5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521

Analysis

max time kernel
140s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/04/2026, 07:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521.exe
Size 1.8MB
Sample260422-jmc2daa14k
SHA256 5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521
MD5 bf040951df9e55adba4458b42a83e0c4
SHA1 14ab05ff51bea3becfa3f16a385f158c578fc041
SHA512 62b56e84b457f162eaa83a12dd0fa95f52acde188659928d6012fc2ff089670536e6b96ae0645eddd9367185554e1d9a50838aa3d9293aac146c00c57655c51e
SSDEEP 24576:2GtJQzN/AUKd/Yp5zOHr36daE/ol4uuJ5MeJ5MTs:5tGzNIUg/6FOLXW04uq5M65MY
TLSH
T1DF957C12F7E8E5F1C1A90A300EAB836E2738FD518B118BDBE284771D1E717C54E7AA45
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery spyware trojan vmprotect

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3132 created 636	3132	Explorer.EXE	5

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\PE5sNu0.sys	prevhost.exe
File opened for modification	C:\Windows\system32\drivers\vHQceVaMa29.sys	prevhost.exe
File opened for modification	C:\Windows\system32\drivers\mGeDauFFq8.dib	prevhost.exe

Executes dropped EXE 1 IoCs

pid	Process
1468	prevhost.exe

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	1	114.114.114.114	1468	prevhost.exe

VMProtect packed file 10 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/2076-0-0x00000000007E0000-0x00000000008E7000-memory.dmp	vmprotect
behavioral2/memory/2076-1-0x00000000007E0000-0x00000000008E7000-memory.dmp	vmprotect
behavioral2/memory/2076-7-0x00000000007E0000-0x00000000008E7000-memory.dmp	vmprotect
behavioral2/memory/3132-20-0x0000000007270000-0x0000000007505000-memory.dmp	vmprotect
behavioral2/memory/3132-22-0x0000000007270000-0x0000000007505000-memory.dmp	vmprotect
behavioral2/memory/3132-51-0x0000000007270000-0x0000000007505000-memory.dmp	vmprotect
behavioral2/memory/1468-84-0x00000218B4000000-0x00000218B4306000-memory.dmp	vmprotect
behavioral2/memory/1468-87-0x00000218B4000000-0x00000218B4306000-memory.dmp	vmprotect
behavioral2/memory/2076-104-0x00000000007E0000-0x00000000008E7000-memory.dmp	vmprotect
behavioral2/files/0x0007000000000679-131.dat	vmprotect

Drops file in System32 directory 14 IoCs

description	ioc	Process
File created	C:\Windows\system32\ \Windows\System32\z3qJ96C.sys	prevhost.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0CB9E7.cat	prevhost.exe
File opened for modification	C:\Windows\system32\qdSRcoJiQJgXG.eao	prevhost.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0CBA74.cat	prevhost.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0CBAA4.cat	prevhost.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0CBB01.cat	prevhost.exe
File created	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\uZRRWW.cat	prevhost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	prevhost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	prevhost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	prevhost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	prevhost.exe
File opened for modification	C:\Windows\system32\WJ1fI9BD6O.sys	prevhost.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0CBA17.cat	prevhost.exe
File opened for modification	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0CBA44.cat	prevhost.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\IvOHcnFVED.aiz	prevhost.exe
File opened for modification	C:\Program Files\WindowsApps\manifest.json	prevhost.exe
File opened for modification	C:\Program Files\WindowsApps\39665488.js	prevhost.exe
File opened for modification	C:\Program Files\WindowsApps\56197ecc.js	prevhost.exe
File opened for modification	C:\Program Files\WindowsApps\47bfe9aa.html	prevhost.exe
File opened for modification	C:\Program Files\WindowsApps\lib\647313ee.js	prevhost.exe
File opened for modification	C:\Program Files\Sx0SPjZDOzGf.sys	prevhost.exe
File opened for modification	C:\Program Files\ZOTxixBSN6afS.vgs	prevhost.exe
File opened for modification	C:\Program Files (x86)\HB6MlKPcu9lkl.sys	prevhost.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\3O5YAT3XsHWlmy.qpd	prevhost.exe
File created	C:\Windows\prevhost.exe	Explorer.EXE
File opened for modification	C:\Windows\prevhost.exe	Explorer.EXE
File created	C:\Windows\eRqY9kB1.sys	prevhost.exe
File opened for modification	C:\Windows\0EmFUtalU0GAtU.sys	prevhost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	prevhost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	prevhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	prevhost.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1760	timeout.exe

Modifies data under HKEY_USERS 16 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	prevhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	prevhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	prevhost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	prevhost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	prevhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	prevhost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	prevhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History	prevhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P	prevhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	prevhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	prevhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	prevhost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	prevhost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	prevhost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	prevhost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	prevhost.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA	5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\1F24C630CDA418EF2069FFAD4FDD5F463A1B69AA\Blob = 5c000000010000000400000080010000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003800000047006c006f00620061006c005300690067006e002000450043004300200052006f006f00740020004300410020002d002000520035000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308620000000100000020000000179fbc148a3dd00fd24ea13458cc43bfa7f59c8182d783a513f6ebec100c89241400000001000000140000003de629489bea07ca21444a26de6eded283d09f591d0000000100000010000000b647dd2a9ccadee75e8905e256cc6b147f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d7010300000001000000140000001f24c630cda418ef2069ffad4fdd5f463a1b69aa2000000001000000220200003082021e308201a4a0030201020211605949e0262ebb55f90a778a71f94ad86c300a06082a8648ce3d040303305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3132313131333030303030305a170d3338303131393033313430375a305031243022060355040b131b476c6f62616c5369676e2045434320526f6f74204341202d20523531133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e3076301006072a8648ce3d020106052b810400220362000447450e96fb7d5dbfe939d121f89f0bb6d57b1e923a48591cf062312dc07a28fe1aa75cb3b6cc97e745d458fad1776d43a2c08765340a1f7addeb3c33a1c59d4da46f4195387fc91e84ebd19e49928794870c3a854a669f9d59934d976106864aa3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604143de629489bea07ca21444a26de6eded283d09f59300a06082a8648ce3d0403030368003065023100e56912c96edbc631ba0941e197f8fbfd9ae27d12c9ed7c64d3cb05258b56d9a0e75e5d4e0b839c5b7629a00926216a62023071d2b58f5cea3be1780985a875923bc85cfd48ef0d7422a808e26ec549cec70cbca76169f1f73be12acbf92bf3669037	5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2076	5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521.exe
2076	5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521.exe
2076	5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521.exe
2076	5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521.exe
2076	5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521.exe
2076	5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521.exe
2076	5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521.exe
2076	5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521.exe
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe
1468	prevhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3132	Explorer.EXE

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2076	5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521.exe
Token: SeTcbPrivilege	2076	5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521.exe
Token: SeDebugPrivilege	2076	5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521.exe
Token: SeDebugPrivilege	3132	Explorer.EXE
Token: SeDebugPrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeDebugPrivilege	1468	prevhost.exe
Token: SeDebugPrivilege	1468	prevhost.exe
Token: SeDebugPrivilege	1468	prevhost.exe
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeDebugPrivilege	1468	prevhost.exe
Token: SeDebugPrivilege	3084	audiodg.exe
Token: SeDebugPrivilege	1468	prevhost.exe
Token: SeBackupPrivilege	1468	prevhost.exe
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 3132	2076	5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521.exe	53
PID 2076 wrote to memory of 3132	2076	5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521.exe	53
PID 2076 wrote to memory of 3132	2076	5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521.exe	53
PID 3132 wrote to memory of 1468	3132	Explorer.EXE	80
PID 3132 wrote to memory of 1468	3132	Explorer.EXE	80
PID 3132 wrote to memory of 1468	3132	Explorer.EXE	80
PID 3132 wrote to memory of 1468	3132	Explorer.EXE	80
PID 3132 wrote to memory of 4668	3132	Explorer.EXE
PID 3132 wrote to memory of 1172	3132	Explorer.EXE
PID 3132 wrote to memory of 2772	3132	Explorer.EXE
PID 1468 wrote to memory of 3084	1468	prevhost.exe	85
PID 1468 wrote to memory of 3084	1468	prevhost.exe	85
PID 1468 wrote to memory of 3084	1468	prevhost.exe	85
PID 2076 wrote to memory of 5024	2076	5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521.exe	86
PID 5024 wrote to memory of 1760	5024	cmd.exe	88
PID 1468 wrote to memory of 3132	1468	prevhost.exe	53
PID 1468 wrote to memory of 3132	1468	prevhost.exe	53
PID 1468 wrote to memory of 3132	1468	prevhost.exe	53
PID 1468 wrote to memory of 3132	1468	prevhost.exe	53
PID 1468 wrote to memory of 3132	1468	prevhost.exe	53
PID 1468 wrote to memory of 3132	1468	prevhost.exe	53
PID 1468 wrote to memory of 3132	1468	prevhost.exe	53
PID 1468 wrote to memory of 3132	1468	prevhost.exe	53
PID 1468 wrote to memory of 3132	1468	prevhost.exe	53
PID 1468 wrote to memory of 3132	1468	prevhost.exe	53
PID 1468 wrote to memory of 3132	1468	prevhost.exe	53
PID 1468 wrote to memory of 3132	1468	prevhost.exe	53
PID 1468 wrote to memory of 3132	1468	prevhost.exe	53
PID 1468 wrote to memory of 3132	1468	prevhost.exe	53
PID 1468 wrote to memory of 3132	1468	prevhost.exe	53
PID 1468 wrote to memory of 3132	1468	prevhost.exe	53
PID 1468 wrote to memory of 3132	1468	prevhost.exe	53
PID 1468 wrote to memory of 3132	1468	prevhost.exe	53
PID 1468 wrote to memory of 3132	1468	prevhost.exe	53
PID 1468 wrote to memory of 3132	1468	prevhost.exe	53
PID 1468 wrote to memory of 3132	1468	prevhost.exe	53
PID 1468 wrote to memory of 3132	1468	prevhost.exe	53
PID 1468 wrote to memory of 3132	1468	prevhost.exe	53
PID 1468 wrote to memory of 3132	1468	prevhost.exe	53
PID 1468 wrote to memory of 3132	1468	prevhost.exe	53
PID 1468 wrote to memory of 3132	1468	prevhost.exe	53
PID 1468 wrote to memory of 3132	1468	prevhost.exe	53
PID 1468 wrote to memory of 3132	1468	prevhost.exe	53
PID 1468 wrote to memory of 3132	1468	prevhost.exe	53
PID 1468 wrote to memory of 3132	1468	prevhost.exe	53
PID 1468 wrote to memory of 3132	1468	prevhost.exe	53
PID 1468 wrote to memory of 3132	1468	prevhost.exe	53
PID 3132 wrote to memory of 3868	3132	Explorer.EXE
PID 3132 wrote to memory of 4164	3132	Explorer.EXE
PID 3132 wrote to memory of 1124	3132	Explorer.EXE
PID 3132 wrote to memory of 3884	3132	Explorer.EXE
PID 3132 wrote to memory of 5048	3132	Explorer.EXE
PID 3132 wrote to memory of 1696	3132	Explorer.EXE
PID 3132 wrote to memory of 3404	3132	Explorer.EXE
PID 3132 wrote to memory of 4592	3132	Explorer.EXE
PID 3132 wrote to memory of 3844	3132	Explorer.EXE
PID 3132 wrote to memory of 3880	3132	Explorer.EXE
PID 3132 wrote to memory of 2204	3132	Explorer.EXE
PID 3132 wrote to memory of 2292	3132	Explorer.EXE
PID 3132 wrote to memory of 4388	3132	Explorer.EXE
PID 3132 wrote to memory of 4248	3132	Explorer.EXE
PID 3132 wrote to memory of 2320	3132	Explorer.EXE
PID 3132 wrote to memory of 3000	3132	Explorer.EXE

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:636
- C:\Windows\prevhost.exe
  "C:\Windows\prevhost.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Unexpected DNS network traffic destination
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Windows\system32\audiodg.exe
    "C:\Windows\system32\audiodg.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3084

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3132
- C:\Users\Admin\AppData\Local\Temp\5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521.exe
  "C:\Users\Admin\AppData\Local\Temp\5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\5303a95cb76d345dfbc88a50f3aea5cef6477abaccc24c323ed2b3a390b95521.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5024
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:1760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0EmFUtalU0GAtU.sys

Path C:\Windows\0EmFUtalU0GAtU.sys
Size 171KB
SHA256 7860ba948f5df7266d40724ac9dd430afe36b7462eb41a96871116b01141d3d3
MD5 696d4e10f25431a27ed9c92ff514e5e5
SHA1 116d9aa544743ccfddddd3af42c3f95e17980ed4
SHA512 be90281b054c4eb2d7c1a0cf15a86b34b03b54de3d17352ffd0bb776abf1dcbc0687ab9aa5b86b9af92aca98264d7982f9d84201ed21a4109ebdf63406029a18
SSDEEP 3072:a+IaIfIEHlbySWsjhWDodnRlzYVucprnuRbW6kR/eKPkW79imuWgDSgpLIgWy:7INg4bYsjKodR567prnQW6u/e2Zidl
TLSH
T1810412C290D891F3D50C54BCBA5351E882E8307BE921C369F9443FBDBC5519AED42ADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2B0CBA17.cat

Path C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0CBA17.cat
Size 5KB
SHA256 494280628758aaad9ca11c5843af59d3292d8680151ea8302fd9c1db612006b2
MD5 14abf2b885340e7205a4a6e5ce993c9a
SHA1 7d14cf5d84075cdf87315a60902bc910a0db8fbf
SHA512 ac802361b3b467944437688be21211f2c1946cab12d66467c74359a07b33d9a9fda54776d2a11fa799ab3e498c80a3354883e3386717a52e85e56401fd629d24
SSDEEP 96:dyDmIr5uPNC9L0WDIRIzwV0Di3s6TeDuHfw4pbTA/pvkrNXZCsnlTE+TVJoQrOG1:DIrXL0UIRIzw3jtlAur9ZCspE+TMQrO8
TLSH
T1B4B1C6D709082456EC865B91D5C6D66FED3467A52EC861A680B291992EC3BF07B0E80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prevhost.exe

Path C:\Windows\prevhost.exe
Size 48KB
SHA256 a08b54f33e989959cb4f7fe8d84466112d1dc3e1b865829f1e0928d7a6987b8d
MD5 221f2b2c75db5ba2d1e6d7ad49abf61e
SHA1 aab6bb692182e480e2355c757e0d1233e2ce713f
SHA512 536a4173618f5bc8f4f1e349a4ce8131b6aee7093ea49d9888831e1508696e31d9d71edf2d9d1cfe636c815fcae650f33c9c0288dda09bcc258be693bf830169
SSDEEP 768:fJ2ANw5etUp5IoXe6IjjszA8pCg8Ps1MTSiIOBPGsUNyUB4:R2AyEGpi78pCgesyB5UNyG4
TLSH
T108233A4D936824D8F13B563A89864205D5B0B4315722A3EF62A4C3FB2F237E97939F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1468-72-0x00000218B1C40000-0x00000218B1C41000-memory.dmp

Download

memory/1468-54-0x00000218B0310000-0x00000218B03B3000-memory.dmp

Download

memory/1468-87-0x00000218B4000000-0x00000218B4306000-memory.dmp

Download

memory/1468-84-0x00000218B4000000-0x00000218B4306000-memory.dmp

Download

memory/1468-83-0x00000218B3C30000-0x00000218B3E0B000-memory.dmp

Download

memory/1468-77-0x00000218B3C30000-0x00000218B3E0B000-memory.dmp

Download

memory/1468-38-0x00000218B1C60000-0x00000218B1EC7000-memory.dmp

Download

memory/1468-215-0x00000218B0310000-0x00000218B03B3000-memory.dmp

Download

memory/1468-214-0x00000218B0310000-0x00000218B03B3000-memory.dmp

Download

memory/1468-213-0x00000218B0310000-0x00000218B03B3000-memory.dmp

Download

memory/1468-37-0x00000218B1C60000-0x00000218B1EC7000-memory.dmp

Download

memory/1468-46-0x00007FFEF67A0000-0x00007FFEF67B0000-memory.dmp

Download

memory/1468-45-0x00000218B1C60000-0x00000218B1EC7000-memory.dmp

Download

memory/1468-47-0x00000218B01E0000-0x00000218B01E1000-memory.dmp

Download

memory/1468-76-0x00000218B3C30000-0x00000218B3E0B000-memory.dmp

Download

memory/1468-180-0x00000218B0310000-0x00000218B03B3000-memory.dmp

Download

memory/1468-33-0x00000218AFFE0000-0x00000218AFFE3000-memory.dmp

Download

memory/1468-34-0x00000218B1C60000-0x00000218B1EC7000-memory.dmp

Download

memory/1468-73-0x00000218B2860000-0x00000218B289F000-memory.dmp

Download

memory/1468-106-0x00000218B2860000-0x00000218B289F000-memory.dmp

Download

memory/1468-53-0x00000218B1C60000-0x00000218B1EC7000-memory.dmp

Download

memory/1468-90-0x00000218B0310000-0x00000218B03B3000-memory.dmp

Download

memory/1468-60-0x00007FFEF67A0000-0x00007FFEF67B0000-memory.dmp

Download

memory/1468-61-0x00000218B1BE0000-0x00000218B1BE1000-memory.dmp

Download

memory/1468-105-0x00000218B1C40000-0x00000218B1C41000-memory.dmp

Download

memory/1468-71-0x00000218B2310000-0x00000218B2351000-memory.dmp

Download

memory/1468-94-0x00000218B2310000-0x00000218B2351000-memory.dmp

Download

memory/1468-66-0x00000218B2310000-0x00000218B2311000-memory.dmp

Download

memory/1468-67-0x00000218B1BE0000-0x00000218B1BE1000-memory.dmp

Download

memory/1468-68-0x00000218B2320000-0x00000218B2321000-memory.dmp

Download

memory/1468-69-0x00000218B2310000-0x00000218B2311000-memory.dmp

Download

memory/1468-70-0x00000218B1C40000-0x00000218B1C41000-memory.dmp

Download

memory/2076-104-0x00000000007E0000-0x00000000008E7000-memory.dmp

Download

memory/2076-48-0x0000000003720000-0x0000000003721000-memory.dmp

Download

memory/2076-0-0x00000000007E0000-0x00000000008E7000-memory.dmp

Download

memory/2076-35-0x0000000003720000-0x0000000003721000-memory.dmp

Download

memory/2076-17-0x0000000003720000-0x0000000003721000-memory.dmp

Download

memory/2076-16-0x0000000003720000-0x0000000003721000-memory.dmp

Download

memory/2076-7-0x00000000007E0000-0x00000000008E7000-memory.dmp

Download

memory/2076-1-0x00000000007E0000-0x00000000008E7000-memory.dmp

Download

memory/3084-75-0x00000222C33A0000-0x00000222C33B6000-memory.dmp

Download

memory/3132-51-0x0000000007270000-0x0000000007505000-memory.dmp

Download

memory/3132-63-0x0000000002AC0000-0x0000000002AC1000-memory.dmp

Download

memory/3132-64-0x0000000002D80000-0x0000000002D81000-memory.dmp

Download

memory/3132-62-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Download

memory/3132-52-0x0000000002D80000-0x0000000002D81000-memory.dmp

Download

memory/3132-117-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Download

memory/3132-31-0x0000000002D80000-0x0000000002D81000-memory.dmp

Download

memory/3132-27-0x0000000002B90000-0x0000000002B93000-memory.dmp

Download

memory/3132-22-0x0000000007270000-0x0000000007505000-memory.dmp

Download

memory/3132-183-0x0000000002BD0000-0x0000000002BD1000-memory.dmp

Download

memory/3132-195-0x0000000002E40000-0x0000000002E41000-memory.dmp

Download

memory/3132-193-0x0000000002DF0000-0x0000000002DF1000-memory.dmp

Download

memory/3132-191-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Download

memory/3132-188-0x0000000002D90000-0x0000000002D91000-memory.dmp

Download

memory/3132-187-0x0000000002C10000-0x0000000002C11000-memory.dmp

Download

memory/3132-186-0x0000000002C00000-0x0000000002C01000-memory.dmp

Download

memory/3132-185-0x0000000002BF0000-0x0000000002BF1000-memory.dmp

Download

memory/3132-182-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

Download

memory/3132-196-0x0000000002EC0000-0x0000000002EC1000-memory.dmp

Download

memory/3132-194-0x0000000002E20000-0x0000000002E21000-memory.dmp

Download

memory/3132-192-0x0000000002DE0000-0x0000000002DE1000-memory.dmp

Download

memory/3132-190-0x0000000002DB0000-0x0000000002DB1000-memory.dmp

Download

memory/3132-189-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/3132-184-0x0000000002BE0000-0x0000000002BE1000-memory.dmp

Download

memory/3132-181-0x0000000002BA0000-0x0000000002BA1000-memory.dmp

Download

memory/3132-20-0x0000000007270000-0x0000000007505000-memory.dmp

Download

memory/3132-19-0x0000000002B90000-0x0000000002B93000-memory.dmp

Download

memory/3132-18-0x0000000002B90000-0x0000000002B93000-memory.dmp

Download