Overview

overview

10

Static

static

3

1.rar

windows10-2004-x64

10

0oj3.exe

windows10-2004-x64

10

Config.ini

windows10-2004-x64

1

interception.dll

windows10-2004-x64

1

libcrypto-3-x64.dll

windows10-2004-x64

1

onnxruntime.dll

windows10-2004-x64

1

opencv_world490.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    900s
  • max time network
    867s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-12-2024 21:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0oj3.exe

  • Size

    37.0MB

  • MD5

    d57050cc8f1d71bb068a181301146855

  • SHA1

    564deb2344ea43dd519ee0000642cb0ced55da83

  • SHA256

    08058004805b7054e6dd6c55e1aebfa356cddd46167aae7de4322d4c3ae79db1

  • SHA512

    43af8130465347d06e23838bc652a94b8d06518d81c40f32f87d78d87a485ae23b13d7585f3e05f0231b9f6f59e383b98617b268519d1c6742b7309c1da494e4

  • SSDEEP

    786432:b/gO+cE2+qOnY9ZBLcf5jJGlbarkt0PAmyrL+rXrO37:bEcEGbLwjubcktYbO37

Score
10/10
asyncratservicedefense_evasionexecutionpersistencerat

Malware Config

Extracted

Family

asyncrat

Version

0.6.1

Botnet

service

C2

193.57.137.78:5555

Mutex

Q8ghiNEV5vpA

Attributes
  • delay

    3

  • install

    true

  • install_file

    cmd.exe

  • install_folder

    %Temp%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 62 IoCs
  • Indicator Removal: Clear Windows Event Logs 1 TTPs 2 IoCs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion
  • Loads dropped DLL 15 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 20 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 18 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 14 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 29 IoCs
  • Modifies registry class 26 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: RenamesItself 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
    • Executes dropped EXE
    PID:616
    • C:\Windows\system32\fontdrvhost.exe
      "fontdrvhost.exe"
      2⤵
        PID:776
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
        • Executes dropped EXE
        PID:316
    • C:\Windows\system32\lsass.exe
      C:\Windows\system32\lsass.exe
      1⤵
      • Executes dropped EXE
      PID:672
    • C:\Windows\system32\fontdrvhost.exe
      "fontdrvhost.exe"
      1⤵
        PID:784
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k DcomLaunch -p
        1⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Checks processor information in registry
        • Modifies registry class
        PID:792
        • C:\Windows\system32\wbem\unsecapp.exe
          C:\Windows\system32\wbem\unsecapp.exe -Embedding
          2⤵
          • Executes dropped EXE
          PID:3076
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          2⤵
            PID:3904
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            2⤵
            • Executes dropped EXE
            PID:4028
          • C:\Windows\System32\RuntimeBroker.exe
            C:\Windows\System32\RuntimeBroker.exe -Embedding
            2⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:4088
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            2⤵
              PID:3008
            • C:\Windows\System32\RuntimeBroker.exe
              C:\Windows\System32\RuntimeBroker.exe -Embedding
              2⤵
              • Executes dropped EXE
              PID:4064
            • C:\Windows\System32\RuntimeBroker.exe
              C:\Windows\System32\RuntimeBroker.exe -Embedding
              2⤵
              • Executes dropped EXE
              PID:4484
            • C:\Windows\system32\SppExtComObj.exe
              C:\Windows\system32\SppExtComObj.exe -Embedding
              2⤵
              • Executes dropped EXE
              PID:2948
            • C:\Windows\system32\DllHost.exe
              C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
              2⤵
              • Drops file in System32 directory
              PID:3056
            • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
              "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
              2⤵
              • Executes dropped EXE
              PID:1988
            • C:\Windows\system32\wbem\wmiprvse.exe
              C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
              2⤵
              • Checks BIOS information in registry
              • Loads dropped DLL
              • Checks SCSI registry key(s)
              • Checks processor information in registry
              • Enumerates system info in registry
              PID:4244
            • C:\Windows\System32\mousocoreworker.exe
              C:\Windows\System32\mousocoreworker.exe -Embedding
              2⤵
              • Loads dropped DLL
              PID:904
            • C:\Windows\system32\backgroundTaskHost.exe
              "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
              2⤵
              • Loads dropped DLL
              PID:3480
            • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
              C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
              2⤵
              • Loads dropped DLL
              PID:940
            • C:\Windows\system32\backgroundTaskHost.exe
              "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
              2⤵
                PID:3576
              • C:\Windows\system32\backgroundTaskHost.exe
                "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:ShellFeedsUI.AppXnj65k2d1a1rnztt2t2nng5ctmk3e76pn.mca
                2⤵
                • Loads dropped DLL
                • Modifies registry class
                • Suspicious use of FindShellTrayWindow
                PID:896
              • C:\Windows\system32\backgroundTaskHost.exe
                "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                2⤵
                • Loads dropped DLL
                PID:876
              • C:\Windows\system32\backgroundTaskHost.exe
                "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                2⤵
                  PID:652
                • C:\Windows\System32\mousocoreworker.exe
                  C:\Windows\System32\mousocoreworker.exe -Embedding
                  2⤵
                  • Loads dropped DLL
                  • Checks processor information in registry
                  • Enumerates system info in registry
                  PID:4564
                • C:\Windows\system32\backgroundTaskHost.exe
                  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                  2⤵
                    PID:4112
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k RPCSS -p
                  1⤵
                  • Executes dropped EXE
                  PID:888
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
                  1⤵
                  • Executes dropped EXE
                  PID:948
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
                  1⤵
                  • Executes dropped EXE
                  PID:440
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
                  1⤵
                  • Executes dropped EXE
                  PID:992
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                  1⤵
                  • Executes dropped EXE
                  PID:1056
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                  1⤵
                  • Executes dropped EXE
                  PID:1068
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
                  1⤵
                  • Executes dropped EXE
                  PID:1108
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                  1⤵
                  • Executes dropped EXE
                  • Indicator Removal: Clear Windows Event Logs
                  PID:1160
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                  1⤵
                  • Loads dropped DLL
                  • Drops file in System32 directory
                  PID:1196
                  • C:\Windows\system32\taskhostw.exe
                    taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                    2⤵
                    • Executes dropped EXE
                    PID:2796
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                  1⤵
                  • Executes dropped EXE
                  PID:1280
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                  1⤵
                  • Executes dropped EXE
                  PID:1308
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                  1⤵
                  • Executes dropped EXE
                  PID:1376
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                  1⤵
                  • Executes dropped EXE
                  PID:1440
                  • C:\Windows\system32\sihost.exe
                    sihost.exe
                    2⤵
                    • Executes dropped EXE
                    PID:2616
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                  1⤵
                  • Executes dropped EXE
                  PID:1448
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                  1⤵
                  • Executes dropped EXE
                  PID:1460
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                  1⤵
                  • Executes dropped EXE
                  PID:1472
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                  1⤵
                  • Executes dropped EXE
                  PID:1624
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                  1⤵
                  • Executes dropped EXE
                  PID:1688
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                  1⤵
                  • Executes dropped EXE
                  PID:1740
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                  1⤵
                  • Executes dropped EXE
                  PID:1792
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                  1⤵
                  • Executes dropped EXE
                  PID:1832
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                  1⤵
                  • Executes dropped EXE
                  PID:1908
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                  1⤵
                  • Executes dropped EXE
                  PID:1920
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                  1⤵
                  • Executes dropped EXE
                  PID:1992
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                  1⤵
                  • Executes dropped EXE
                  PID:1140
                • C:\Windows\System32\spoolsv.exe
                  C:\Windows\System32\spoolsv.exe
                  1⤵
                  • Executes dropped EXE
                  PID:2076
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
                  1⤵
                  • Executes dropped EXE
                  PID:2124
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                  1⤵
                  • Executes dropped EXE
                  PID:2196
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2216
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                  1⤵
                  • Executes dropped EXE
                  PID:2284
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                  1⤵
                  • Executes dropped EXE
                  PID:2440
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                  1⤵
                  • Executes dropped EXE
                  PID:2448
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                  1⤵
                  • Executes dropped EXE
                  PID:2644
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                  1⤵
                  • Executes dropped EXE
                  • Drops file in System32 directory
                  PID:2728
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2828
                • C:\Windows\sysmon.exe
                  C:\Windows\sysmon.exe
                  1⤵
                  • Executes dropped EXE
                  PID:2836
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                  1⤵
                  • Executes dropped EXE
                  PID:2844
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                  1⤵
                  • Executes dropped EXE
                  PID:2856
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                  1⤵
                  • Executes dropped EXE
                  PID:2932
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                  1⤵
                  • Executes dropped EXE
                  PID:3484
                • C:\Windows\Explorer.EXE
                  C:\Windows\Explorer.EXE
                  1⤵
                  • Executes dropped EXE
                  • Suspicious behavior: GetForegroundWindowSpam
                  PID:3584
                  • C:\Users\Admin\AppData\Local\Temp\0oj3.exe
                    "C:\Users\Admin\AppData\Local\Temp\0oj3.exe"
                    2⤵
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious behavior: RenamesItself
                    • Suspicious use of WriteProcessMemory
                    PID:908
                    • C:\Users\Admin\AppData\Local\Temp\cmd.exe
                      cmd.exe
                      3⤵
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious behavior: RenamesItself
                      • Suspicious use of WriteProcessMemory
                      PID:3040
                      • C:\Users\Admin\AppData\Local\Temp\cmd.exe
                        "C:\Users\Admin\AppData\Local\Temp\cmd.exe"
                        4⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • Drops file in System32 directory
                        • Drops file in Program Files directory
                        • Drops file in Windows directory
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:2972
                        • C:\Windows\system32\cmd.exe
                          "C:\Windows\system32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "cmd" /tr '"C:\ProgramData\cmd.exe"' & exit
                          5⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3728
                          • C:\Windows\system32\schtasks.exe
                            schtasks /create /f /sc onlogon /rl highest /tn "cmd" /tr '"C:\ProgramData\cmd.exe"'
                            6⤵
                            • Scheduled Task/Job: Scheduled Task
                            PID:1956
                        • C:\Windows\System32\sc.exe
                          "C:\Windows\System32\sc.exe" create AutoRunService binPath="C:\Program Files\cmd.exe" type=own start=auto
                          5⤵
                          • Launches sc.exe
                          PID:2276
                        • C:\Windows\System32\sc.exe
                          "C:\Windows\System32\sc.exe" start AutoRunService
                          5⤵
                          • Loads dropped DLL
                          • Launches sc.exe
                          PID:4332
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                  1⤵
                  • Executes dropped EXE
                  PID:3700
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                  1⤵
                  • Loads dropped DLL
                  PID:3784
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                  1⤵
                  • Executes dropped EXE
                  PID:64
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                  1⤵
                  • Executes dropped EXE
                  PID:4688
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                  1⤵
                  • Executes dropped EXE
                  • Modifies data under HKEY_USERS
                  PID:1300
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                  1⤵
                  • Executes dropped EXE
                  PID:4748
                • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                  1⤵
                  • Executes dropped EXE
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  PID:4632
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                  1⤵
                  • Executes dropped EXE
                  PID:3392
                • C:\Windows\System32\WaaSMedicAgent.exe
                  C:\Windows\System32\WaaSMedicAgent.exe d89fb4d4312bf42b06d1117d78b714f6 qu/j20JjzkeyCaYKwFvaxA.0.1.0.0.0
                  1⤵
                    PID:4980
                    • C:\Windows\System32\Conhost.exe
                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      2⤵
                      • Loads dropped DLL
                      PID:1084
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                    1⤵
                    • Loads dropped DLL
                    • Drops file in Windows directory
                    PID:1856
                  • C:\Windows\servicing\TrustedInstaller.exe
                    C:\Windows\servicing\TrustedInstaller.exe
                    1⤵
                    • Loads dropped DLL
                    PID:380
                  • C:\Program Files\cmd.exe
                    "C:\Program Files\cmd.exe"
                    1⤵
                    • Executes dropped EXE
                    • Drops file in System32 directory
                    PID:3156
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                    1⤵
                    • Loads dropped DLL
                    PID:3284
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                    1⤵
                    • Loads dropped DLL
                    • Modifies data under HKEY_USERS
                    PID:1008

                  Network

                  MITRE ATT&CK Enterprise v15

                  Reconnaissance

                  Resource Development

                  Initial Access

                  Execution

                  Scheduled Task/Job

                  1
                  T1053

                  Scheduled Task

                  1
                  T1053.005

                  System Services

                  1
                  T1569

                  Service Execution

                  1
                  T1569.002

                  Persistence

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Create or Modify System Process

                  1
                  T1543

                  Windows Service

                  1
                  T1543.003

                  Scheduled Task/Job

                  1
                  T1053

                  Scheduled Task

                  1
                  T1053.005

                  Privilege Escalation

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Create or Modify System Process

                  1
                  T1543

                  Windows Service

                  1
                  T1543.003

                  Scheduled Task/Job

                  1
                  T1053

                  Scheduled Task

                  1
                  T1053.005

                  Defense Evasion

                  Indicator Removal

                  1
                  T1070

                  Clear Windows Event Logs

                  1
                  T1070.001

                  Modify Registry

                  1
                  T1112

                  Credential Access

                  Discovery

                  Peripheral Device Discovery

                  1
                  T1120

                  Query Registry

                  6
                  T1012

                  System Information Discovery

                  6
                  T1082

                  Lateral Movement

                  Collection

                  Command and Control

                  Exfiltration

                  Impact

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Program Files\cmd.exe
                    Filesize

                    1.9MB

                    MD5

                    5d864ba27836417dbbb494b3a5d888a9

                    SHA1

                    66b87eb33a31d18ac8c89d237c2235b80ecc1b79

                    SHA256

                    0f916874ee10e6b39afb2319eb33ee8f6b6d1b11f223ce859ead0b1375f84b36

                    SHA512

                    6f59639c1b1ec0f928347d2ec7da1c46a5b2c9ef3cff71d2e4ec8009b6a97ca0f033d27a830d4efd697f99982c2a86f6620cd9e392918756425223ca9caafdf6

                    Download Submit

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
                    Filesize

                    328B

                    MD5

                    2074df754ad8660175f943937075a7a6

                    SHA1

                    28939d9017d59ccf2297bc888dbe7c031653d76a

                    SHA256

                    381bea4d4353ff40421c67b507fbb52bbce0630a6fcaa94bfb644074390f0c0b

                    SHA512

                    732555589b3756e98c3c9f52e21732e1ab06decd9a4a3b1c5592c06e73a0663404c898fb489dbfe8d26f69e3a6987148d60d842dea623c2e4f58725aca635d04

                    Download Submit

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749
                    Filesize

                    330B

                    MD5

                    af16cb225127ccaaef0b9e23b64d2b18

                    SHA1

                    570d7b259f2d06a9fa71af144fb2ea1e5cebbe22

                    SHA256

                    122cb0e798e759f74bec59b0ffcf8a182546d1f32ba10fc962e2211d447bd97c

                    SHA512

                    0b45b5eac29f9a94caff173d06b19ababa480e9c39026f82204b3bcdcc5dc9655398e6eaecc5f1e82fdf8eed65cdac73dff23db67670bd666ef7b161315cc803

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\IDX_CONTENT_TASKBARHEADLINES.json
                    Filesize

                    11KB

                    MD5

                    5453333a11530013037401d197bec080

                    SHA1

                    c5db84d4fe89b37e148d5367315e18eb76445ea2

                    SHA256

                    d06ede4355801c994b16736923396e86b590d742f5053e4c877284a677dfeba9

                    SHA512

                    9b74a9a491c264e6d79e7c52b7a424fcc46addffb9913b93e140fdbdcf52130880198344c0cd8049033537ebaa8d8975c694633866f417af0db47d9a8116946e

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\cmd.exe
                    Filesize

                    2.2MB

                    MD5

                    dd2b4161313175caffafa7fa4ee184c6

                    SHA1

                    e660e3063e7771425e1edfffc45d8387c090fb59

                    SHA256

                    c2572e03276acd9c8b641606eb123a304ddfcb1bab172706ce863b1102e42bf4

                    SHA512

                    ed567c0d9827969a66c43dd7c5ac552c18a4f7f4c9063cda30badceddb0397faa14dbef4bb7730b00dc78e55d6f05adc3c149e37a6517f944e4d179e1ae49ce0

                    Download Submit

                  • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
                    Filesize

                    2KB

                    MD5

                    f313c5b4f95605026428425586317353

                    SHA1

                    06be66fa06e1cffc54459c38d3d258f46669d01a

                    SHA256

                    129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b

                    SHA512

                    b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890

                    Download Submit

                  • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
                    Filesize

                    2KB

                    MD5

                    ceb7caa4e9c4b8d760dbf7e9e5ca44c5

                    SHA1

                    a3879621f9493414d497ea6d70fbf17e283d5c08

                    SHA256

                    98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9

                    SHA512

                    1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff

                    Download Submit

                  • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
                    Filesize

                    2KB

                    MD5

                    7d612892b20e70250dbd00d0cdd4f09b

                    SHA1

                    63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5

                    SHA256

                    727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02

                    SHA512

                    f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1

                    Download Submit

                  • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
                    Filesize

                    2KB

                    MD5

                    1e8e2076314d54dd72e7ee09ff8a52ab

                    SHA1

                    5fd0a67671430f66237f483eef39ff599b892272

                    SHA256

                    55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f

                    SHA512

                    5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6

                    Download Submit

                  • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
                    Filesize

                    2KB

                    MD5

                    0b990e24f1e839462c0ac35fef1d119e

                    SHA1

                    9e17905f8f68f9ce0a2024d57b537aa8b39c6708

                    SHA256

                    a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a

                    SHA512

                    c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4

                    Download Submit

                  • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
                    Filesize

                    328B

                    MD5

                    dfaa0a604b45df01b1fb31ee42279670

                    SHA1

                    5547f86517cf2c527e6cfe3c66bef1c2bba60cb1

                    SHA256

                    eeb61e0d25f7383101ee85e3f5b387bb8dfea86bfacffdf8ed32ca1d1449cdca

                    SHA512

                    8ecb711734770793707296a184484429315e78753fa04a4afbddde95794dd699b22e1bc893b69be51dc19a6cb44858bcc003e8c6bedc8bddf23e9ae3bf8dc451

                    Download Submit

                  • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749
                    Filesize

                    330B

                    MD5

                    8e254447a7f166000139c2cecab62adf

                    SHA1

                    3f92f1e3587f5e8453dc6b49218d9738e4a033f9

                    SHA256

                    42974f9bede2b5c75761474dd08989c51dde64abb075513676f9793c75886d36

                    SHA512

                    5a6d84ac086bf6b8c5d54517eeb42f31a4eae27fb85f3b5ef32e36c83c3f2edd10d867d6c24ea10af1313c99db72970ff00f2435a97347b919ce4499d40b0266

                    Download Submit

                  • C:\Windows\system32\ASChelp.dll
                    Filesize

                    112KB

                    MD5

                    6a0f36515a46c1a29da10d9aaf6c2193

                    SHA1

                    47f57d38c99d2e9d6cdbb8c8ef9da9eb2b9f6365

                    SHA256

                    ee45c3f9d8b46a1414a313b356c14ef728847072ad01791924eef53215f2e937

                    SHA512

                    3e33c23b2d0de819fa7cdde962c14934b14d81438f5df0b48e450a851ded2f03809ee80246241d8df2c8768f12a4176792f39808534fdbaea8d00cd41b3a6e02

                    Download Submit

                  • memory/908-2-0x00007FF65F800000-0x00007FF660800000-memory.dmp

                    Filesize

                    16.0MB

                    Download

                  • memory/908-1-0x00007FFBD36E0000-0x00007FFBD36E2000-memory.dmp

                    Filesize

                    8KB

                    Download

                  • memory/908-0-0x00007FFBD36D0000-0x00007FFBD36D2000-memory.dmp

                    Filesize

                    8KB

                    Download

                  • memory/908-6-0x00007FF65F800000-0x00007FF660800000-memory.dmp

                    Filesize

                    16.0MB

                    Download

                  • memory/1856-286-0x000002D77DF50000-0x000002D77DF51000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1856-282-0x000002D77DF90000-0x000002D77DF91000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1856-281-0x000002D77E050000-0x000002D77E054000-memory.dmp

                    Filesize

                    16KB

                    Download

                  • memory/2972-19-0x000002C0BF010000-0x000002C0BF016000-memory.dmp

                    Filesize

                    24KB

                    Download

                  • memory/2972-17-0x000002C0BD150000-0x000002C0BD392000-memory.dmp

                    Filesize

                    2.3MB

                    Download

                  • memory/3040-18-0x00007FF65F800000-0x00007FF660800000-memory.dmp

                    Filesize

                    16.0MB

                    Download

                  • memory/3056-180-0x0000021B86C70000-0x0000021B86C78000-memory.dmp

                    Filesize

                    32KB

                    Download

                  • memory/3056-181-0x0000021B86C50000-0x0000021B86C51000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/3156-31-0x0000023350110000-0x00000233502FC000-memory.dmp

                    Filesize

                    1.9MB

                    Download

                  • memory/3904-217-0x0000023157D00000-0x0000023157D08000-memory.dmp

                    Filesize

                    32KB

                    Download

                  • memory/3904-218-0x00000231578B0000-0x00000231578B1000-memory.dmp

                    Filesize

                    4KB

                    Download