685f040aac4052a7f10fbbf0c28e9f880a79dd3
SHA512ec665d7a20f27b2a0fe2475883009c6d34615cc2046d096de447ef57bcac9da0ae842be0556f5736f42d9c1c601fb8629896a2444990e508f7c573165088ab32
-
Filesize
727KB
MD57d0bac4e796872daa3f6dc82c57f4ca8
SHA1b4f6bbe08fa8cd0784a94ac442ff937a3d3eea0a
SHA256ce2ef9fc248965f1408d4b7a1e6db67494ba07a7bbdfa810418b30be66ad5879
SHA512145a0e8543e0d79fe1a5ce268d710c807834a05da1e948f84d6a1818171cd4ef077ea44ba1fe439b07b095721e0109cbf7e4cfd7b57519ee44d9fd9fe1169a3e
-
Filesize
727KB
MD55f684ce126de17a7d4433ed2494c5ca9
SHA1ce1a30a477daa1bac2ec358ce58731429eafe911
SHA2562e2ba0c47e71991d646ec380cde47f44318d695e6f3f56ec095955a129af1c2c
SHA5124d0c2669b5002da14d44c21dc2f521fb37b6b41b61bca7b2a9af7c03f616dda9ca825f79a81d3401af626a90017654f9221a6ccc83010ff73de71967fc2f3f5b
-
Filesize
722KB
MD54623482c106cf6cc1bac198f31787b65
SHA15abb0decf7b42ef5daf7db012a742311932f6dad
SHA256eceda45aedbf6454b79f010c891bead3844d43189972f6beeb5ccddb13cc0349
SHA512afecefcec652856dd8b4275f11d75a68a582337b682309c4b61fd26ed7038b92e6b9aa72c1bfc350ce2caf5e357098b54eb1e448a4392960f9f82e01c447669f
-
Filesize
406KB
MD554c674d19c0ff72816402f66f6c3d37c
SHA12dcc0269545a213648d59dc84916d9ec2d62a138
SHA256646d4ea2f0670691aa5b998c26626ede7623886ed3ac9bc9679018f85e584bb5
SHA5124d451e9bef2c451cb9e86c7f4d705be65787c88df5281da94012bfbe5af496718ec3e48099ec3dff1d06fee7133293f10d649866fe59daa7951aebe2e5e67c1f
-
Filesize
3KB
MD5b133a676d139032a27de3d9619e70091
SHA11248aa89938a13640252a79113930ede2f26f1fa
SHA256ae2b6236d3eeb4822835714ae9444e5dcd21bc60f7a909f2962c43bc743c7b15
SHA512c6b99e13d854ce7a6874497473614ee4bd81c490802783db1349ab851cd80d1dc06df8c1f6e434aba873a5bbf6125cc64104709064e19a9dc1c66dcde3f898f5
-
Filesize
27KB
MD546d08e3a55f007c523ac64dce6dcf478
SHA162edf88697e98d43f32090a2197bead7e7244245
SHA2565b15b1fc32713447c3fbc952a0fb02f1fd78c6f9ac69087bdb240625b0282614
SHA512b1f42e70c0ba866a9ed34eb531dbcbae1a659d7349c1e1a14b18b9e23d8cbd302d8509c6d3a28bc7509dd92e83bcb400201fb5d5a70f613421d81fe649d02e42
-
Filesize
161KB
MD5a69c6e092d415063a9fb80f8fe4e3444
SHA18b26a0fd01b1e48f7110cffecf6bc3b9d0822e9a
SHA256f7dd8d6299c108a3221c31bf33637f59f0e19703aaa88b1e3a4f1093e7209a5d
SHA5124e69b49d65f68ff913afbc991f06509645ac69850182f557ca625ad5cf92832059ddadb4af547cfb4fd84c4b24cf55a1ce3d9d6d466112e9581908d4e4d2da38