Analysis
- max time kernel
150s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/08/2026, 07:37
Behavioral task
behavioral1
Sample
15ff44174aeaa9ca2b95428d632f158f8b463b6f57b16e5cc4eb5406078cb224.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
15ff44174aeaa9ca2b95428d632f158f8b463b6f57b16e5cc4eb5406078cb224.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
20 signatures
150 seconds
General
- Target 15ff44174aeaa9ca2b95428d632f158f8b463b6f57b16e5cc4eb5406078cb224.exe
- Size 400KB
- Sample260826-jf9rrsvanf
- SHA256 15ff44174aeaa9ca2b95428d632f158f8b463b6f57b16e5cc4eb5406078cb224
- MD5 830e2f657fc68ae55dea2b41df124a91
- SHA1 dc45afa7d0fe769c3887d4f4925eb56a217b4094
- SHA512 dc2292005873cab5318c6bec805e1b7dcb097575d4d298f3a956f5697e67b04de4568b5887e4bb08c6150d72b08a8e01317ebcfd5bbaebc8c8a97c88e70b96b6
- SSDEEP 6144:Qyq4zKegGqQ6TG04cWIICC6wkd6ri34Srcqk+gH3bNqV2N1jSrft47T:eShg1Q6TG04cWMC6wQ4LR+gH3Yxrm3
- TLSH T162942343095925F4C8EB053D8B35F92DFFA81168D854A93BB7840BDDF92B0E318697A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 5720 created 752 5720 explorer.exe 5 - Drops file in Drivers directory 5 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\MdOKghkJGlTJKK.sys wsmprovhost.exe File opened for modification C:\Windows\system32\drivers\Vdc5q64oiyX4cy.kog wsmprovhost.exe File created C:\Windows\System32\drivers\FcNSR2a.sys wsmprovhost.exe File opened for modification C:\Windows\system32\drivers\64wjBJjnuSTR.sys wsmprovhost.exe File opened for modification C:\Windows\system32\drivers\mBFsBg3LzAbA.jmf wsmprovhost.exe - Executes dropped EXE 1 IoCs
pid Process 260 wsmprovhost.exe - Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 3 114.114.114.114 4772 15ff44174aeaa9ca2b95428d632f158f8b463b6f57b16e5cc4eb5406078cb224.exe -
resource yara_rule behavioral2/memory/4772-0-0x0000000000280000-0x0000000000380000-memory.dmp vmprotect behavioral2/memory/4772-3-0x0000000000280000-0x0000000000380000-memory.dmp vmprotect behavioral2/memory/5720-12-0x0000000005780000-0x0000000005A15000-memory.dmp vmprotect behavioral2/memory/5720-9-0x0000000005780000-0x0000000005A15000-memory.dmp vmprotect behavioral2/memory/4772-11-0x0000000000280000-0x0000000000380000-memory.dmp vmprotect behavioral2/memory/5720-14-0x0000000005780000-0x0000000005A15000-memory.dmp vmprotect behavioral2/memory/5720-35-0x0000000005780000-0x0000000005A15000-memory.dmp vmprotect behavioral2/memory/260-68-0x0000019AADD00000-0x0000019AADFFF000-memory.dmp vmprotect behavioral2/memory/260-71-0x0000019AADD00000-0x0000019AADFFF000-memory.dmp vmprotect behavioral2/memory/260-88-0x0000019AADD00000-0x0000019AADFFF000-memory.dmp vmprotect behavioral2/memory/4772-95-0x0000000000280000-0x0000000000380000-memory.dmp vmprotect behavioral2/files/0x000d00000001c4fd-112.dat vmprotect behavioral2/files/0x001100000001c518-208.dat vmprotect - Drops file in System32 directory 34 IoCs
description ioc Process File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0ED323.cat wsmprovhost.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0ED350.cat wsmprovhost.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0EFF15.cat wsmprovhost.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0EFFA2.cat wsmprovhost.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0F002F.cat wsmprovhost.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0F008C.cat wsmprovhost.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0F0203.cat wsmprovhost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 wsmprovhost.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0ED4F7.cat wsmprovhost.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0EFFCF.cat wsmprovhost.exe File opened for modification C:\Windows\system32\kx5KU6jYGk.kky wsmprovhost.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0EFEB8.cat wsmprovhost.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0EFFFF.cat wsmprovhost.exe File created C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Z04YjQ.cat wsmprovhost.exe File created C:\Windows\system32\ \Windows\System32\hkBgKcV.sys wsmprovhost.exe File opened for modification C:\Windows\system32\85R1y1JiDQ.sys wsmprovhost.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0ED3B0.cat wsmprovhost.exe File opened for modification C:\Windows\system32\P3ZFLxqzNI.sys wsmprovhost.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0ED46A.cat wsmprovhost.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0ED527.cat wsmprovhost.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0EFF42.cat wsmprovhost.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0EFEE5.cat wsmprovhost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 wsmprovhost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 wsmprovhost.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0ED40D.cat wsmprovhost.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0ED43D.cat wsmprovhost.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0ED49A.cat wsmprovhost.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0F005C.cat wsmprovhost.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0F0119.cat wsmprovhost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 wsmprovhost.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0ED380.cat wsmprovhost.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0ED4C7.cat wsmprovhost.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0EFE88.cat wsmprovhost.exe File opened for modification C:\Windows\system32\xMrgT5DG04P.awy wsmprovhost.exe - Drops file in Program Files directory 13 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\io75UQjz0E.sys wsmprovhost.exe File opened for modification C:\Program Files (x86)\D5l5ZY7cgav10.qkz wsmprovhost.exe File opened for modification C:\Program Files\BlFZWt27zRp9QY.trr wsmprovhost.exe File opened for modification C:\Program Files (x86)\r4Q5Boou23QvLG.sys wsmprovhost.exe File opened for modification C:\Program Files (x86)\ZLCx6Gj6aOWW9.tzq wsmprovhost.exe File opened for modification C:\Program Files\Windows Media Player\39692058.js wsmprovhost.exe File opened for modification C:\Program Files\Windows Media Player\47c3686e.html wsmprovhost.exe File opened for modification C:\Program Files\Windows Media Player\561db084.js wsmprovhost.exe File opened for modification C:\Program Files\Windows Media Player\lib\6477f89a.js wsmprovhost.exe File opened for modification C:\Program Files\n9xBrgzj07.nlv wsmprovhost.exe File opened for modification C:\Program Files\kExd9EKPu0KTX.sys wsmprovhost.exe File opened for modification C:\Program Files\Windows Media Player\manifest.json wsmprovhost.exe File opened for modification C:\Program Files\571fZxrOrUsb.sys wsmprovhost.exe - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\x7dreVqO4J.pve wsmprovhost.exe File opened for modification C:\Windows\X7uYag4f5A.sys wsmprovhost.exe File opened for modification C:\Windows\kc5QBrzkRsE1.iog wsmprovhost.exe File created C:\Windows\wsmprovhost.exe explorer.exe File created C:\Windows\swHzm5GX1.sys wsmprovhost.exe File opened for modification C:\Windows\zRqwKmtW33r4.sys wsmprovhost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4276 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15ff44174aeaa9ca2b95428d632f158f8b463b6f57b16e5cc4eb5406078cb224.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 wsmprovhost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName wsmprovhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 wsmprovhost.exe - Delays execution with timeout.exe 1 IoCs
pid Process 4136 timeout.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix wsmprovhost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" wsmprovhost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" wsmprovhost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ wsmprovhost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" wsmprovhost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" wsmprovhost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" wsmprovhost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" wsmprovhost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing wsmprovhost.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\NotificationData explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002 explorer.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4772 15ff44174aeaa9ca2b95428d632f158f8b463b6f57b16e5cc4eb5406078cb224.exe 4772 15ff44174aeaa9ca2b95428d632f158f8b463b6f57b16e5cc4eb5406078cb224.exe 4772 15ff44174aeaa9ca2b95428d632f158f8b463b6f57b16e5cc4eb5406078cb224.exe 4772 15ff44174aeaa9ca2b95428d632f158f8b463b6f57b16e5cc4eb5406078cb224.exe 4772 15ff44174aeaa9ca2b95428d632f158f8b463b6f57b16e5cc4eb5406078cb224.exe 4772 15ff44174aeaa9ca2b95428d632f158f8b463b6f57b16e5cc4eb5406078cb224.exe 4772 15ff44174aeaa9ca2b95428d632f158f8b463b6f57b16e5cc4eb5406078cb224.exe 4772 15ff44174aeaa9ca2b95428d632f158f8b463b6f57b16e5cc4eb5406078cb224.exe 4772 15ff44174aeaa9ca2b95428d632f158f8b463b6f57b16e5cc4eb5406078cb224.exe 4772 15ff44174aeaa9ca2b95428d632f158f8b463b6f57b16e5cc4eb5406078cb224.exe 4772 15ff44174aeaa9ca2b95428d632f158f8b463b6f57b16e5cc4eb5406078cb224.exe 4772 15ff44174aeaa9ca2b95428d632f158f8b463b6f57b16e5cc4eb5406078cb224.exe 4772 15ff44174aeaa9ca2b95428d632f158f8b463b6f57b16e5cc4eb5406078cb224.exe 4772 15ff44174aeaa9ca2b95428d632f158f8b463b6f57b16e5cc4eb5406078cb224.exe 4772 15ff44174aeaa9ca2b95428d632f158f8b463b6f57b16e5cc4eb5406078cb224.exe 4772 15ff44174aeaa9ca2b95428d632f158f8b463b6f57b16e5cc4eb5406078cb224.exe 5720 explorer.exe 5720 explorer.exe 5720 explorer.exe 5720 explorer.exe 260 wsmprovhost.exe 260 wsmprovhost.exe 260 wsmprovhost.exe 260 wsmprovhost.exe 260 wsmprovhost.exe 260 wsmprovhost.exe 260 wsmprovhost.exe 260 wsmprovhost.exe 260 wsmprovhost.exe 260 wsmprovhost.exe 260 wsmprovhost.exe 260 wsmprovhost.exe 260 wsmprovhost.exe 260 wsmprovhost.exe 260 wsmprovhost.exe 260 wsmprovhost.exe 260 wsmprovhost.exe 260 wsmprovhost.exe 260 wsmprovhost.exe 260 wsmprovhost.exe 260 wsmprovhost.exe 260 wsmprovhost.exe 260 wsmprovhost.exe 260 wsmprovhost.exe 260 wsmprovhost.exe 260 wsmprovhost.exe 260 wsmprovhost.exe 260 wsmprovhost.exe 260 wsmprovhost.exe 260 wsmprovhost.exe 260 wsmprovhost.exe 260 wsmprovhost.exe 260 wsmprovhost.exe 260 wsmprovhost.exe 260 wsmprovhost.exe 260 wsmprovhost.exe 260 wsmprovhost.exe 260 wsmprovhost.exe 260 wsmprovhost.exe 260 wsmprovhost.exe 260 wsmprovhost.exe 260 wsmprovhost.exe 260 wsmprovhost.exe 260 wsmprovhost.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5720 explorer.exe - Suspicious behavior: LoadsDriver 35 IoCs
pid Process 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4772 15ff44174aeaa9ca2b95428d632f158f8b463b6f57b16e5cc4eb5406078cb224.exe Token: SeTcbPrivilege 4772 15ff44174aeaa9ca2b95428d632f158f8b463b6f57b16e5cc4eb5406078cb224.exe Token: SeDebugPrivilege 4772 15ff44174aeaa9ca2b95428d632f158f8b463b6f57b16e5cc4eb5406078cb224.exe Token: SeDebugPrivilege 5720 explorer.exe Token: SeDebugPrivilege 5720 explorer.exe Token: SeShutdownPrivilege 5720 explorer.exe Token: SeCreatePagefilePrivilege 5720 explorer.exe Token: SeDebugPrivilege 260 wsmprovhost.exe Token: SeDebugPrivilege 260 wsmprovhost.exe Token: SeDebugPrivilege 260 wsmprovhost.exe Token: SeShutdownPrivilege 5720 explorer.exe Token: SeCreatePagefilePrivilege 5720 explorer.exe Token: SeShutdownPrivilege 5720 explorer.exe Token: SeCreatePagefilePrivilege 5720 explorer.exe Token: SeShutdownPrivilege 5720 explorer.exe Token: SeCreatePagefilePrivilege 5720 explorer.exe Token: SeShutdownPrivilege 5720 explorer.exe Token: SeCreatePagefilePrivilege 5720 explorer.exe Token: SeShutdownPrivilege 5720 explorer.exe Token: SeCreatePagefilePrivilege 5720 explorer.exe Token: SeShutdownPrivilege 5720 explorer.exe Token: SeCreatePagefilePrivilege 5720 explorer.exe Token: SeShutdownPrivilege 5720 explorer.exe Token: SeCreatePagefilePrivilege 5720 explorer.exe Token: SeShutdownPrivilege 5720 explorer.exe Token: SeCreatePagefilePrivilege 5720 explorer.exe Token: SeShutdownPrivilege 5720 explorer.exe Token: SeCreatePagefilePrivilege 5720 explorer.exe Token: SeShutdownPrivilege 5720 explorer.exe Token: SeCreatePagefilePrivilege 5720 explorer.exe Token: SeShutdownPrivilege 5720 explorer.exe Token: SeCreatePagefilePrivilege 5720 explorer.exe Token: SeDebugPrivilege 260 wsmprovhost.exe Token: SeBackupPrivilege 260 wsmprovhost.exe Token: SeDebugPrivilege 260 wsmprovhost.exe Token: SeDebugPrivilege 4816 waitfor.exe Token: SeShutdownPrivilege 5720 explorer.exe Token: SeCreatePagefilePrivilege 5720 explorer.exe Token: SeShutdownPrivilege 5720 explorer.exe Token: SeCreatePagefilePrivilege 5720 explorer.exe Token: SeShutdownPrivilege 5720 explorer.exe Token: SeCreatePagefilePrivilege 5720 explorer.exe Token: SeShutdownPrivilege 5720 explorer.exe Token: SeCreatePagefilePrivilege 5720 explorer.exe Token: SeShutdownPrivilege 5720 explorer.exe Token: SeCreatePagefilePrivilege 5720 explorer.exe Token: SeShutdownPrivilege 5720 explorer.exe Token: SeCreatePagefilePrivilege 5720 explorer.exe Token: SeShutdownPrivilege 5720 explorer.exe Token: SeCreatePagefilePrivilege 5720 explorer.exe Token: SeShutdownPrivilege 5720 explorer.exe Token: SeCreatePagefilePrivilege 5720 explorer.exe Token: SeShutdownPrivilege 5720 explorer.exe Token: SeCreatePagefilePrivilege 5720 explorer.exe Token: SeShutdownPrivilege 5720 explorer.exe Token: SeCreatePagefilePrivilege 5720 explorer.exe Token: SeShutdownPrivilege 5720 explorer.exe Token: SeCreatePagefilePrivilege 5720 explorer.exe Token: SeShutdownPrivilege 5720 explorer.exe Token: SeCreatePagefilePrivilege 5720 explorer.exe Token: SeShutdownPrivilege 5720 explorer.exe Token: SeCreatePagefilePrivilege 5720 explorer.exe Token: SeIncBasePriorityPrivilege 4772 15ff44174aeaa9ca2b95428d632f158f8b463b6f57b16e5cc4eb5406078cb224.exe Token: SeShutdownPrivilege 5720 explorer.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4772 wrote to memory of 5720 4772 15ff44174aeaa9ca2b95428d632f158f8b463b6f57b16e5cc4eb5406078cb224.exe 81 PID 4772 wrote to memory of 5720 4772 15ff44174aeaa9ca2b95428d632f158f8b463b6f57b16e5cc4eb5406078cb224.exe 81 PID 4772 wrote to memory of 5720 4772 15ff44174aeaa9ca2b95428d632f158f8b463b6f57b16e5cc4eb5406078cb224.exe 81 PID 5720 wrote to memory of 260 5720 explorer.exe 89 PID 5720 wrote to memory of 260 5720 explorer.exe 89 PID 5720 wrote to memory of 260 5720 explorer.exe 89 PID 5720 wrote to memory of 260 5720 explorer.exe 89 PID 5720 wrote to memory of 1380 5720 explorer.exe PID 5720 wrote to memory of 5896 5720 explorer.exe PID 5720 wrote to memory of 5968 5720 explorer.exe PID 260 wrote to memory of 4816 260 wsmprovhost.exe 94 PID 260 wrote to memory of 4816 260 wsmprovhost.exe 94 PID 260 wrote to memory of 4816 260 wsmprovhost.exe 94 PID 4772 wrote to memory of 4276 4772 15ff44174aeaa9ca2b95428d632f158f8b463b6f57b16e5cc4eb5406078cb224.exe 97 PID 4276 wrote to memory of 4136 4276 cmd.exe 99 PID 260 wrote to memory of 5720 260 wsmprovhost.exe 81 PID 260 wrote to memory of 5720 260 wsmprovhost.exe 81 PID 260 wrote to memory of 5720 260 wsmprovhost.exe 81 PID 260 wrote to memory of 5720 260 wsmprovhost.exe 81 PID 260 wrote to memory of 5720 260 wsmprovhost.exe 81 PID 260 wrote to memory of 5720 260 wsmprovhost.exe 81 PID 260 wrote to memory of 5720 260 wsmprovhost.exe 81 PID 260 wrote to memory of 5720 260 wsmprovhost.exe 81 PID 260 wrote to memory of 5720 260 wsmprovhost.exe 81 PID 260 wrote to memory of 5720 260 wsmprovhost.exe 81 PID 260 wrote to memory of 5720 260 wsmprovhost.exe 81 PID 260 wrote to memory of 5720 260 wsmprovhost.exe 81 PID 260 wrote to memory of 5720 260 wsmprovhost.exe 81 PID 260 wrote to memory of 5720 260 wsmprovhost.exe 81 PID 260 wrote to memory of 5720 260 wsmprovhost.exe 81 PID 260 wrote to memory of 5720 260 wsmprovhost.exe 81 PID 260 wrote to memory of 5720 260 wsmprovhost.exe 81 PID 260 wrote to memory of 5720 260 wsmprovhost.exe 81 PID 260 wrote to memory of 5720 260 wsmprovhost.exe 81 PID 260 wrote to memory of 5720 260 wsmprovhost.exe 81 PID 260 wrote to memory of 5720 260 wsmprovhost.exe 81 PID 260 wrote to memory of 5720 260 wsmprovhost.exe 81 PID 260 wrote to memory of 5720 260 wsmprovhost.exe 81 PID 260 wrote to memory of 5720 260 wsmprovhost.exe 81 PID 260 wrote to memory of 5720 260 wsmprovhost.exe 81 PID 260 wrote to memory of 5720 260 wsmprovhost.exe 81 PID 260 wrote to memory of 5720 260 wsmprovhost.exe 81 PID 260 wrote to memory of 5720 260 wsmprovhost.exe 81 PID 260 wrote to memory of 5720 260 wsmprovhost.exe 81 PID 260 wrote to memory of 5720 260 wsmprovhost.exe 81 PID 260 wrote to memory of 5720 260 wsmprovhost.exe 81 PID 260 wrote to memory of 5720 260 wsmprovhost.exe 81 PID 5720 wrote to memory of 5104 5720 explorer.exe PID 5720 wrote to memory of 5932 5720 explorer.exe PID 5720 wrote to memory of 4476 5720 explorer.exe PID 5720 wrote to memory of 6136 5720 explorer.exe PID 5720 wrote to memory of 6132 5720 explorer.exe PID 5720 wrote to memory of 1552 5720 explorer.exe PID 5720 wrote to memory of 5164 5720 explorer.exe PID 5720 wrote to memory of 1104 5720 explorer.exe PID 5720 wrote to memory of 4960 5720 explorer.exe PID 5720 wrote to memory of 3320 5720 explorer.exe PID 5720 wrote to memory of 3152 5720 explorer.exe PID 5720 wrote to memory of 1348 5720 explorer.exe PID 5720 wrote to memory of 4464 5720 explorer.exe PID 5720 wrote to memory of 5228 5720 explorer.exe PID 5720 wrote to memory of 5240 5720 explorer.exe PID 5720 wrote to memory of 900 5720 explorer.exe PID 260 wrote to memory of 5720 260 wsmprovhost.exe 81
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:752
-
C:\Windows\wsmprovhost.exe"C:\Windows\wsmprovhost.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Windows\system32\waitfor.exe"C:\Windows\system32\waitfor.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4816
-
-
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5720 -
C:\Users\Admin\AppData\Local\Temp\15ff44174aeaa9ca2b95428d632f158f8b463b6f57b16e5cc4eb5406078cb224.exe"C:\Users\Admin\AppData\Local\Temp\15ff44174aeaa9ca2b95428d632f158f8b463b6f57b16e5cc4eb5406078cb224.exe"2⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\15ff44174aeaa9ca2b95428d632f158f8b463b6f57b16e5cc4eb5406078cb224.exe"3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Windows\SysWOW64\timeout.exetimeout /t 14⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4136
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0ED3B0.cat
- Size 5KB
- SHA256 591f18bca3cb1b0791a73d30fd841c4523e62e54a542573220713dd9c1386976
- MD5 9507c3907c2086065dc74df6b544d06f
- SHA1 97ff6eee59e537746d97d6953e676a073e138c68
- SHA512 13d3f9ea226c330bc5fbfff63877e6f8cde9dc66f1f50efa5d7d3099b498958b51e507671156dadad253d6fbfa12407e9594b8d9106230cba0049fdea8bce3d7
- SSDEEP 96:bK6mIr5uPNC9L0WDIRIzwV0Di3s6TeDuHfw4pbTA/pvkrNXZCsnlTE+TVJoQrOjn:boIrXL0UIRIzw3jtlAur9ZCspE+TMQrA
- TLSH T16EB1E5E709082856EC865F91D1C6D22F8D74779A2EC864E65472D2952FC3BF0BB0D80F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\2B0EFF15.cat
- Size 5KB
- SHA256 dfe50d201bd7d2a2bd87501ed274a76ea68c99771c2a0c5b903bfa9c3cb112c2
- MD5 5c6c2b72810e384ea0db5d2e5cc13fa0
- SHA1 bc06e8965d7ab066d6ee2bf247f1fd3e8cdb7caf
- SHA512 f074406f6fbe40f0bfa19dcfc46fee5f1678d72c20f8b2ffa5aeb27b45fad73fea800efeb5284947663bd5ddef667051b259389ad0e8ee2d2fa15cea891293b3
- SSDEEP 96:twWmIr5uPNC9L0WDIRIzwV0Di3s6TeDuHfw4pbTA/pvkrNXZCsnlTE+TVJoQrO/3:iIrXL0UIRIzw3jtlAur9ZCspE+TMQrOP
- TLSH T1D6B1E7DB09082456ED865F91D5C2D23FDE3067D62EC8A592947292992FC3BF07B0D40F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\X7uYag4f5A.sys
- Size 174KB
- SHA256 e72c8879e2091b2dc83c6007374da4ffea0364adb3edce148bcd61a9064a44af
- MD5 64f4e1a732762d1327c0a076c338d874
- SHA1 464d8a83806210bce66ef459dc62e9d0b999230f
- SHA512 d830a2229a259f897c4349291417109e2c649b707d14c7228e6291bcf3709f5937b03e35ac17eb9b725879347bafa5f7767d925eda585ef63f9db315e393547c
- SSDEEP 3072:Gc4r7Z2+DVgCW4sM+oDUCfa+M1NL/8rD7DeeZJgiXga/r+3zGk2Fu8uTNdTU6PJH:Gc4vxx7iCSvNL0n7D1ZyiXgwaDx2Fu8q
- TLSH T1240412F724EC40E3C0429974BA2564E794F0542FEE15A686B6C536733CCA1EF5E8F9A0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\wsmprovhost.exe
- Size 68KB
- SHA256 4a2388d16e02925956dff1e92b2b146c89e267b85637069eb1f18b2fa5af3049
- MD5 cf847821027b21c569e1251c7b8730f0
- SHA1 49b171c632b4e1fb16a25ff374ddf8399e4d797b
- SHA512 500ff04283d1d5f24c40696fb06e9699f509d3d5805b2134fe38cae11cd8589b95197e1de1d8c73affe7b9e409aa92745c6020c40cc99586193092ffd6d99a76
- SSDEEP 768:nPgcKu68eiCx3n1KeEFWl0BMBQSn2qdiA8d:nPgnA6XPE0+ZSVdiBd
- TLSH T1C3631B989B694CD7C9A5D37C84710525A271F47C8303E2EB415CD42F7F9BAE50B3ADA0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\zRqwKmtW33r4.sys
- Size 192KB
- SHA256 7daeb0a4ec30e0860e771a71d7d554ddc51b47da04b73b370b47dd426bbe437f
- MD5 69ac5d40b23ed52bc64b559383e4f8a3
- SHA1 74081cb19d8889bf5e33562bb2a26e4ed048c24a
- SHA512 dab47a160edac1e127035ec971a7ccfb16766ee9a96618ecd00ad74e4182c3df56680067bb5cc258c20ef9eaa80794fa7d1f58f480a9c5c4165eeed988f8c35f
- SSDEEP 6144:9eiKU+0gkAHL/HnSk5iEBmhtpRKJGUoF1OvN7lnOuz9C:BKU+0gkw/HSkdstz4GFF1O17lOk9
- TLSH T1EB1412CFA2E462EFD01A00F983D7A4E566B6B4A7C7D0D5917CC832346E469D34D1B9B0
- MD5 SHA1 SHA512 SSDEEP TLSH