88bf0db97f3bf88a4b7f0aaff64cc4065cb5da6c140008e6cb22316da47428bb

Analysis

max time kernel
61s
platform
windows11-21h2_x64
resource
win11-20250502-en
resource tags

arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
submitted
28/05/2025, 21:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Runtime Broker.scr.exe
Size 231KB
Sample250528-1dw7bstmt7
SHA256 88bf0db97f3bf88a4b7f0aaff64cc4065cb5da6c140008e6cb22316da47428bb
MD5 b0d3794c8e0344c2ea7a975cfd838a53
SHA1 c2584b38119ed749714178ed3fa8f5b4e98ec350
SHA512 2ff04f56f3f2653147b0a73cfbc3910dff70f3979957f306cde22ef4a5f658409085acc40302e69bdbe7799cd99b4dff5375f59807a6a17a7898121917cb2b6b
SSDEEP 6144:BxW0VD1J/5bTgVziHzZnSKrCbYMmVb78Vq:X7/5/gVziHlBrCbYN8s
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1940 created 544	1940	WerFault.exe	13

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 1576 created 696	1576	svchost.exe	7
PID 1576 created 544	1576	svchost.exe	13

Executes dropped EXE 1 IoCs

pid	Process
768	bzthk51s.0ki.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 2 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Storsvc%4Diagnostic.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WER-Diag%4Operational.evtx	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 14 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe

Modifies data under HKEY_USERS 20 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\RemoteSession\Profile	winlogon.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\RemoteSession	winlogon.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\MuiCached\MachinePreferredUILanguages = 65006e002d005500530000000000	winlogon.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\RemoteSession\CLSID	winlogon.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "210"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\RemoteSession\KeyboardLayout = "0"	winlogon.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4632	SCHTASKS.exe
2284	SCHTASKS.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
768	bzthk51s.0ki.exe
768	bzthk51s.0ki.exe
768	bzthk51s.0ki.exe
768	bzthk51s.0ki.exe
768	bzthk51s.0ki.exe
768	bzthk51s.0ki.exe
768	bzthk51s.0ki.exe
768	bzthk51s.0ki.exe
768	bzthk51s.0ki.exe
768	bzthk51s.0ki.exe
768	bzthk51s.0ki.exe
768	bzthk51s.0ki.exe
768	bzthk51s.0ki.exe
2384	WerFault.exe
2384	WerFault.exe
2948	WerFault.exe
2948	WerFault.exe
768	bzthk51s.0ki.exe
768	bzthk51s.0ki.exe
1576	svchost.exe
1576	svchost.exe
1576	svchost.exe
1576	svchost.exe
768	bzthk51s.0ki.exe
768	bzthk51s.0ki.exe
768	bzthk51s.0ki.exe
6140	Process not Found
6140	Process not Found
768	bzthk51s.0ki.exe
768	bzthk51s.0ki.exe
768	bzthk51s.0ki.exe
768	bzthk51s.0ki.exe
768	bzthk51s.0ki.exe
768	bzthk51s.0ki.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
2520	Process not Found
2640	Process not Found
5780	Process not Found
3196	Process not Found
4528	Process not Found
856	Process not Found
3788	Process not Found
3152	Process not Found
3980	Process not Found
736	Process not Found
668	Process not Found
1540	Process not Found
2488	Process not Found
5032	Process not Found
1444	Process not Found
6000	Process not Found
3028	Process not Found
5632	Process not Found
884	Process not Found
5276	Process not Found
5808	Process not Found
6108	Process not Found
2140	Process not Found
5932	Process not Found
5308	Process not Found
800	Process not Found
1408	Process not Found
1348	Process not Found
4680	Process not Found
2176	Process not Found
4712	Process not Found
2232	Process not Found
1588	Process not Found
1796	Process not Found
1816	Process not Found
4040	Process not Found
3948	Process not Found
5328	Process not Found
556	Process not Found
572	Process not Found
4560	Process not Found
4904	Process not Found
72	Process not Found
4724	Process not Found
5952	Process not Found
4224	Process not Found
4252	Process not Found
4360	Process not Found
2060	Process not Found
4916	Process not Found
4992	Process not Found
1908	Process not Found
5448	Process not Found
5100	Process not Found
3008	Process not Found
5068	Process not Found
5040	Process not Found
5060	Process not Found
5044	Process not Found
2288	Process not Found
2292	Process not Found
396	Process not Found
760	Process not Found
1044	Process not Found

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeDebugPrivilege	1436	Runtime Broker.scr.exe
Token: SeDebugPrivilege	768	bzthk51s.0ki.exe
Token: SeRestorePrivilege	2384	WerFault.exe
Token: SeBackupPrivilege	2384	WerFault.exe
Token: SeShutdownPrivilege	3264	Explorer.EXE
Token: SeCreatePagefilePrivilege	3264	Explorer.EXE
Token: SeShutdownPrivilege	3264	Explorer.EXE
Token: SeCreatePagefilePrivilege	3264	Explorer.EXE
Token: SeShutdownPrivilege	3264	Explorer.EXE
Token: SeCreatePagefilePrivilege	3264	Explorer.EXE
Token: SeShutdownPrivilege	640	winlogon.exe
Token: SeShutdownPrivilege	3264	Explorer.EXE
Token: SeCreatePagefilePrivilege	3264	Explorer.EXE
Token: SeShutdownPrivilege	3264	Explorer.EXE
Token: SeCreatePagefilePrivilege	3264	Explorer.EXE
Token: SeShutdownPrivilege	3264	Explorer.EXE
Token: SeCreatePagefilePrivilege	3264	Explorer.EXE
Token: SeShutdownPrivilege	3264	Explorer.EXE
Token: SeCreatePagefilePrivilege	3264	Explorer.EXE
Token: SeShutdownPrivilege	3264	Explorer.EXE
Token: SeCreatePagefilePrivilege	3264	Explorer.EXE
Token: SeBackupPrivilege	1484	svchost.exe
Token: SeRestorePrivilege	1484	svchost.exe
Token: SeShutdownPrivilege	640	winlogon.exe
Token: SeAuditPrivilege	2364	svchost.exe
Token: SeRestorePrivilege	1336	svchost.exe
Token: SeBackupPrivilege	1336	svchost.exe
Token: SeShutdownPrivilege	640	winlogon.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3264	Explorer.EXE
3264	Explorer.EXE

Suspicious use of SendNotifyMessage 29 IoCs

pid	Process
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE
3264	Explorer.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2360	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 768	1436	Runtime Broker.scr.exe	78
PID 1436 wrote to memory of 768	1436	Runtime Broker.scr.exe	78
PID 1436 wrote to memory of 4632	1436	Runtime Broker.scr.exe	79
PID 1436 wrote to memory of 4632	1436	Runtime Broker.scr.exe	79
PID 768 wrote to memory of 640	768	bzthk51s.0ki.exe	5
PID 768 wrote to memory of 696	768	bzthk51s.0ki.exe	7
PID 768 wrote to memory of 992	768	bzthk51s.0ki.exe	12
PID 768 wrote to memory of 544	768	bzthk51s.0ki.exe	13
PID 768 wrote to memory of 720	768	bzthk51s.0ki.exe	14
PID 768 wrote to memory of 616	768	bzthk51s.0ki.exe	15
PID 768 wrote to memory of 1076	768	bzthk51s.0ki.exe	16
PID 768 wrote to memory of 1084	768	bzthk51s.0ki.exe	17
PID 768 wrote to memory of 1216	768	bzthk51s.0ki.exe	19
PID 768 wrote to memory of 1228	768	bzthk51s.0ki.exe	20
PID 768 wrote to memory of 1312	768	bzthk51s.0ki.exe	21
PID 768 wrote to memory of 1336	768	bzthk51s.0ki.exe	22
PID 768 wrote to memory of 1364	768	bzthk51s.0ki.exe	23
PID 768 wrote to memory of 1484	768	bzthk51s.0ki.exe	24
PID 768 wrote to memory of 1508	768	bzthk51s.0ki.exe	25
PID 768 wrote to memory of 1624	768	bzthk51s.0ki.exe	26
PID 768 wrote to memory of 1636	768	bzthk51s.0ki.exe	27
PID 768 wrote to memory of 1716	768	bzthk51s.0ki.exe	28
PID 768 wrote to memory of 1724	768	bzthk51s.0ki.exe	29
PID 768 wrote to memory of 1768	768	bzthk51s.0ki.exe	30
PID 768 wrote to memory of 1860	768	bzthk51s.0ki.exe	31
PID 768 wrote to memory of 1880	768	bzthk51s.0ki.exe	32
PID 768 wrote to memory of 1968	768	bzthk51s.0ki.exe	33
PID 768 wrote to memory of 1976	768	bzthk51s.0ki.exe	34
PID 768 wrote to memory of 1468	768	bzthk51s.0ki.exe	35
PID 768 wrote to memory of 1836	768	bzthk51s.0ki.exe	36
PID 768 wrote to memory of 2144	768	bzthk51s.0ki.exe	37
PID 768 wrote to memory of 2320	768	bzthk51s.0ki.exe	39
PID 768 wrote to memory of 2364	768	bzthk51s.0ki.exe	40
PID 768 wrote to memory of 2532	768	bzthk51s.0ki.exe	41
PID 768 wrote to memory of 2540	768	bzthk51s.0ki.exe	42
PID 768 wrote to memory of 2580	768	bzthk51s.0ki.exe	43
PID 768 wrote to memory of 2596	768	bzthk51s.0ki.exe	44
PID 768 wrote to memory of 2676	768	bzthk51s.0ki.exe	45
PID 768 wrote to memory of 2700	768	bzthk51s.0ki.exe	46
PID 768 wrote to memory of 2708	768	bzthk51s.0ki.exe	47
PID 768 wrote to memory of 2728	768	bzthk51s.0ki.exe	48
PID 768 wrote to memory of 3020	768	bzthk51s.0ki.exe	49
PID 768 wrote to memory of 3068	768	bzthk51s.0ki.exe	50
PID 768 wrote to memory of 3104	768	bzthk51s.0ki.exe	51
PID 768 wrote to memory of 3264	768	bzthk51s.0ki.exe	52
PID 768 wrote to memory of 3444	768	bzthk51s.0ki.exe	53
PID 768 wrote to memory of 3456	768	bzthk51s.0ki.exe	54
PID 768 wrote to memory of 3840	768	bzthk51s.0ki.exe	57
PID 768 wrote to memory of 3896	768	bzthk51s.0ki.exe	58
PID 768 wrote to memory of 3988	768	bzthk51s.0ki.exe	59
PID 768 wrote to memory of 4012	768	bzthk51s.0ki.exe	60
PID 768 wrote to memory of 4264	768	bzthk51s.0ki.exe	61
PID 768 wrote to memory of 4456	768	bzthk51s.0ki.exe	62
PID 768 wrote to memory of 4180	768	bzthk51s.0ki.exe	65
PID 768 wrote to memory of 4960	768	bzthk51s.0ki.exe	66
PID 768 wrote to memory of 5624	768	bzthk51s.0ki.exe	67
PID 768 wrote to memory of 1936	768	bzthk51s.0ki.exe	69
PID 768 wrote to memory of 5820	768	bzthk51s.0ki.exe	70
PID 768 wrote to memory of 456	768	bzthk51s.0ki.exe	71
PID 768 wrote to memory of 1176	768	bzthk51s.0ki.exe	72
PID 768 wrote to memory of 3500	768	bzthk51s.0ki.exe	73
PID 768 wrote to memory of 2300	768	bzthk51s.0ki.exe	74
PID 768 wrote to memory of 5384	768	bzthk51s.0ki.exe	75
PID 768 wrote to memory of 1436	768	bzthk51s.0ki.exe	77

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:640
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:544
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 544 -s 3096
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:2948
- C:\Windows\system32\LogonUI.exe
  "LogonUI.exe" /flags:0x0 /state0:0xa3a1d055 /state1:0x41c64e6d
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  PID:2360

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:696
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 696 -s 2596
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:720

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:616

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1228

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1484
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:3020

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1624

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1724

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1768

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1880

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1976

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1836

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2144

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2320

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2596

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2676

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3068

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3104

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3264
- C:\Users\Admin\AppData\Local\Temp\Runtime Broker.scr.exe
  "C:\Users\Admin\AppData\Local\Temp\Runtime Broker.scr.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1436
- - C:\Users\Admin\AppData\Local\Temp\bzthk51s.0ki.exe
    "C:\Users\Admin\AppData\Local\Temp\bzthk51s.0ki.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:768
- - C:\Windows\SYSTEM32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "MasonRuntime Broker.scr.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\Runtime Broker.scr.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4632
- - C:\Windows\SYSTEM32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "MasonRuntime Broker.scr.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\Runtime Broker.scr.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3456

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3840

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3896

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4012

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:4264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:4960

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:5624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:1936

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:5820

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:456

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:3500

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:5384

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
PID:1576
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -pss -s 508 -p 696 -ip 696
  2⤵
  PID:5380
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -pss -s 552 -p 544 -ip 544
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  PID:1940

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
PID:4160

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4440

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000114 0000008c
1⤵
PID:2284

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000010c 0000008c
1⤵
PID:2336

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 0000010c 0000008c
1⤵
PID:6140

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000108 0000008c
1⤵
PID:4160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WER.2b9681fb-32ca-4394-9dca-379a7e32b51e.tmp.txt

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WER.2b9681fb-32ca-4394-9dca-379a7e32b51e.tmp.txt
Size 13KB
SHA256 d5af033db86a5f0783d1146a798e221befade279ce3030a6c67916abbbbb083e
MD5 a82c18f225ed0dbf482d34d612cc1aff
SHA1 ef9e1a2abd88c8ffa1e27cff9736e25d13a98371
SHA512 11e4f74f057f1d7fc7b888a04d343de05d09e3947f03417c47630c7250e4d937007b09fc92272075d5417fe9f8f10b6a99d0c12f7ba4787abdc467fe6fe4a1a4
SSDEEP 96:4iefdvEPg0oJSYgJY0+WVHhYEZuatFicFfRewZf+a/c22MteDg7I+F3:Nef03JgmWa/cJMteDg0+F3
MD5 SHA1 SHA512 SSDEEP

Submit Download

WER.328aafbd-18ea-4ca9-b727-35b5196962a5.tmp.txt

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WER.328aafbd-18ea-4ca9-b727-35b5196962a5.tmp.txt
Size 13KB
SHA256 558a64c9ae0e178f3a561750486a579dcd98eaaf7bd7f14b9aa3e85c52ca1a31
MD5 ae250d3b7e119585841fe00a737b8caf
SHA1 b50a80375427791a1f992bed5d0bd873030f7476
SHA512 754d449a4d3ffdebbd2fa59cedcb55fc03180ea5e079c8fb94ee27716dd3406422b50edc45801ffdbf379bebd6c7f26cb374666984fabb50da0ace2a968ec145
SSDEEP 96:4iefWTr0goJIY5YjkTWkHMYEZgVtFiYF2RSwAf/ay6eMQfDg7IiF3:NefE+8kJXay6eMQfDg0iF3
MD5 SHA1 SHA512 SSDEEP

Submit Download

WER.53d3d5db-2e68-4dae-93da-7267f3f44922.tmp.csv

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WER.53d3d5db-2e68-4dae-93da-7267f3f44922.tmp.csv
Size 34KB
SHA256 922868cf3831e573a155039e27759f9f831b85a60616ba083f63445b64edd6d9
MD5 1d92a924fa3d528957be76eaf000a68c
SHA1 b6cfb5f2326eeafcc965b27f7afdb09a1be4e560
SHA512 1ef6a9599c6bb1af6e9020c10425de293e1274394c480b8633495b739e441bcda7f0c73dac8c31ffed0421797fd2e575cae4213c8de01ba5a1ad6ddcc2afe0e7
SSDEEP 768:yiH+LGdNyaxqXbdo7HV9UpOJINrAzxT3OL:yiHMGdNyiqXbdox9UpOLxT+L
MD5 SHA1 SHA512 SSDEEP

Submit Download

WER.98f53e2b-1fd3-4881-a5e3-d77365bd4b29.tmp.csv

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WER.98f53e2b-1fd3-4881-a5e3-d77365bd4b29.tmp.csv
Size 34KB
SHA256 f4c28aadf0b18bf17173eb0c5f8b86b1f354c19c0094013441e1ec2183ee265f
MD5 ea5a70e2e1aeb7c4cf21774ccedb838b
SHA1 e6cde43ee994ce4bd5b9da7290ec17794ba14232
SHA512 fd6e6684db113a055589bb20ffe2ffd1eac729c19fe9118fb0586e964190261f88fc236a4da9c21cf992f43f0f53bab6c92477f22151bba43f2fb45a0a85d2e3
SSDEEP 768:+hOxTGINyaxqXbdo7H19UpOJINrAzxT3Ote:+hOFGINyiqXbdoR9UpOLxT+te
MD5 SHA1 SHA512 SSDEEP

Submit Download

bzthk51s.0ki.exe

Path C:\Users\Admin\AppData\Local\Temp\bzthk51s.0ki.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/544-89-0x00007FFF8BA04000-0x00007FFF8BA05000-memory.dmp

Download

memory/544-90-0x00007FFF8BA03000-0x00007FFF8BA04000-memory.dmp

Download

memory/544-91-0x00007FFF8BA06000-0x00007FFF8BA07000-memory.dmp

Download

memory/544-88-0x0000021CAC990000-0x0000021CAC9BB000-memory.dmp

Download

memory/640-15-0x000001FC86670000-0x000001FC86695000-memory.dmp

Download

memory/640-83-0x00007FFF8BA04000-0x00007FFF8BA05000-memory.dmp

Download

memory/640-79-0x000001FC866A0000-0x000001FC866CB000-memory.dmp

Download

memory/640-20-0x00007FFF4B9F0000-0x00007FFF4BA00000-memory.dmp

Download

memory/640-19-0x000001FC866A0000-0x000001FC866CB000-memory.dmp

Download

memory/696-24-0x00007FFF4B9F0000-0x00007FFF4BA00000-memory.dmp

Download

memory/696-92-0x0000018162B00000-0x0000018162B2B000-memory.dmp

Download

memory/696-93-0x00007FFF8BA03000-0x00007FFF8BA04000-memory.dmp

Download

memory/696-94-0x00007FFF8BA06000-0x00007FFF8BA07000-memory.dmp

Download

memory/696-23-0x0000018162B00000-0x0000018162B2B000-memory.dmp

Download

memory/768-11-0x00007FFF8B960000-0x00007FFF8BB69000-memory.dmp

Download

memory/768-12-0x00007FFF8A1D0000-0x00007FFF8A28D000-memory.dmp

Download

memory/768-14-0x00007FFF8B960000-0x00007FFF8BB69000-memory.dmp

Download

memory/768-13-0x00007FFF8B961000-0x00007FFF8BA8A000-memory.dmp

Download

memory/768-361-0x00007FFF8B960000-0x00007FFF8BB69000-memory.dmp

Download

memory/1436-0-0x00007FFF6AB13000-0x00007FFF6AB15000-memory.dmp

Download

memory/1436-2-0x000002261BC40000-0x000002261BC6C000-memory.dmp

Download

memory/1436-1-0x000002261B800000-0x000002261B840000-memory.dmp

Download

memory/3264-63-0x0000000002D10000-0x0000000002D3B000-memory.dmp

Download

memory/3264-64-0x00007FFF4B9F0000-0x00007FFF4BA00000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads