438e44aae94e8376d2e36e23212920e936b7517bca24eaf66e9d7d014e21552c

Analysis

max time kernel
896s
max time network
846s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2025, 06:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

xiaose.exe
Size

537KB
MD5

494303294715f5ffad7ad3f43b73b00b
SHA1

6c1948f7edf115cd1f13cd170b882077930be150
SHA256

27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7
SHA512

6a96af34a8443876222d61d6d99041f5f749d062bb65c2e580e9d50b2c7588c510d3c71fd72b0281f17a76bf76aee345c3227ae6d7502623fe600a2cd6da960b
SSDEEP

12288:ItucH+fOkEXRTrC6/mdD0ehe2YvXGKHW1W:G5/mdD0ehtYOKHWY

Score

10^/10

defense_evasion discovery

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 4 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	xiaose.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	xiaose.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\xiaose.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xiaose.exe:*:enabled:@shell32.dll,-1"	xiaose.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	xiaose.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral31/files/0x000b000000023c8f-2.dat	acprotect

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Control Panel\International\Geo\Nation	xiaose.exe

Executes dropped EXE 1 IoCs

pid	Process
1796	Terms.EXE

Loads dropped DLL 7 IoCs

pid	Process
3368	xiaose.exe
3368	xiaose.exe
1796	Terms.EXE
1796	Terms.EXE
4504	WerFault.exe
4504	WerFault.exe
2552	WerFault.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	xiaose.exe
File opened (read-only)	\??\E:	xiaose.exe
File opened (read-only)	\??\I:	xiaose.exe
File opened (read-only)	\??\J:	xiaose.exe
File opened (read-only)	\??\V:	xiaose.exe
File opened (read-only)	\??\Z:	xiaose.exe
File opened (read-only)	\??\K:	xiaose.exe
File opened (read-only)	\??\L:	xiaose.exe
File opened (read-only)	\??\O:	xiaose.exe
File opened (read-only)	\??\S:	xiaose.exe
File opened (read-only)	\??\W:	xiaose.exe
File opened (read-only)	\??\M:	xiaose.exe
File opened (read-only)	\??\N:	xiaose.exe
File opened (read-only)	\??\Q:	xiaose.exe
File opened (read-only)	\??\R:	xiaose.exe
File opened (read-only)	\??\U:	xiaose.exe
File opened (read-only)	\??\X:	xiaose.exe
File opened (read-only)	\??\Y:	xiaose.exe
File opened (read-only)	\??\G:	xiaose.exe
File opened (read-only)	\??\H:	xiaose.exe
File opened (read-only)	\??\P:	xiaose.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Terms.EXE	xiaose.exe
File opened for modification	C:\Windows\Terms.EXE	xiaose.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2552	3368	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xiaose.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Terms.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3368	xiaose.exe
3368	xiaose.exe
1796	Terms.EXE
1796	Terms.EXE
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe
3368	xiaose.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3368	xiaose.exe
Token: SeDebugPrivilege	1796	Terms.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3368	xiaose.exe
1796	Terms.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 584	3368	xiaose.exe	5
PID 3368 wrote to memory of 584	3368	xiaose.exe	5
PID 3368 wrote to memory of 584	3368	xiaose.exe	5
PID 3368 wrote to memory of 584	3368	xiaose.exe	5
PID 3368 wrote to memory of 584	3368	xiaose.exe	5
PID 3368 wrote to memory of 584	3368	xiaose.exe	5
PID 3368 wrote to memory of 680	3368	xiaose.exe	7
PID 3368 wrote to memory of 680	3368	xiaose.exe	7
PID 3368 wrote to memory of 680	3368	xiaose.exe	7
PID 3368 wrote to memory of 680	3368	xiaose.exe	7
PID 3368 wrote to memory of 680	3368	xiaose.exe	7
PID 3368 wrote to memory of 680	3368	xiaose.exe	7
PID 3368 wrote to memory of 792	3368	xiaose.exe	8
PID 3368 wrote to memory of 792	3368	xiaose.exe	8
PID 3368 wrote to memory of 792	3368	xiaose.exe	8
PID 3368 wrote to memory of 792	3368	xiaose.exe	8
PID 3368 wrote to memory of 792	3368	xiaose.exe	8
PID 3368 wrote to memory of 792	3368	xiaose.exe	8
PID 3368 wrote to memory of 800	3368	xiaose.exe	9
PID 3368 wrote to memory of 800	3368	xiaose.exe	9
PID 3368 wrote to memory of 800	3368	xiaose.exe	9
PID 3368 wrote to memory of 800	3368	xiaose.exe	9
PID 3368 wrote to memory of 800	3368	xiaose.exe	9
PID 3368 wrote to memory of 800	3368	xiaose.exe	9
PID 3368 wrote to memory of 804	3368	xiaose.exe	10
PID 3368 wrote to memory of 804	3368	xiaose.exe	10
PID 3368 wrote to memory of 804	3368	xiaose.exe	10
PID 3368 wrote to memory of 804	3368	xiaose.exe	10
PID 3368 wrote to memory of 804	3368	xiaose.exe	10
PID 3368 wrote to memory of 804	3368	xiaose.exe	10
PID 3368 wrote to memory of 916	3368	xiaose.exe	11
PID 3368 wrote to memory of 916	3368	xiaose.exe	11
PID 3368 wrote to memory of 916	3368	xiaose.exe	11
PID 3368 wrote to memory of 916	3368	xiaose.exe	11
PID 3368 wrote to memory of 916	3368	xiaose.exe	11
PID 3368 wrote to memory of 916	3368	xiaose.exe	11
PID 3368 wrote to memory of 960	3368	xiaose.exe	12
PID 3368 wrote to memory of 960	3368	xiaose.exe	12
PID 3368 wrote to memory of 960	3368	xiaose.exe	12
PID 3368 wrote to memory of 960	3368	xiaose.exe	12
PID 3368 wrote to memory of 960	3368	xiaose.exe	12
PID 3368 wrote to memory of 960	3368	xiaose.exe	12
PID 3368 wrote to memory of 60	3368	xiaose.exe	13
PID 3368 wrote to memory of 60	3368	xiaose.exe	13
PID 3368 wrote to memory of 60	3368	xiaose.exe	13
PID 3368 wrote to memory of 60	3368	xiaose.exe	13
PID 3368 wrote to memory of 60	3368	xiaose.exe	13
PID 3368 wrote to memory of 60	3368	xiaose.exe	13
PID 3368 wrote to memory of 408	3368	xiaose.exe	14
PID 3368 wrote to memory of 408	3368	xiaose.exe	14
PID 3368 wrote to memory of 408	3368	xiaose.exe	14
PID 3368 wrote to memory of 408	3368	xiaose.exe	14
PID 3368 wrote to memory of 408	3368	xiaose.exe	14
PID 3368 wrote to memory of 408	3368	xiaose.exe	14
PID 3368 wrote to memory of 956	3368	xiaose.exe	15
PID 3368 wrote to memory of 956	3368	xiaose.exe	15
PID 3368 wrote to memory of 956	3368	xiaose.exe	15
PID 3368 wrote to memory of 956	3368	xiaose.exe	15
PID 3368 wrote to memory of 956	3368	xiaose.exe	15
PID 3368 wrote to memory of 956	3368	xiaose.exe	15
PID 3368 wrote to memory of 512	3368	xiaose.exe	16
PID 3368 wrote to memory of 512	3368	xiaose.exe	16
PID 3368 wrote to memory of 512	3368	xiaose.exe	16
PID 3368 wrote to memory of 512	3368	xiaose.exe	16

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:584
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:804
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:60

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:792
- C:\Windows\system32\wbem\unsecapp.exe
  C:\Windows\system32\wbem\unsecapp.exe -Embedding
  2⤵
  PID:2904
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3772
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3948
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4016
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3212
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4204
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:2844
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:2836
- C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
  2⤵
  PID:4716
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:2740
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
  2⤵
  PID:3904
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:3412
- C:\Windows\system32\BackgroundTaskHost.exe
  "C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
  2⤵
  PID:4908
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3656
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:1272
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
  2⤵
  PID:1440
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
  2⤵
  PID:3472

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:408

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:512

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1144
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:3056
- C:\Windows\system32\MusNotification.exe
  C:\Windows\system32\MusNotification.exe
  2⤵
  PID:3076

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1412
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1600

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1612

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1708

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1732

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1780

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1888

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1900

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1996

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2100

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2148

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2536

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2572

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3396

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3480
- C:\Users\Admin\AppData\Local\Temp\xiaose.exe
  "C:\Users\Admin\AppData\Local\Temp\xiaose.exe"
  2⤵
  - Modifies firewall policy service
  - Checks computer location settings
  - Loads dropped DLL
  - Enumerates connected drives
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3368
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 1692
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4980

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:4568

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:2688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4148

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:4592

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:5032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:116

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe cb51dfe1717c8565a5100be235eca96f PlEi2/Fw/0iIiXb3OoL5SQ.0.1.0.0.0
1⤵
PID:2624
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:4756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:4932

C:\Windows\Terms.EXE
C:\Windows\Terms.EXE
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3368 -ip 3368
1⤵
- Loads dropped DLL
PID:4504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ytiC2F2.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Windows\Terms.EXE

Filesize
537KB

MD5
494303294715f5ffad7ad3f43b73b00b

SHA1
6c1948f7edf115cd1f13cd170b882077930be150

SHA256
27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7

SHA512
6a96af34a8443876222d61d6d99041f5f749d062bb65c2e580e9d50b2c7588c510d3c71fd72b0281f17a76bf76aee345c3227ae6d7502623fe600a2cd6da960b

Download Submit
memory/1796-52-0x0000000000D40000-0x0000000000DB3000-memory.dmp

Filesize
460KB

Download
memory/1796-39-0x0000000000D40000-0x0000000000DB3000-memory.dmp

Filesize
460KB

Download
memory/1796-38-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1796-22-0x0000000000D40000-0x0000000000DB3000-memory.dmp

Filesize
460KB

Download
memory/1796-20-0x0000000000D40000-0x0000000000DB3000-memory.dmp

Filesize
460KB

Download
memory/3368-8-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/3368-27-0x000000007FE30000-0x000000007FE3C000-memory.dmp

Filesize
48KB

Download
memory/3368-15-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/3368-11-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/3368-0-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/3368-25-0x000000007FE30000-0x000000007FE3C000-memory.dmp

Filesize
48KB

Download
memory/3368-26-0x000000007FE30000-0x000000007FE3C000-memory.dmp

Filesize
48KB

Download
memory/3368-12-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/3368-31-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/3368-34-0x000000007FE30000-0x000000007FE3C000-memory.dmp

Filesize
48KB

Download
memory/3368-37-0x0000000002070000-0x00000000020E3000-memory.dmp

Filesize
460KB

Download
memory/3368-9-0x0000000077582000-0x0000000077583000-memory.dmp

Filesize
4KB

Download
memory/3368-10-0x0000000077583000-0x0000000077584000-memory.dmp

Filesize
4KB

Download
memory/3368-6-0x0000000002070000-0x00000000020E3000-memory.dmp

Filesize
460KB

Download