Analysis
- max time kernel
122s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/10/2026, 03:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
33 signatures
150 seconds
General
- Target f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe
- Size 2.9MB
- Sample261017-eellbs119p
- SHA256 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3
- MD5 b8819af1409521ae286b49616d583213
- SHA1 893b78d62e52cdaac1d1e5473afd541f2256bfe1
- SHA512 ec62ce6f5faa0790c909b75a2d1172cb625489440c43b9a33281ed37c295e06ff8d0dd480abacc93ceb80e479b765b90c08a756d3cb687d11fb78eca0d9ebfb2
- SSDEEP 49152:qCwsbCAN8KXferL7Vwe/Gg0P+WhGFNhAnlh9:9ws2AN8KXOaeOgmhOhslh9
- TLSH T12AE56B12A99588A2D38916B0DF73DAB3A728BD7D1BF3453DBA9DFCC537382403A16114
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
-
http://www.klkjwre9fqwieluoi.info/
-
http://kukutrustnet777888.info/
Signatures
-
resource yara_rule behavioral1/memory/4212-37-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/4212-36-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/5000-66-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/5000-80-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/5000-79-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2192-50-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2192-49-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit - Gh0st RAT payload 8 IoCs
resource yara_rule behavioral1/memory/4212-37-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/4212-36-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/files/0x00070000000245a4-28.dat family_gh0strat behavioral1/memory/5000-66-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/5000-80-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/5000-79-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2192-50-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2192-49-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat - Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe - UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe - Windows security bypass 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe - Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys TXPlatfor.exe - Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Remote Data\Parameters\ServiceDll = "C:\\Windows\\system32\\240713781.txt" R.exe - Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatfor.exe - Executes dropped EXE 5 IoCs
pid Process 4616 R.exe 4212 N.exe 2192 TXPlatfor.exe 5000 TXPlatfor.exe 2268 Remote Data.exe - Loads dropped DLL 3 IoCs
pid Process 4616 R.exe 4408 svchost.exe 2268 Remote Data.exe - Windows security modification 2 TTPs 7 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe File opened (read-only) \??\K: f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe File opened (read-only) \??\Q: f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe File opened (read-only) \??\T: f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe File opened (read-only) \??\U: f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe File opened (read-only) \??\G: f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe File opened (read-only) \??\H: f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe File opened (read-only) \??\M: f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe File opened (read-only) \??\O: f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe File opened (read-only) \??\V: f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe File opened (read-only) \??\X: f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe File opened (read-only) \??\Z: f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe File opened (read-only) \??\I: f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe File opened (read-only) \??\L: f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe File opened (read-only) \??\P: f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe File opened (read-only) \??\R: f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe File opened (read-only) \??\S: f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe File opened (read-only) \??\W: f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe File opened (read-only) \??\Y: f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe File opened (read-only) \??\J: f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe File opened (read-only) \??\N: f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification F:\autorun.inf f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe File opened for modification C:\autorun.inf f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe - Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ini.ini R.exe File created C:\Windows\SysWOW64\Remote Data.exe svchost.exe File opened for modification C:\Windows\SysWOW64\Remote Data.exe svchost.exe File created C:\Windows\SysWOW64\TXPlatfor.exe N.exe File opened for modification C:\Windows\SysWOW64\TXPlatfor.exe N.exe File created C:\Windows\SysWOW64\240713781.txt R.exe -
resource yara_rule behavioral1/memory/888-3-0x0000000002510000-0x000000000359E000-memory.dmp upx behavioral1/memory/888-4-0x0000000002510000-0x000000000359E000-memory.dmp upx behavioral1/memory/888-5-0x0000000002510000-0x000000000359E000-memory.dmp upx behavioral1/memory/4212-37-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/4212-36-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/4212-34-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/888-14-0x0000000002510000-0x000000000359E000-memory.dmp upx behavioral1/memory/888-10-0x0000000002510000-0x000000000359E000-memory.dmp upx behavioral1/memory/888-9-0x0000000002510000-0x000000000359E000-memory.dmp upx behavioral1/memory/888-7-0x0000000002510000-0x000000000359E000-memory.dmp upx behavioral1/memory/888-6-0x0000000002510000-0x000000000359E000-memory.dmp upx behavioral1/memory/888-8-0x0000000002510000-0x000000000359E000-memory.dmp upx behavioral1/memory/888-1-0x0000000002510000-0x000000000359E000-memory.dmp upx behavioral1/memory/5000-66-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/5000-80-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/5000-79-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2192-50-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2192-47-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/888-43-0x0000000002510000-0x000000000359E000-memory.dmp upx behavioral1/memory/888-44-0x0000000002510000-0x000000000359E000-memory.dmp upx behavioral1/memory/2192-49-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/888-81-0x0000000002510000-0x000000000359E000-memory.dmp upx behavioral1/memory/888-86-0x0000000002510000-0x000000000359E000-memory.dmp upx behavioral1/memory/888-87-0x0000000002510000-0x000000000359E000-memory.dmp upx behavioral1/memory/888-89-0x0000000002510000-0x000000000359E000-memory.dmp upx behavioral1/memory/888-90-0x0000000002510000-0x000000000359E000-memory.dmp upx behavioral1/memory/888-91-0x0000000002510000-0x000000000359E000-memory.dmp upx behavioral1/memory/888-92-0x0000000002510000-0x000000000359E000-memory.dmp upx behavioral1/memory/888-95-0x0000000002510000-0x000000000359E000-memory.dmp upx behavioral1/memory/888-97-0x0000000002510000-0x000000000359E000-memory.dmp upx behavioral1/memory/888-99-0x0000000002510000-0x000000000359E000-memory.dmp upx behavioral1/memory/888-101-0x0000000002510000-0x000000000359E000-memory.dmp upx behavioral1/memory/888-106-0x0000000002510000-0x000000000359E000-memory.dmp upx behavioral1/memory/888-109-0x0000000002510000-0x000000000359E000-memory.dmp upx behavioral1/memory/888-108-0x0000000002510000-0x000000000359E000-memory.dmp upx behavioral1/memory/888-111-0x0000000002510000-0x000000000359E000-memory.dmp upx behavioral1/memory/888-110-0x0000000002510000-0x000000000359E000-memory.dmp upx behavioral1/memory/888-121-0x0000000002510000-0x000000000359E000-memory.dmp upx behavioral1/memory/888-123-0x0000000002510000-0x000000000359E000-memory.dmp upx behavioral1/memory/888-125-0x0000000002510000-0x000000000359E000-memory.dmp upx behavioral1/memory/888-127-0x0000000002510000-0x000000000359E000-memory.dmp upx behavioral1/memory/888-128-0x0000000002510000-0x000000000359E000-memory.dmp upx behavioral1/memory/888-129-0x0000000002510000-0x000000000359E000-memory.dmp upx behavioral1/memory/888-133-0x0000000002510000-0x000000000359E000-memory.dmp upx behavioral1/memory/888-132-0x0000000002510000-0x000000000359E000-memory.dmp upx behavioral1/memory/888-136-0x0000000002510000-0x000000000359E000-memory.dmp upx behavioral1/memory/888-139-0x0000000002510000-0x000000000359E000-memory.dmp upx behavioral1/memory/888-140-0x0000000002510000-0x000000000359E000-memory.dmp upx behavioral1/memory/888-142-0x0000000002510000-0x000000000359E000-memory.dmp upx behavioral1/memory/888-155-0x0000000002510000-0x000000000359E000-memory.dmp upx - Drops file in Program Files directory 12 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5092 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Remote Data.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname TXPlatfor.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain TXPlatfor.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Remote Data.exe - System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language R.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TXPlatfor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Remote Data.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4472 PING.EXE 5092 cmd.exe - Runs ping.exe 1 TTPs 1 IoCs
pid Process 4472 PING.EXE - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 5000 TXPlatfor.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe Token: SeDebugPrivilege 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 888 wrote to memory of 788 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 9 PID 888 wrote to memory of 796 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 10 PID 888 wrote to memory of 448 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 14 PID 888 wrote to memory of 3004 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 50 PID 888 wrote to memory of 3040 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 51 PID 888 wrote to memory of 680 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 53 PID 888 wrote to memory of 3296 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 56 PID 888 wrote to memory of 3408 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 57 PID 888 wrote to memory of 3608 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 58 PID 888 wrote to memory of 3704 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 59 PID 888 wrote to memory of 4616 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 86 PID 888 wrote to memory of 3808 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 60 PID 888 wrote to memory of 3892 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 61 PID 888 wrote to memory of 3424 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 62 PID 888 wrote to memory of 4692 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 65 PID 888 wrote to memory of 4948 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 77 PID 888 wrote to memory of 2556 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 84 PID 888 wrote to memory of 4212 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 89 PID 888 wrote to memory of 788 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 9 PID 888 wrote to memory of 796 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 10 PID 888 wrote to memory of 448 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 14 PID 888 wrote to memory of 3004 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 50 PID 888 wrote to memory of 3040 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 51 PID 888 wrote to memory of 680 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 53 PID 888 wrote to memory of 3296 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 56 PID 888 wrote to memory of 3408 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 57 PID 888 wrote to memory of 3608 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 58 PID 888 wrote to memory of 3704 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 59 PID 888 wrote to memory of 3808 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 60 PID 888 wrote to memory of 3892 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 61 PID 888 wrote to memory of 3424 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 62 PID 888 wrote to memory of 4692 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 65 PID 888 wrote to memory of 4948 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 77 PID 888 wrote to memory of 2556 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 84 PID 888 wrote to memory of 4212 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 89 PID 888 wrote to memory of 4212 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 89 PID 4212 wrote to memory of 5092 4212 N.exe 92 PID 2192 wrote to memory of 5000 2192 TXPlatfor.exe 93 PID 4408 wrote to memory of 2268 4408 svchost.exe 96 PID 5092 wrote to memory of 4472 5092 cmd.exe 98 PID 888 wrote to memory of 788 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 9 PID 888 wrote to memory of 796 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 10 PID 888 wrote to memory of 448 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 14 PID 888 wrote to memory of 3004 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 50 PID 888 wrote to memory of 3040 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 51 PID 888 wrote to memory of 680 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 53 PID 888 wrote to memory of 3296 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 56 PID 888 wrote to memory of 3408 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 57 PID 888 wrote to memory of 3608 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 58 PID 888 wrote to memory of 3704 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 59 PID 888 wrote to memory of 3808 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 60 PID 888 wrote to memory of 3892 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 61 PID 888 wrote to memory of 3424 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 62 PID 888 wrote to memory of 4692 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 65 PID 888 wrote to memory of 4948 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 77 PID 888 wrote to memory of 2556 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 84 PID 888 wrote to memory of 4528 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 102 PID 888 wrote to memory of 3512 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 103 PID 888 wrote to memory of 788 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 9 PID 888 wrote to memory of 796 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 10 PID 888 wrote to memory of 448 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 14 PID 888 wrote to memory of 3004 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 50 PID 888 wrote to memory of 3040 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 51 PID 888 wrote to memory of 680 888 f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe 53 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:796
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:448
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:3004
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:3040
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:680
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe"C:\Users\Admin\AppData\Local\Temp\f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:888 -
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe3⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4616
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.15⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4472
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3408
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3608
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3704
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3808
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3892
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3424
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4692
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4948
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:2556
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remote Data"1⤵PID:4612
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remote Data"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Windows\SysWOW64\Remote Data.exe"C:\Windows\system32\Remote Data.exe" "c:\windows\system32\240713781.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:2268
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: LoadsDriver
PID:5000
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k "Remote Data"1⤵PID:4824
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4528
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3512
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Server Software Component
1Terminal Services DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
- Size 6.8MB
- SHA256 c1065bbffa5b07b71f2b9f90b6738c69103ded15f7df6b6ef6aa534380c771dc
- MD5 6baac3478c5ff27578bb71a5296e60b7
- SHA1 98b4dbc35c909da031d73e511d3370667a26bb07
- SHA512 8d3a7035ff95fad250291e68b7be0ba18e3b096c265bc7784e385a1dbb5a1543399a6d9548aebddcd2b66ca697865bf0d2120809a2cdbf38fea8e8e3f352c48e
- SSDEEP 49152:ICwsbCANFKXferL7Vwe/Gg0P+WhGFNhMKE4udQuVyBvNszCnSgVdQM3/+TjER7zp:Dws2ANFKXOaeOgmhOhzijnUdYd+RaAj
- TLSH T11B767B03B2958495D2898170CF66D673AB617CAD07F251FF3698BED63B36AC03B39610
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\0E5935BC_Rar\f4df98a6d7678e91569f32389a39f7645d8a498769e165e61eb2fce4462392e3.exe
- Size 2.8MB
- SHA256 0883b402522d0262988d0634a165dfe719b6dd72485c60602c6c31821a1cd05e
- MD5 f925067a2b9e171fa9848f1182f6182a
- SHA1 480a294f9eb7a2e16963d35e632fe2f8e519247a
- SHA512 e487ac0a9ff7a9d784929a20afaabe5c7fca575c84595d02019029b46164b02eda6c76e9be493cb47872876d54978dbd8cbe424f7055808cd9d967481c9bc61e
- SSDEEP 24576:KCwsbKgbQ5NANIvGTYwMHXA+wT1kfTw4SIuvB74fgt7ibhRM5QhKehFdMtRj7nHd:KCwsbCANnKXferL7Vwe/Gg0P+WhGFNhv
- TLSH T103D56A12A99588A2D38916B0DF73DAB3A728BD7D1BF3453DBA9DFCC537382403A16114
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\R.exe
- Size 941KB
- SHA256 bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c
- MD5 8dc3adf1c490211971c1e2325f1424d2
- SHA1 4eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5
- SHA512 ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d
- SSDEEP 24576:N+wT1kfTw4SIuvB74fgt7ibhRM5QhKehFdMtRj7nH1PXw:cerL7Vw
- TLSH T105257D43E6765C93C3CC4836CC7AD27273217A5CB3F79636B180AAD7B6B52603D2065A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\dyar.exe
- Size 69KB
- SHA256 4d58bc8c0d962e1fcdb9eacc785d620c413eb8a3ce8eb15ad6dcecebacb86ef1
- MD5 37e5131364a4ec7935b69e2b835e6847
- SHA1 d4b7c44a6b7d941bd0161f2503bd78ce62d2b020
- SHA512 e2ce6625aacdaee6928999c4255df9f52a16c8ece55f6bc14fd39e9341ca3f42a6adcf5f91222501e01dd73f75665ecc9ca006a408290cc8a0ea7f3551c2af3b
- SSDEEP 1536:ae7bIulF2ZdOMlNIW4HUhlHrJ/tv5FhkQyvTa2Oxzl:aAkuv2ZsM4nqlLJ9Ny+VBl
- TLSH T17E63026FBC2FECA7C15CB13F35DAC536C8973AF02701844986F25C76853945A8B26A1E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\240713781.txt
- Size 899KB
- SHA256 a003d8124daa1d61fd5af75c24a909143e91eb37515b1ee111538d2599faeebd
- MD5 7d8bcf49dc80685cb0956b5a1c46a1d4
- SHA1 348d3a65ee99ae5dfc95d36680027cf4a7f9ad9f
- SHA512 fdf4955fedb5def9e7f66cb81fcc125bd1a43ed09936b531741192e6ebc4c565eb2f0af924bd76fafc19250c64395f9827ae73f857c185f72192de4951d8721a
- SSDEEP 24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXt:7wqd87Vt
- TLSH T1CF152983F6B68CA3C7C90435DC7AD2B67B24761CE3F786327280E9D7B5B6251781421A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Remote Data.exe
- Size 60KB
- SHA256 6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
- MD5 889b99c52a60dd49227c5e485a016679
- SHA1 8fa889e456aa646a4d0a4349977430ce5fa5e2d7
- SHA512 08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
- SSDEEP 1536:H9ykYCTdiHQKrFXmw2RQln5IUmDjoX6+:HlMHprF2nRQln5I
- TLSH T127532AC2FA00C171D4A7563019778F1A5766AC13DB728ACB94B0B4A41EB3291AD3E5FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\TXPlatfor.exe
- Size 377KB
- SHA256 3de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8
- MD5 4a36a48e58829c22381572b2040b6fe0
- SHA1 f09d30e44ff7e3f20a5de307720f3ad148c6143b
- SHA512 5d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0
- SSDEEP 6144:5UGp2l6zRmeVLNHfkQ2TAygOcqAJwQZgb4YtjH6/MuQafORzEOmFfMzi71o+YHL7:HclcceBKlKwAg0Mja/UafOVwbha
- TLSH T152841241FF520127C74AB0B5C9984E7F8E7A03888E650C3A7F795E4E1B603EE6923D59
- MD5 SHA1 SHA512 SSDEEP TLSH