Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
02/03/2025, 18:31
Behavioral task
behavioral1
Sample
MasonRootkit.exe
Resource
win7-20240903-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
MasonRootkit.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
26 signatures
150 seconds
General
-
Target
MasonRootkit.exe
-
Size
231KB
-
MD5
265b52aa4d100784d7cd39258d5e4d21
-
SHA1
5b708da62d55364477ffb77e7feb4193f4635f92
-
SHA256
9d08e5e62b409ef1ccd05c7996eb5432e4a36f55642cb7441d153909e823f144
-
SHA512
4ce9e2c41b65ce3c108765dcd934e0f2a12f6c9640cb2ae547997b26a66da1d515ea7bfeb9cc529a57fbd41f51d61068ca7b9f551119e1403ff0cf1b5684e661
-
SSDEEP
3072:AvNYkHFE9jZOjT4LD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQigS:srE9Z/5bTgVziHzZnSKrCbYMJZbe8tq
Score
10/10
Malware Config
Extracted
Family
xworm
Version
5.0
C2
217.136.29.82:50007
Attributes
-
install_file
Mason.exe
aes.plain
Signatures
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral2/memory/756-1-0x000001C4501D0000-0x000001C450210000-memory.dmp family_xworm behavioral2/memory/756-418-0x000001C46A920000-0x000001C46A92E000-memory.dmp family_xworm -
Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs
description pid Process procid_target PID 5060 created 604 5060 WerFault.exe 5 PID 3636 created 340 3636 WerFault.exe 13 -
Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs
description pid Process procid_target PID 3504 created 340 3504 svchost.exe 13 PID 3504 created 604 3504 svchost.exe 5 PID 3504 created 340 3504 svchost.exe 13 -
Xworm family
-
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DoSvc\ImagePath = "C:\\Windows\\System32\\svchost.exe -k NetworkService -p" WaaSMedicAgent.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion wmiprvse.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Control Panel\International\Geo\Nation MasonRootkit.exe -
Executes dropped EXE 1 IoCs
pid Process 2976 czzawfwq.002.exe -
Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs
Clear Windows Event Logs to hide the activity of an intrusion.
description ioc Process File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx svchost.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: svchost.exe File opened (read-only) \??\E: svchost.exe File opened (read-only) \??\H: svchost.exe File opened (read-only) \??\N: svchost.exe File opened (read-only) \??\O: svchost.exe File opened (read-only) \??\S: svchost.exe File opened (read-only) \??\U: svchost.exe File opened (read-only) \??\V: svchost.exe File opened (read-only) \??\I: svchost.exe File opened (read-only) \??\J: svchost.exe File opened (read-only) \??\L: svchost.exe File opened (read-only) \??\P: svchost.exe File opened (read-only) \??\Q: svchost.exe File opened (read-only) \??\W: svchost.exe File opened (read-only) \??\X: svchost.exe File opened (read-only) \??\Y: svchost.exe File opened (read-only) \??\M: svchost.exe File opened (read-only) \??\R: svchost.exe File opened (read-only) \??\T: svchost.exe File opened (read-only) \??\Z: svchost.exe File opened (read-only) \??\B: svchost.exe File opened (read-only) \??\G: svchost.exe File opened (read-only) \??\K: svchost.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PHYSICALDRIVE0 wmiprvse.exe -
Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776 svchost.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work svchost.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml OfficeClickToRun.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776 svchost.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan svchost.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749 svchost.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 18 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service wmiprvse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Mfg wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags wmiprvse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000\LogConf wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName wmiprvse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID wmiprvse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000\LogConf wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Mfg wmiprvse.exe -
Checks processor information in registry 2 TTPs 9 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe -
Enumerates system info in registry 2 TTPs 7 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier wmiprvse.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe -
Modifies data under HKEY_USERS 57 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ExtendedProperties\LID = "001800127D4965FB" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,1329 15,1329 100,1329 6" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,41484365,17110988,7153487,39965824,17962391,508368333,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1740940410" OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={8B7C720E-4BB3-439B-A34C-13B98B79CE31}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Sun, 02 Mar 2025 18:33:31 GMT" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4860 SCHTASKS.exe 556 SCHTASKS.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2976 czzawfwq.002.exe 2976 czzawfwq.002.exe 2976 czzawfwq.002.exe 2976 czzawfwq.002.exe 2976 czzawfwq.002.exe 2976 czzawfwq.002.exe 2976 czzawfwq.002.exe 2976 czzawfwq.002.exe 2976 czzawfwq.002.exe 2976 czzawfwq.002.exe 4248 WerFault.exe 4248 WerFault.exe 1984 WerFault.exe 1984 WerFault.exe 2976 czzawfwq.002.exe 2976 czzawfwq.002.exe 3504 svchost.exe 3504 svchost.exe 2976 czzawfwq.002.exe 2976 czzawfwq.002.exe 2976 czzawfwq.002.exe 2976 czzawfwq.002.exe 3504 svchost.exe 3504 svchost.exe 2976 czzawfwq.002.exe 2976 czzawfwq.002.exe 2976 czzawfwq.002.exe 2976 czzawfwq.002.exe 2976 czzawfwq.002.exe 2976 czzawfwq.002.exe 2976 czzawfwq.002.exe 2976 czzawfwq.002.exe 4220 WerFault.exe 4220 WerFault.exe 3504 svchost.exe 3504 svchost.exe 3504 svchost.exe 3504 svchost.exe 2976 czzawfwq.002.exe 2976 czzawfwq.002.exe 2976 czzawfwq.002.exe 2976 czzawfwq.002.exe 2976 czzawfwq.002.exe 2976 czzawfwq.002.exe 2976 czzawfwq.002.exe 2976 czzawfwq.002.exe 2976 czzawfwq.002.exe 2976 czzawfwq.002.exe 2976 czzawfwq.002.exe 2976 czzawfwq.002.exe 2976 czzawfwq.002.exe 2976 czzawfwq.002.exe 2976 czzawfwq.002.exe 2976 czzawfwq.002.exe 2976 czzawfwq.002.exe 2976 czzawfwq.002.exe 2976 czzawfwq.002.exe 2976 czzawfwq.002.exe 2976 czzawfwq.002.exe 2976 czzawfwq.002.exe 2976 czzawfwq.002.exe 2976 czzawfwq.002.exe 2976 czzawfwq.002.exe 2976 czzawfwq.002.exe -
Suspicious behavior: LoadsDriver 64 IoCs
pid Process 1312 Process not Found 1440 Process not Found 4688 Process not Found 1696 Process not Found 1120 Process not Found 920 Process not Found 904 Process not Found 3336 Process not Found 1412 Process not Found 3992 Process not Found 3060 Process not Found 1004 Process not Found 3016 Process not Found 5012 Process not Found 1056 Process not Found 3668 Process not Found 2136 Process not Found 2800 Process not Found 4048 Process not Found 208 Process not Found 2348 Process not Found 4120 Process not Found 4760 Process not Found 4428 Process not Found 2892 Process not Found 4636 Process not Found 536 Process not Found 3892 Process not Found 724 Process not Found 5040 Process not Found 636 Process not Found 2828 Process not Found 3052 Process not Found 3740 Process not Found 1328 Process not Found 560 Process not Found 1076 Process not Found 4796 Process not Found 4948 Process not Found 4792 Process not Found 4880 Process not Found 1984 Process not Found 2052 Process not Found 4888 Process not Found 4456 Process not Found 2160 Process not Found 3672 Process not Found 2576 Process not Found 4440 Process not Found 1732 Process not Found 4412 Process not Found 4536 Process not Found 812 Process not Found 3084 Process not Found 1968 Process not Found 3620 Process not Found 2024 Process not Found 784 Process not Found 2308 Process not Found 1284 Process not Found 3700 Process not Found 2692 Process not Found 2388 Process not Found 3088 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 756 MasonRootkit.exe Token: SeDebugPrivilege 2976 czzawfwq.002.exe Token: SeShutdownPrivilege 3468 Explorer.EXE Token: SeCreatePagefilePrivilege 3468 Explorer.EXE Token: SeShutdownPrivilege 3468 Explorer.EXE Token: SeCreatePagefilePrivilege 3468 Explorer.EXE Token: SeAuditPrivilege 2492 svchost.exe Token: SeShutdownPrivilege 3468 Explorer.EXE Token: SeCreatePagefilePrivilege 3468 Explorer.EXE Token: SeShutdownPrivilege 3468 Explorer.EXE Token: SeCreatePagefilePrivilege 3468 Explorer.EXE Token: SeShutdownPrivilege 3468 Explorer.EXE Token: SeCreatePagefilePrivilege 3468 Explorer.EXE Token: SeShutdownPrivilege 3468 Explorer.EXE Token: SeCreatePagefilePrivilege 3468 Explorer.EXE Token: SeShutdownPrivilege 3468 Explorer.EXE Token: SeCreatePagefilePrivilege 3468 Explorer.EXE Token: SeShutdownPrivilege 3468 Explorer.EXE Token: SeCreatePagefilePrivilege 3468 Explorer.EXE Token: SeShutdownPrivilege 3468 Explorer.EXE Token: SeCreatePagefilePrivilege 3468 Explorer.EXE Token: SeShutdownPrivilege 440 svchost.exe Token: SeCreatePagefilePrivilege 440 svchost.exe Token: SeShutdownPrivilege 440 svchost.exe Token: SeCreatePagefilePrivilege 440 svchost.exe Token: SeShutdownPrivilege 440 svchost.exe Token: SeCreatePagefilePrivilege 440 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2208 svchost.exe Token: SeIncreaseQuotaPrivilege 2208 svchost.exe Token: SeSecurityPrivilege 2208 svchost.exe Token: SeTakeOwnershipPrivilege 2208 svchost.exe Token: SeLoadDriverPrivilege 2208 svchost.exe Token: SeBackupPrivilege 2208 svchost.exe Token: SeRestorePrivilege 2208 svchost.exe Token: SeShutdownPrivilege 2208 svchost.exe Token: SeSystemEnvironmentPrivilege 2208 svchost.exe Token: SeManageVolumePrivilege 2208 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2208 svchost.exe Token: SeIncreaseQuotaPrivilege 2208 svchost.exe Token: SeSecurityPrivilege 2208 svchost.exe Token: SeTakeOwnershipPrivilege 2208 svchost.exe Token: SeLoadDriverPrivilege 2208 svchost.exe Token: SeSystemtimePrivilege 2208 svchost.exe Token: SeBackupPrivilege 2208 svchost.exe Token: SeRestorePrivilege 2208 svchost.exe Token: SeShutdownPrivilege 2208 svchost.exe Token: SeSystemEnvironmentPrivilege 2208 svchost.exe Token: SeUndockPrivilege 2208 svchost.exe Token: SeManageVolumePrivilege 2208 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2208 svchost.exe Token: SeIncreaseQuotaPrivilege 2208 svchost.exe Token: SeSecurityPrivilege 2208 svchost.exe Token: SeTakeOwnershipPrivilege 2208 svchost.exe Token: SeLoadDriverPrivilege 2208 svchost.exe Token: SeSystemtimePrivilege 2208 svchost.exe Token: SeBackupPrivilege 2208 svchost.exe Token: SeRestorePrivilege 2208 svchost.exe Token: SeShutdownPrivilege 2208 svchost.exe Token: SeSystemEnvironmentPrivilege 2208 svchost.exe Token: SeUndockPrivilege 2208 svchost.exe Token: SeManageVolumePrivilege 2208 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2208 svchost.exe Token: SeIncreaseQuotaPrivilege 2208 svchost.exe Token: SeSecurityPrivilege 2208 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3468 Explorer.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 756 wrote to memory of 2976 756 MasonRootkit.exe 87 PID 756 wrote to memory of 2976 756 MasonRootkit.exe 87 PID 756 wrote to memory of 4860 756 MasonRootkit.exe 88 PID 756 wrote to memory of 4860 756 MasonRootkit.exe 88 PID 2976 wrote to memory of 604 2976 czzawfwq.002.exe 5 PID 2976 wrote to memory of 688 2976 czzawfwq.002.exe 7 PID 2976 wrote to memory of 960 2976 czzawfwq.002.exe 12 PID 2976 wrote to memory of 340 2976 czzawfwq.002.exe 13 PID 2976 wrote to memory of 412 2976 czzawfwq.002.exe 14 PID 2976 wrote to memory of 1044 2976 czzawfwq.002.exe 16 PID 2976 wrote to memory of 1060 2976 czzawfwq.002.exe 17 PID 2976 wrote to memory of 1092 2976 czzawfwq.002.exe 18 PID 2976 wrote to memory of 1184 2976 czzawfwq.002.exe 19 PID 2976 wrote to memory of 1200 2976 czzawfwq.002.exe 20 PID 2976 wrote to memory of 1260 2976 czzawfwq.002.exe 21 PID 2976 wrote to memory of 1316 2976 czzawfwq.002.exe 22 PID 2976 wrote to memory of 1344 2976 czzawfwq.002.exe 23 PID 2976 wrote to memory of 1444 2976 czzawfwq.002.exe 24 PID 2976 wrote to memory of 1460 2976 czzawfwq.002.exe 25 PID 2976 wrote to memory of 1504 2976 czzawfwq.002.exe 26 PID 2976 wrote to memory of 1532 2976 czzawfwq.002.exe 27 PID 2976 wrote to memory of 1636 2976 czzawfwq.002.exe 28 PID 2976 wrote to memory of 1716 2976 czzawfwq.002.exe 29 PID 2976 wrote to memory of 1724 2976 czzawfwq.002.exe 30 PID 2976 wrote to memory of 1812 2976 czzawfwq.002.exe 31 PID 2976 wrote to memory of 1820 2976 czzawfwq.002.exe 32 PID 2976 wrote to memory of 1940 2976 czzawfwq.002.exe 33 PID 2976 wrote to memory of 1948 2976 czzawfwq.002.exe 34 PID 2976 wrote to memory of 1972 2976 czzawfwq.002.exe 35 PID 2976 wrote to memory of 2008 2976 czzawfwq.002.exe 36 PID 2976 wrote to memory of 1784 2976 czzawfwq.002.exe 37 PID 2976 wrote to memory of 2164 2976 czzawfwq.002.exe 39 PID 2976 wrote to memory of 2208 2976 czzawfwq.002.exe 40 PID 2976 wrote to memory of 2288 2976 czzawfwq.002.exe 41 PID 2976 wrote to memory of 2296 2976 czzawfwq.002.exe 42 PID 2976 wrote to memory of 2392 2976 czzawfwq.002.exe 43 PID 2976 wrote to memory of 2420 2976 czzawfwq.002.exe 44 PID 2976 wrote to memory of 2492 2976 czzawfwq.002.exe 45 PID 2976 wrote to memory of 2520 2976 czzawfwq.002.exe 46 PID 2976 wrote to memory of 2556 2976 czzawfwq.002.exe 47 PID 2976 wrote to memory of 2592 2976 czzawfwq.002.exe 48 PID 2976 wrote to memory of 2996 2976 czzawfwq.002.exe 49 PID 2976 wrote to memory of 3008 2976 czzawfwq.002.exe 50 PID 2976 wrote to memory of 1124 2976 czzawfwq.002.exe 51 PID 2976 wrote to memory of 780 2976 czzawfwq.002.exe 53 PID 2976 wrote to memory of 3204 2976 czzawfwq.002.exe 54 PID 2976 wrote to memory of 3388 2976 czzawfwq.002.exe 55 PID 2976 wrote to memory of 3468 2976 czzawfwq.002.exe 56 PID 2976 wrote to memory of 3580 2976 czzawfwq.002.exe 57 PID 2976 wrote to memory of 3780 2976 czzawfwq.002.exe 58 PID 2976 wrote to memory of 3976 2976 czzawfwq.002.exe 60 PID 2976 wrote to memory of 3912 2976 czzawfwq.002.exe 62 PID 2976 wrote to memory of 4460 2976 czzawfwq.002.exe 64 PID 2976 wrote to memory of 5024 2976 czzawfwq.002.exe 66 PID 2976 wrote to memory of 3656 2976 czzawfwq.002.exe 68 PID 2976 wrote to memory of 1404 2976 czzawfwq.002.exe 69 PID 2976 wrote to memory of 2572 2976 czzawfwq.002.exe 70 PID 2976 wrote to memory of 2172 2976 czzawfwq.002.exe 71 PID 2976 wrote to memory of 1468 2976 czzawfwq.002.exe 72 PID 2976 wrote to memory of 1872 2976 czzawfwq.002.exe 73 PID 2976 wrote to memory of 3864 2976 czzawfwq.002.exe 74 PID 2976 wrote to memory of 3144 2976 czzawfwq.002.exe 75 PID 2976 wrote to memory of 4976 2976 czzawfwq.002.exe 77 PID 2976 wrote to memory of 2928 2976 czzawfwq.002.exe 82 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:604
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:340
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 340 -s 37043⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:1984
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 340 -s 15723⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:4220
-
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 604 -s 8602⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:4248
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:688
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:960
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:412
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:1044
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1060
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1092
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1184
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
- Drops file in System32 directory
PID:1200 -
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵PID:780
-
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe2⤵PID:2928
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1260
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1316
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1344
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1444
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1460
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1504
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1532
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:2996
-
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:436
-
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:3788
-
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:4348
-
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:2468
-
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:8
-
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:1216
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1636
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1716
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1724
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1812
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1820
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:1940
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1948
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:1972
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:2008
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:1784
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2164
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2208
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2288
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2296
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
- Drops file in System32 directory
PID:2392
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2420
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:2492
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵PID:2520
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2556
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2592
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:3008
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:1124
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵PID:3204
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:3388
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"2⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\czzawfwq.002.exe"C:\Users\Admin\AppData\Local\Temp\czzawfwq.002.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2976
-
-
C:\Windows\SYSTEM32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "MasonMasonRootkit.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe'" /sc onlogon /rl HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:4860
-
-
C:\Windows\SYSTEM32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "MasonMasonRootkit.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe'" /sc onlogon /rl HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:556 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:1332
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3580
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3780
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3976
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3912
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4460
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5024
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:3656
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:1404
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:2572
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵PID:2172
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
PID:1468
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1872
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵PID:3864
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3144
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵PID:4976
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
PID:3504 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 448 -p 340 -ip 3402⤵PID:708
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 512 -p 604 -ip 6042⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5060
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 644 -p 340 -ip 3402⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3636
-
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 6a0012c2987224600e0de847c6b46242 mmmZc5dk0Eik/LZ69zMN8w.0.1.0.0.01⤵
- Sets service image path in registry
- Modifies data under HKEY_USERS
PID:1140 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵PID:4016
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:440
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
- Checks BIOS information in registry
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
- Enumerates system info in registry
PID:808
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵PID:4084
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Indicator Removal
1Clear Windows Event Logs
1Modify Registry
1Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD537bc70fb2f32bab8d9a9f67a9428cb0a
SHA19427e043f6486c43314c22b11f8494405fc7e623
SHA2569d75ef6b62cea4c9d224da91872288bc2adec8cb3ff034bf3e2dd03446888ff3
SHA512e39d16ef732443bac61833cbba148f7531b66646a7b96d48e7e68255500db89ab02be971269fa6f18ea00e4e137037515d13bd1b5204f50991e32ec2ddbf16e9
-
Filesize
13KB
MD544ddc83496f4fe9c313d357ac368f7a9
SHA110cedd69c34e0d25e2afa12b2426b4a69fda15cd
SHA256c1c7a3a1d6f42e9da39d7cd2bb4b40cdc5991857d3f7fc0cf8e79465f8f8f60e
SHA5129ec02ae7bf342501fad74590118e640967fe86f6a71ecc51630867b5e81243be709efea71e40fe9475bacb4ef705c63cd3ecf4a32079aeb579ce06242b3a2771
-
Filesize
36KB
MD53da32f94c7c3ae917b720cd6807916b4
SHA1e9b9f27ddb08ff4852fdb00df0e3761ed3be5c6b
SHA2566a940b04718ac5bf966e325d430e01ab8b25bcc2dd64737a2b351f96105504f0
SHA512b29fdd886d71329588a7b6a5e5717dc599c31882f2032177ef5944f89b6df2e98cd05bb0f10462a0553db27d9c966d774cac565d8fcb8ba7ce3a9e317536c424
-
Filesize
13KB
MD54fb02d93fce43625bd0b04e9b52a428a
SHA10160ba14cf1014a7c8d9d4365f9096b14e85b35b
SHA256d8fd5ef947ad7ac2626414fa39f4f10c0bab8bf80f0e85a6be59dc5260643520
SHA512e8243ec424b8dcf815adc164eafc816f666e7901aa76a34fa736941d2d9b3c5f86350856f09e56843f916e523bb9988fcc534183e474b9266fd04ff78aed6d71
-
Filesize
36KB
MD5e0eab02aab823abb82a5082195b644c6
SHA1c90459d6903b87fc0f6456711df005b7acef95a2
SHA2565544b68ff27711f06c124fdd83425e380f456bffc97c06d7098aa0a13e85f8c0
SHA512a7bd75ed9e76ad13f22c71bb94ce91ad46d27b1180f5f09b3f8922c90d0a9abbfdc291c5158b1bf961628b49e18f1edee0aba7aad2966628ecccb174bca0b539
-
Filesize
13KB
MD540d5def47a9902c79442f103f5b827ba
SHA17c0d3499548a1fe583465953c7ebe982d84de369
SHA256ecdd5c02b6e0547c90f3920357c603a5ab721ccf2b36eccf4f309fd76619e8d1
SHA512e20b17920fae9d2b61285a682bd6f728d1382612eab06779f7b9ed469619260c0ff686cf3662fe42beaa514923b7abf7025021364739f91ccc237e1ea0830643
-
Filesize
161KB
MD594f1ab3a068f83b32639579ec9c5d025
SHA138f3d5bc5de46feb8de093d11329766b8e2054ae
SHA256879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
SHA51244d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
-
Filesize
2KB
MD51e8e2076314d54dd72e7ee09ff8a52ab
SHA15fd0a67671430f66237f483eef39ff599b892272
SHA25655f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f
SHA5125b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6
-
Filesize
2KB
MD50b990e24f1e839462c0ac35fef1d119e
SHA19e17905f8f68f9ce0a2024d57b537aa8b39c6708
SHA256a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a
SHA512c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4
-
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5ea476906cb6f9dbb1b0ca1b5c024babd
SHA1b4a6cc8787ab457e90947ba23092de709ea35574
SHA2565ad02fcb0d34881297dc118b2eb565dd7513cf1de4c15227a774cb6b943ced87
SHA512264b7222c8f13ee1f343f9910ff54857195c61e426c61b13c6462b92f81961944fa7d78e7feb91572df9d5fe87972476aa6ecdae5984f78ae802afd6a4023a01