Analysis
- max time kernel
150s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20250217-en - resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system - submitted
02/03/2025, 18:11
Behavioral task
behavioral1
Sample
stub.exe
Resource
win7-20240903-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
stub.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
27 signatures
150 seconds
General
- Target stub.exe
- Size 231KB
- Sample250302-ws3kfazzd1
- SHA256 9d08e5e62b409ef1ccd05c7996eb5432e4a36f55642cb7441d153909e823f144
- MD5 265b52aa4d100784d7cd39258d5e4d21
- SHA1 5b708da62d55364477ffb77e7feb4193f4635f92
- SHA512 4ce9e2c41b65ce3c108765dcd934e0f2a12f6c9640cb2ae547997b26a66da1d515ea7bfeb9cc529a57fbd41f51d61068ca7b9f551119e1403ff0cf1b5684e661
- SSDEEP 3072:AvNYkHFE9jZOjT4LD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQigS:srE9Z/5bTgVziHzZnSKrCbYMJZbe8tq
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
xworm
Version
-
5.0
C2
-
217.136.29.82:50007
Attributes
-
install_file
Mason.exe
aes.plain
Signatures
- Detect Xworm Payload 2 IoCs
resource yara_rule behavioral2/memory/4944-1-0x000001AAE3BA0000-0x000001AAE3BE0000-memory.dmp family_xworm behavioral2/memory/4944-415-0x000001AAFE400000-0x000001AAFE40E000-memory.dmp family_xworm - Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 2460 created 380 2460 WerFault.exe 13 - Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
description pid Process procid_target PID 2860 created 612 2860 svchost.exe 5 PID 2860 created 380 2860 svchost.exe 13 - Xworm family
- Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DoSvc\ImagePath = "C:\\Windows\\System32\\svchost.exe -k NetworkService -p" WaaSMedicAgent.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion wmiprvse.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\Control Panel\International\Geo\Nation stub.exe - Executes dropped EXE 1 IoCs
pid Process 4900 qzmfbac3.naq.exe - Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs
Clear Windows Event Logs to hide the activity of an intrusion.
description ioc Process File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx svchost.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: svchost.exe File opened (read-only) \??\Y: svchost.exe File opened (read-only) \??\G: svchost.exe File opened (read-only) \??\Q: svchost.exe File opened (read-only) \??\R: svchost.exe File opened (read-only) \??\Z: svchost.exe File opened (read-only) \??\B: svchost.exe File opened (read-only) \??\K: svchost.exe File opened (read-only) \??\V: svchost.exe File opened (read-only) \??\A: svchost.exe File opened (read-only) \??\E: svchost.exe File opened (read-only) \??\H: svchost.exe File opened (read-only) \??\J: svchost.exe File opened (read-only) \??\P: svchost.exe File opened (read-only) \??\S: svchost.exe File opened (read-only) \??\U: svchost.exe File opened (read-only) \??\W: svchost.exe File opened (read-only) \??\I: svchost.exe File opened (read-only) \??\L: svchost.exe File opened (read-only) \??\M: svchost.exe File opened (read-only) \??\N: svchost.exe File opened (read-only) \??\O: svchost.exe File opened (read-only) \??\T: svchost.exe - Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PHYSICALDRIVE0 wmiprvse.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776 svchost.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan svchost.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work svchost.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml OfficeClickToRun.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776 svchost.exe - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 18 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags wmiprvse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000\LogConf wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Mfg wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Mfg wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc wmiprvse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service wmiprvse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 wmiprvse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000\LogConf wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName wmiprvse.exe - Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe - Enumerates system info in registry 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier wmiprvse.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe - Modifies data under HKEY_USERS 57 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={4716907A-E266-4403-9FD6-9DC7734AE833}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1740939194" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ExtendedProperties\LID = "00184012963080C5" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,1329 15,1329 100,1329 6" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Sun, 02 Mar 2025 18:13:15 GMT" OfficeClickToRun.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,41484365,17110988,7153487,39965824,17962391,508368333,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe - Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\94454692-9453-45d2 RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\c103b508-1323-4201 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable RuntimeBroker.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1816 SCHTASKS.exe 3980 SCHTASKS.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 812 WerFault.exe 812 WerFault.exe 2216 WerFault.exe 2216 WerFault.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 2860 svchost.exe 2860 svchost.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 2860 svchost.exe 2860 svchost.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe 4900 qzmfbac3.naq.exe - Suspicious behavior: LoadsDriver 64 IoCs
pid Process 1912 Process not Found 4556 Process not Found 4544 Process not Found 1744 Process not Found 856 Process not Found 800 Process not Found 1028 Process not Found 4068 Process not Found 1772 Process not Found 3924 Process not Found 672 Process not Found 2768 Process not Found 4356 Process not Found 516 Process not Found 428 Process not Found 1164 Process not Found 1200 Process not Found 1216 Process not Found 1356 Process not Found 2028 Process not Found 1220 Process not Found 1408 Process not Found 2760 Process not Found 2596 Process not Found 232 Process not Found 2948 Process not Found 1748 Process not Found 1532 Process not Found 4856 Process not Found 2944 Process not Found 5040 Process not Found 1256 Process not Found 3372 Process not Found 2412 Process not Found 2496 Process not Found 1104 Process not Found 3524 Process not Found 1716 Process not Found 2216 Process not Found 2960 Process not Found 1384 Process not Found 3492 Process not Found 3584 Process not Found 2024 Process not Found 1984 Process not Found 1128 Process not Found 4620 Process not Found 2128 Process not Found 3104 Process not Found 3088 Process not Found 1612 Process not Found 1980 Process not Found 748 Process not Found 3700 Process not Found 1584 Process not Found 3452 Process not Found 1360 Process not Found 3388 Process not Found 4600 Process not Found 5108 Process not Found 1660 Process not Found 1644 Process not Found 4116 Process not Found 336 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4944 stub.exe Token: SeDebugPrivilege 4900 qzmfbac3.naq.exe Token: SeShutdownPrivilege 3416 Explorer.EXE Token: SeCreatePagefilePrivilege 3416 Explorer.EXE Token: SeShutdownPrivilege 3416 Explorer.EXE Token: SeCreatePagefilePrivilege 3416 Explorer.EXE Token: SeAuditPrivilege 2980 svchost.exe Token: SeShutdownPrivilege 3416 Explorer.EXE Token: SeCreatePagefilePrivilege 3416 Explorer.EXE Token: SeShutdownPrivilege 3416 Explorer.EXE Token: SeCreatePagefilePrivilege 3416 Explorer.EXE Token: SeShutdownPrivilege 3416 Explorer.EXE Token: SeCreatePagefilePrivilege 3416 Explorer.EXE Token: SeShutdownPrivilege 3416 Explorer.EXE Token: SeCreatePagefilePrivilege 3416 Explorer.EXE Token: SeShutdownPrivilege 3416 Explorer.EXE Token: SeCreatePagefilePrivilege 3416 Explorer.EXE Token: SeShutdownPrivilege 3416 Explorer.EXE Token: SeCreatePagefilePrivilege 3416 Explorer.EXE Token: SeShutdownPrivilege 3416 Explorer.EXE Token: SeCreatePagefilePrivilege 3416 Explorer.EXE Token: SeAuditPrivilege 2980 svchost.exe Token: SeShutdownPrivilege 820 svchost.exe Token: SeCreatePagefilePrivilege 820 svchost.exe Token: SeShutdownPrivilege 820 svchost.exe Token: SeCreatePagefilePrivilege 820 svchost.exe Token: SeShutdownPrivilege 820 svchost.exe Token: SeCreatePagefilePrivilege 820 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2088 svchost.exe Token: SeIncreaseQuotaPrivilege 2088 svchost.exe Token: SeSecurityPrivilege 2088 svchost.exe Token: SeTakeOwnershipPrivilege 2088 svchost.exe Token: SeLoadDriverPrivilege 2088 svchost.exe Token: SeBackupPrivilege 2088 svchost.exe Token: SeRestorePrivilege 2088 svchost.exe Token: SeShutdownPrivilege 2088 svchost.exe Token: SeSystemEnvironmentPrivilege 2088 svchost.exe Token: SeManageVolumePrivilege 2088 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2088 svchost.exe Token: SeIncreaseQuotaPrivilege 2088 svchost.exe Token: SeSecurityPrivilege 2088 svchost.exe Token: SeTakeOwnershipPrivilege 2088 svchost.exe Token: SeLoadDriverPrivilege 2088 svchost.exe Token: SeSystemtimePrivilege 2088 svchost.exe Token: SeBackupPrivilege 2088 svchost.exe Token: SeRestorePrivilege 2088 svchost.exe Token: SeShutdownPrivilege 2088 svchost.exe Token: SeSystemEnvironmentPrivilege 2088 svchost.exe Token: SeUndockPrivilege 2088 svchost.exe Token: SeManageVolumePrivilege 2088 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2088 svchost.exe Token: SeIncreaseQuotaPrivilege 2088 svchost.exe Token: SeSecurityPrivilege 2088 svchost.exe Token: SeTakeOwnershipPrivilege 2088 svchost.exe Token: SeLoadDriverPrivilege 2088 svchost.exe Token: SeSystemtimePrivilege 2088 svchost.exe Token: SeBackupPrivilege 2088 svchost.exe Token: SeRestorePrivilege 2088 svchost.exe Token: SeShutdownPrivilege 2088 svchost.exe Token: SeSystemEnvironmentPrivilege 2088 svchost.exe Token: SeUndockPrivilege 2088 svchost.exe Token: SeManageVolumePrivilege 2088 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2088 svchost.exe Token: SeIncreaseQuotaPrivilege 2088 svchost.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3416 Explorer.EXE - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4944 wrote to memory of 4900 4944 stub.exe 89 PID 4944 wrote to memory of 4900 4944 stub.exe 89 PID 4944 wrote to memory of 1816 4944 stub.exe 90 PID 4944 wrote to memory of 1816 4944 stub.exe 90 PID 4900 wrote to memory of 612 4900 qzmfbac3.naq.exe 5 PID 4900 wrote to memory of 676 4900 qzmfbac3.naq.exe 7 PID 4900 wrote to memory of 968 4900 qzmfbac3.naq.exe 12 PID 4900 wrote to memory of 380 4900 qzmfbac3.naq.exe 13 PID 4900 wrote to memory of 740 4900 qzmfbac3.naq.exe 14 PID 4900 wrote to memory of 1064 4900 qzmfbac3.naq.exe 16 PID 4900 wrote to memory of 1072 4900 qzmfbac3.naq.exe 17 PID 4900 wrote to memory of 1096 4900 qzmfbac3.naq.exe 18 PID 4900 wrote to memory of 1192 4900 qzmfbac3.naq.exe 19 PID 4900 wrote to memory of 1204 4900 qzmfbac3.naq.exe 20 PID 4900 wrote to memory of 1284 4900 qzmfbac3.naq.exe 21 PID 4900 wrote to memory of 1300 4900 qzmfbac3.naq.exe 22 PID 4900 wrote to memory of 1400 4900 qzmfbac3.naq.exe 23 PID 4900 wrote to memory of 1452 4900 qzmfbac3.naq.exe 24 PID 4900 wrote to memory of 1484 4900 qzmfbac3.naq.exe 25 PID 4900 wrote to memory of 1508 4900 qzmfbac3.naq.exe 26 PID 4900 wrote to memory of 1524 4900 qzmfbac3.naq.exe 27 PID 4900 wrote to memory of 1596 4900 qzmfbac3.naq.exe 28 PID 4900 wrote to memory of 1672 4900 qzmfbac3.naq.exe 29 PID 4900 wrote to memory of 1704 4900 qzmfbac3.naq.exe 30 PID 4900 wrote to memory of 1780 4900 qzmfbac3.naq.exe 31 PID 4900 wrote to memory of 1808 4900 qzmfbac3.naq.exe 32 PID 4900 wrote to memory of 1964 4900 qzmfbac3.naq.exe 33 PID 4900 wrote to memory of 1084 4900 qzmfbac3.naq.exe 34 PID 4900 wrote to memory of 1240 4900 qzmfbac3.naq.exe 35 PID 4900 wrote to memory of 2056 4900 qzmfbac3.naq.exe 36 PID 4900 wrote to memory of 2088 4900 qzmfbac3.naq.exe 37 PID 4900 wrote to memory of 2116 4900 qzmfbac3.naq.exe 38 PID 4900 wrote to memory of 2248 4900 qzmfbac3.naq.exe 39 PID 4900 wrote to memory of 2348 4900 qzmfbac3.naq.exe 41 PID 4900 wrote to memory of 2492 4900 qzmfbac3.naq.exe 42 PID 4900 wrote to memory of 2520 4900 qzmfbac3.naq.exe 43 PID 4900 wrote to memory of 2640 4900 qzmfbac3.naq.exe 44 PID 4900 wrote to memory of 2688 4900 qzmfbac3.naq.exe 45 PID 4900 wrote to memory of 2712 4900 qzmfbac3.naq.exe 46 PID 4900 wrote to memory of 2720 4900 qzmfbac3.naq.exe 47 PID 4900 wrote to memory of 2932 4900 qzmfbac3.naq.exe 49 PID 4900 wrote to memory of 2980 4900 qzmfbac3.naq.exe 50 PID 4900 wrote to memory of 2996 4900 qzmfbac3.naq.exe 51 PID 4900 wrote to memory of 3016 4900 qzmfbac3.naq.exe 52 PID 4900 wrote to memory of 3032 4900 qzmfbac3.naq.exe 53 PID 4900 wrote to memory of 3212 4900 qzmfbac3.naq.exe 54 PID 4900 wrote to memory of 3416 4900 qzmfbac3.naq.exe 55 PID 4900 wrote to memory of 3424 4900 qzmfbac3.naq.exe 56 PID 4900 wrote to memory of 3740 4900 qzmfbac3.naq.exe 57 PID 4900 wrote to memory of 3916 4900 qzmfbac3.naq.exe 58 PID 4900 wrote to memory of 4080 4900 qzmfbac3.naq.exe 60 PID 4900 wrote to memory of 4188 4900 qzmfbac3.naq.exe 62 PID 4900 wrote to memory of 4936 4900 qzmfbac3.naq.exe 65 PID 4900 wrote to memory of 4388 4900 qzmfbac3.naq.exe 67 PID 4900 wrote to memory of 2488 4900 qzmfbac3.naq.exe 68 PID 4900 wrote to memory of 3752 4900 qzmfbac3.naq.exe 69 PID 4900 wrote to memory of 3620 4900 qzmfbac3.naq.exe 70 PID 4900 wrote to memory of 3136 4900 qzmfbac3.naq.exe 71 PID 4900 wrote to memory of 1380 4900 qzmfbac3.naq.exe 72 PID 4900 wrote to memory of 4128 4900 qzmfbac3.naq.exe 73 PID 4900 wrote to memory of 1368 4900 qzmfbac3.naq.exe 75 PID 4900 wrote to memory of 3300 4900 qzmfbac3.naq.exe 76 PID 4900 wrote to memory of 5076 4900 qzmfbac3.naq.exe 77 PID 4900 wrote to memory of 3636 4900 qzmfbac3.naq.exe 78 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:612
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:380
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 380 -s 26043⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:2216
-
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 612 -s 11242⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:812
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:676
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:968
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:740
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:1064
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1072
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1096
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1192
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
- Drops file in System32 directory
PID:1204 -
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵PID:2640
-
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe2⤵PID:4424
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1284
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1300
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1400
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1452
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1484
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1508
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1524
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:2492
-
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:4340
-
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:2188
-
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:2132
-
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:4612
-
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:3224
-
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:1624
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1596
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1672
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1704
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1780
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1808
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:1964
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:1084
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1240
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:2056
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2088
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2116
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:2248
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2348
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2520
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵PID:2688
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2712
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2720
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
- Drops file in System32 directory
PID:2932
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:2980
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵PID:2996
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:3016
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:3032
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:3212
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\stub.exe"C:\Users\Admin\AppData\Local\Temp\stub.exe"2⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\qzmfbac3.naq.exe"C:\Users\Admin\AppData\Local\Temp\qzmfbac3.naq.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4900
-
-
C:\Windows\SYSTEM32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "Masonstub.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\stub.exe'" /sc onlogon /rl HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:1816
-
-
C:\Windows\SYSTEM32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "Masonstub.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\stub.exe'" /sc onlogon /rl HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:3980 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:3452
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:3424
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3740
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3916
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4080
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4188
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:4936
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:4388
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2488
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
PID:3752
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵PID:3620
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:3136
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1380
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:4128
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵PID:1368
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3300
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵PID:5076
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵PID:3636
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Modifies registry class
PID:4396
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:548
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2624
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
PID:2860 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 508 -p 380 -ip 3802⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2460
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 548 -p 612 -ip 6122⤵PID:5104
-
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe f0636eb8b967fcc6d70333ef05cd14e8 7Dgk7JPNRkyRPoHYa4sPsQ.0.1.0.0.01⤵
- Sets service image path in registry
- Modifies data under HKEY_USERS
PID:384 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵PID:1132
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:820
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
- Checks BIOS information in registry
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
- Enumerates system info in registry
PID:5036
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵PID:616
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵PID:3488
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵PID:2052
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Indicator Removal
1Clear Windows Event Logs
1Modify Registry
1Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Microsoft\Windows\WER\Temp\WEREFAF.tmp.csv
- Size 39KB
- SHA256 c318411eefa5b8401965de4457c12b390e3de2258f65ffb1978c52a1db584cf8
- MD5 e586728f40a0093c8eb3024bd7b2f18a
- SHA1 25b01dcaa2395d13620dcd5b8c485a841d3d5b62
- SHA512 1e3b58bc58a1646eb043859f60f3b3b038f6a2612384e34c48fec821910ad6ba053a32b386cb5d17f993b0b565966d5b84ba1f056e0d7b73e36fa698d683a49c
- SSDEEP 768:2MPy19EE8pFQ4/MdB4/AmQ1Cu1eSnqdCh1PKC2nJXWGt:2MqXEE8p64/Md8AmSRbjPKzJXWGt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Microsoft\Windows\WER\Temp\WEREFCF.tmp.txt
- Size 13KB
- SHA256 ff415ce5c35d0d15a499da5f1ae4cdf7d264f8e2caf3545d3f77ec4a9fd39cc6
- MD5 dc83a7ab3a12a83cebfeffe698ea0eb5
- SHA1 9da76e30388453efbed186da1e9cc93eba0b836c
- SHA512 ed5b336c761d754b019b91dc6deee3722274eafacaed2faa9c0f8cd222a6644cac86dabf257dd00566eb1d50bb636c4b1fb17e00a4a8ec71886a607050e8a7da
- SSDEEP 96:4ief+KMANiYsY8/WIfH7YEZnNCt7iaF/S/wm3MUa1ACNMXA5IyU3:Nef+prZNPHa1ACNMXAmyU3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Microsoft\Windows\WER\Temp\WERF00F.tmp.csv
- Size 37KB
- SHA256 706734a524bdee58aa69150dd492a2db1ffeafd21f8aaa35d599a07e627fd435
- MD5 df04aa8b9ffaf45fc4294e860040706e
- SHA1 e4d32abd93b9b8e6369094ab1945056a6635c0b9
- SHA512 5a684c855827057d91e9b771c5b1ecebf9b0fb316f49f51d2a9591a17cfdffb0f27fe823b427fa62c2556a6c281e7abe08e0f689c98de930e1301f734f1233d6
- SSDEEP 768:HIPXJGxCJ45p4B4/3dB4WLbfk1Cl1eSn1dChzPrlnDUy:HIPoUJ45pc4/3d1Lbf1RalPJDUy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Microsoft\Windows\WER\Temp\WERF02F.tmp.txt
- Size 13KB
- SHA256 e542cac89ae7a9cc94b2f7ba2a9a1c95334ad96c1f9719133e2146e91ab1882b
- MD5 43232d8488364daff24cc1a2b5b7a076
- SHA1 21f895e762d21066ed4d00cd28dc74b36a453a54
- SHA512 17b9196f6aef15a69ae14a80e14662a0b143097a46827b3ac769c3b0bf456563adc0267d19e1631a8eff4b8af90e1363bd98a26be9a26ebe1382f58e1b415147
- SSDEEP 96:4iefMgIzG+Y8YsYW0HXYEZx01t7i9FlKSkwB3JDcVa1A0M0AXIm43:NefMtbATMa1A0M0A4m43
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\qzmfbac3.naq.exe
- Size 161KB
- SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
- MD5 94f1ab3a068f83b32639579ec9c5d025
- SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
- SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
- SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
- Size 2KB
- SHA256 55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f
- MD5 1e8e2076314d54dd72e7ee09ff8a52ab
- SHA1 5fd0a67671430f66237f483eef39ff599b892272
- SHA512 5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6
- MD5 SHA1 SHA512
- Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
- Size 2KB
- SHA256 a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a
- MD5 0b990e24f1e839462c0ac35fef1d119e
- SHA1 9e17905f8f68f9ce0a2024d57b537aa8b39c6708
- SHA512 c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4
- MD5 SHA1 SHA512
- Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
- Size 404B
- SHA256 97a1c4c6d8dd639e85a2388c4e37360c6ea506fb1b32b1f07d85a1a5d806e1d2
- MD5 537dc33671c397e8f6c9e2f95a3dfe04
- SHA1 27d8871864bd7b256572f0c937da403f68f4ccd6
- SHA512 8453a3ca6fec8a20fa5032402886a1f94398ee29593528c502a9ad51a31e493ec73c469307183719fb230a06814a4984236260ac882fadc75c6a992b6a39a40a
- MD5 SHA1 SHA512