wannacry | bb2df0429f49b6915abee454bb22ea3cb80caa1bd0dd37fbebb576c24ec42d0d

Analysis

max time kernel
23s
max time network
43s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 18:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bb2df0429f49b6915abee454bb22ea3cb80caa1bd0dd37fbebb576c24ec42d0d.dll
Size 5.0MB
Sample261107-xapras1sev
SHA256 bb2df0429f49b6915abee454bb22ea3cb80caa1bd0dd37fbebb576c24ec42d0d
MD5 4d6e985b6fddd69624294da8d1c04e33
SHA1 d2b41224d5d372355622c302a916a12f27a46c7a
SHA512 17000c9e3c343e1f84b7ebdd34f78480c7673715ed83ee1e819ccdd68f63ee5a57e07ee3b67549cb1a95a6a6f1abb365904dd8408ad8343ca30b7710e30d9672
SSDEEP 98304:x8qPoBhz1aRxcSUDk36SAEdhvxWa9P5wGMHqM8WFFa:x8qPe1Cxcxk3ZAEUad2Ga
TLSH
T19B369C03A7EC025AF6F35B39D57664519977BDCA2836D20C10A4269E0EB3F218CA177F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery wannacry ransomware spyware stealer worm

Malware Config

Signatures

Family: Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry

Executes dropped EXE 14 IoCs

pid	Process
1532	mssecsvc.exe
3224	mssecsvc.exe
2972	elevation_service.exe
2004	tasksche.exe
3464	elevation_service.exe
6004	maintenanceservice.exe
6032	OSE.EXE
404	PerceptionSimulationService.exe
916	perfhost.exe
2888	ReFsDedupSvc.exe
1220	SensorDataService.exe
3392	ssh-agent.exe
4744	AgentService.exe
2240	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	mssecsvc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	mssecsvc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	mssecsvc.exe
File opened for modification	C:\Windows\system32\locator.exe	mssecsvc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	mssecsvc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	mssecsvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	mssecsvc.exe
File opened for modification	C:\Windows\System32\vds.exe	mssecsvc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	mssecsvc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	mssecsvc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	mssecsvc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	mssecsvc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	mssecsvc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	mssecsvc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	mssecsvc.exe
File opened for modification	C:\Windows\System32\alg.exe	mssecsvc.exe
File opened for modification	C:\Windows\System32\alg.exe	mssecsvc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	mssecsvc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	mssecsvc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	mssecsvc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	mssecsvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	mssecsvc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	mssecsvc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	mssecsvc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	mssecsvc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\b21b9dd1b68fd3f0.bin	mssecsvc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	mssecsvc.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	mssecsvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	mssecsvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	mssecsvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	mssecsvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	mssecsvc.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	mssecsvc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	mssecsvc.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	mssecsvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	mssecsvc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	mssecsvc.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	mssecsvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	mssecsvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	mssecsvc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	mssecsvc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	mssecsvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	mssecsvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	mssecsvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	mssecsvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	mssecsvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	mssecsvc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	mssecsvc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	mssecsvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	mssecsvc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	mssecsvc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	mssecsvc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	mssecsvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	mssecsvc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	mssecsvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	mssecsvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	mssecsvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	mssecsvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	mssecsvc.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	mssecsvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	mssecsvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	mssecsvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	mssecsvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	mssecsvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	mssecsvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	mssecsvc.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	mssecsvc.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	mssecsvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	mssecsvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	mssecsvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	mssecsvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	mssecsvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	mssecsvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	mssecsvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	mssecsvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	mssecsvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	mssecsvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	mssecsvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	mssecsvc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	mssecsvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	mssecsvc.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	mssecsvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	mssecsvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	mssecsvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	mssecsvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	mssecsvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	mssecsvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	mssecsvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	mssecsvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	mssecsvc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	mssecsvc.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	mssecsvc.exe
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	mssecsvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	mssecsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssecsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000013b6a856e76edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e15fb858e76edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000ec521157e76edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f34ff255e76edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000462b7056e76edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000df89b256e76edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000050fa8a56e76edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007f377556e76edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3224	mssecsvc.exe
3224	mssecsvc.exe
3224	mssecsvc.exe
3224	mssecsvc.exe
3224	mssecsvc.exe
3224	mssecsvc.exe
3224	mssecsvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1532	mssecsvc.exe
Token: SeTakeOwnershipPrivilege	3224	mssecsvc.exe
Token: SeAssignPrimaryTokenPrivilege	4744	AgentService.exe
Token: 33	2240	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2240	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2240	SearchIndexer.exe
Token: SeBackupPrivilege	2888	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2888	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2888	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2888	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2888	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2888	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2888	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2888	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2888	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2888	ReFsDedupSvc.exe
Token: SeDebugPrivilege	3224	mssecsvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 4448	1252	rundll32.exe	88
PID 4448 wrote to memory of 1532	4448	rundll32.exe	89
PID 2240 wrote to memory of 1908	2240	SearchIndexer.exe	105
PID 2240 wrote to memory of 5732	2240	SearchIndexer.exe	106
PID 2240 wrote to memory of 2696	2240	SearchIndexer.exe	107
PID 2240 wrote to memory of 3668	2240	SearchIndexer.exe	108

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb2df0429f49b6915abee454bb22ea3cb80caa1bd0dd37fbebb576c24ec42d0d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb2df0429f49b6915abee454bb22ea3cb80caa1bd0dd37fbebb576c24ec42d0d.dll,#1
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4448
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1532
  - - C:\WINDOWS\tasksche.exe
      C:\WINDOWS\tasksche.exe /i
      4⤵
      Executes dropped EXE
      PID:2004

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3224

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2972

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3464

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:6004

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6032

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:404

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:916

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2888

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1220

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3392

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4744

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1908
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5732
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2832 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2696
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2920 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e1a818e052f5154b03f7ef3283f4fe1c8da30f70ee1952c8062fc33bb9980a40
MD5 c868190ebfd5ca62322d1a9186b6fa97
SHA1 b02a4e79b4adb41589dd2730d5a71d3c7174f722
SHA512 9d251b6c7d0774bbc7ccad00641b31c16e485d8e676cc3c6c591aa7a7aa5f69238326feb37914ef1d24a0340c42bdbe5f506c7216b450428bfa7e10ac520682f
SSDEEP 49152:1b+632BuPkFKRrdE6ohvstBhuXjfS4LWxn+olMHqz48WFFw/:L3q6sjBlGMHqM8WFFa
TLSH
T115D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 78f8983d87bef844bff58fb624f400a26ea7418204290e58d9bb37943390f2ae
MD5 c4c3c00ed4e62bf5991f40f61de59c1c
SHA1 8f5f2fd703814f2ba76b2548cb866aabcd256a0a
SHA512 ffa0a9d862fdcee6d3f9870b781caa946ea234ea7e4ed3ad6625f848a8bd2485fbfddf6decfce16a7d25604966e18587b50c4c5d7b659d42f3f1d109cc7f915f
SSDEEP 12288:41XLsswWkxy2lRq2czAhEaU4hepDpzxHGhwc5BWUkk9G4x6M9qHiF0qwJuuxDLq:+XYfDtczAholHs+ctkz48WEiqqw/NL
TLSH
T1AE750128B3D448F9ED678138C9A2C506EA737C9547A0E7CB03E4A6661F332D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 4772f851be94859cb87dee46aab10ab86f4dcfd014e8a7be00590b6c8dea2a00
MD5 a7d7038a56d84a01ce0bff72dafb3566
SHA1 d1bb030812f3d54ee8484a5502b23c6a313867ca
SHA512 4ca83108fd3cac05622129962014bed5da589fd175da6c6302ab6ce926ac16a713dc5b666d1065b9d9c878cab1f5657e74b691aacd40262c4be6c69d5b55f43e
SSDEEP 12288:1mw5HEjsChN5BFgl0WDm+C0EaU4hepDpzxHGhwc5BWUkk9G4x6M9qHiF0qwJuuxS:wwucOW/olHs+ctkz48WEiqqw/NL
TLSH
T17875F04573A84CF9EA6755388697C536F7F3BC062A61C71F1360C65B6F33260AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e6fa4a7a6818cec617cdb61f5d9dc505f9f534a762c918c0513696b8e117c111
MD5 f333f6eb6b52572bb129b36cc96dea75
SHA1 254b608a8ba6ad7a7d401ff21dfe6db7e46bb720
SHA512 271e0b46d529853c50716fa20298cf7f61048a4a5f38b0e7ec59a5c151ceed120e5d7d9f6270041103bbec1bb071982bb836ac783ad98ad34ab523777905e080
SSDEEP 49152:CB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl5olMHqz48WFFw/:wu6Jmdxd2d5GMHqM8WFFa
TLSH
T1A4D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 7ad84361a240d2a2cfe888a867de3eb6082363f044829740e222ef2b95165367
MD5 77dabb95677ae7a7c9b31636998398e0
SHA1 0a2d36cc1bd84e55b04e06051f728e8ef2797689
SHA512 936df996532e01871e629f54b095423b70a1deb0171bdbf0b7dbef9bb1a01e33b703d393b158a0f89fccae6d9cfa3186fefdb5c9baaff4e90fd2cd41e810b94a
SSDEEP 12288:f07GEaU4hepDpzxHGhwc5BWUkk9G4x6M9qHiF0qwJuuxDLqX:8GolHs+ctkz48WEiqqw/NL+
TLSH
T133552300D75ECC89EB363870565EE92D265B3F9D2FC642D7B25972C26E308D0AC36E52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 659eb9d79f13a26c816abb9ee129daa40a682ce1b1e7986f380cac515862aa3a
MD5 0b50234f7e9d262329316572dead37dc
SHA1 4354ea3c837cd9c2f270f1e97562047a915b096d
SHA512 9121608da0f46315d18cadd6d5ccb1d9784d679d1ba6bb62729acadaf28b7a619925923fc0e33703954defefe9767ca3e826f33555a52959edcb874a64e2df26
SSDEEP 24576:Cgb6bmBIi49WNNFpg1rSvFv7bYUolHs+ctkz48WEiqqw/NL:Cgb4mBIBhGFnolMHqz48WFFw/
TLSH
T13065AE1E22EC02F5E1F6E2B88DAA4417D6B378160732D2DF1151426D2F3BDE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 f82b1a3f6df7604612e38b50fa9c6edc75db4f1361e49efd0e96b36ee6158bd2
MD5 1a54be9f7bfe6eef9d661d10b9644a2a
SHA1 5ae05e38cd1560bf509367a9b6b0138937533720
SHA512 3f30b49783a60a952a2e9c4102a8105c712e37d7675332773afe877b94c1b63971349eec380d6a43b5ce36cb714d37d67e681f96f6aa15a0b239e58ca0f0b7f9
SSDEEP 24576:YG88u8FpJqH1Hzria7/m3olHs+ctkz48WEiqqw/NL:b7ZFPqVaa7/MolMHqz48WFFw/
TLSH
T17E95F165B7E101F0D477D0388A864667F6B2B8251365EBDF07A88B511F23AE44B3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 627f9e9177ca04814c0adcf9ac7e2bded912a4d4001f5237be5c626e8431fe12
MD5 9faf5eb0823614db40657733f46ce852
SHA1 01654e82b4ed5d331f47a2d9720a75d96551d98c
SHA512 707ce45745c6ab3f678dded4afe43f850083417db1526adae5c1e0bf48aed8dfe77e05297e5f5701c828705fbd426e3b70326a2cec4a8b30297fd5eb3b1f0e24
SSDEEP 49152:QBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj7olMHqz48WFFw/:LG05lO43byGMHqM8WFFa
TLSH
T1D8D5CF6E62EC01F9D1BBD17CDAC64A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1afe7bf3179daede645681f0020aee27b08238403c30cdddbc7a53f92f103f66
MD5 baf9f9da7d73aded962866906c3178e7
SHA1 4be625e5a84f6aeca9769145e5d67d11f60f4dd5
SHA512 1806dc849546442df25cba937a18fdcf1be79ce4bda050148ab4e4e65cfb515268dc84efd525533ee3ffbe587e56c1239b3bae98f767540bab1ae60548a4ade2
SSDEEP 24576:+fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnBolHs+ctkz48WEiqqw/NL:ma5POZ3BJt2pasx2+mDolMHqz48WFFw/
TLSH
T14B65AF5DA7FC00D5D579D17DC5838A1AE5B2342613329BCB122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4d61a5f6876557c508d9e66aeedbb15797569d372dff950746af30a699f46f5c
MD5 b309154cd4228e44881958b66008008b
SHA1 ca7ac4dfa36f85cb6c5d281b429dc14dd98ce096
SHA512 9e1174614202f983b948ed8b3ded2c73fd174e7f98f2237735316d1860946b84d8246860f53a5b4de6f289d4fb532a2e1c8a07b67ec515866e8153f79386c041
SSDEEP 24576:nNcwHdjbyQ4nLC18lb/EOjowL7FkfolHs+ctkz48WEiqqw/NL:nNc/zEOVHFsolMHqz48WFFw/
TLSH
T1CC858C1623E901E4F5BBE1BE89779546FAB17869173086CF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 4.1MB
SHA256 64a042cae62cbef679441530d37fd40c9ac0dc1fe14e3a223260bde92bd4c7ea
MD5 996f0d110e18852d28a96d2c13b20c72
SHA1 68dc0c235d0aa22beacdb7fe1f9ea9e6443a3bc2
SHA512 06c093a1b2f88b3a1e2ee3cb3930d7a32d97bf76d2713469566a134d1be3efce63c26ceacb2d623a5b38d591d54436936964689c43d2da7e81580f0ed96758a0
SSDEEP 98304:c8qPoBhz1aRxcSUDk36SAEdhvxWa9P5wGMHqM8WFFa:c8qPe1Cxcxk3ZAEUad2Ga
TLSH
T177169C03A7EC025AF6F35B39D57664519977BDCA2836D20C10A4269E0EB3F218CA177F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 7f66d8c59c7bcbd5daa849275034d46af38e2486af78d25bdc79ef8e15379d06
MD5 7469aa4a907bfc8db4e56b80b4157ee2
SHA1 4b8b5b6d532688fc7c5e824723ae8cb64fe9109e
SHA512 43b51b830ee7c66515213897a7e0cab211c92078860a59c7287fababd0f6c63a9216cac123a3d9a7483fed97cf40cfc6e26ef5cf8b72dbaa003ed639a41044ef
SSDEEP 24576:RTkNvNnaFeYhJNtmZBmlolHs+ctkz48WEiqqw/NL:RTMwBtOmlolMHqz48WFFw/
TLSH
T13255AF2EB7B846E4D1FAC6B4CD238516E6727861173293CB5290C13F0E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 8422274e0e0c1a41b0f6a513ff6ce46ef6a2925441e3c09bdd20bb027fb9d24c
MD5 56d8203c1bcf01395a261553715c20ba
SHA1 17ee0d5012c1a6f4bb79ab277eefb9c41fe71fec
SHA512 a09d05f75a1fab27b565add6ba66d05c821a82d3d9cc041949c4d8f72183f2e55a0691de8c35a08a22294933c324f218babcf7e17d09fc05f7b2214351148d79
SSDEEP 12288:NHvUrBFrEjwaQrEaU4hepDpzxHGhwc5BWUkk9G4x6M9qHiF0qwJuuxDLq:NPUr+NQrolHs+ctkz48WEiqqw/NL
TLSH
T11475F11E62AD0CE5E676A17D8586860DF7727866175292CF02E0817E4F73DE8BC3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tasksche.exe

Path C:\Windows\tasksche.exe
Size 3.4MB
SHA256 82d3aabbff37889695657e40fd52e38159757b7f909426d1a4a4657f48dd3c5c
MD5 962d4291a5dfac935ca1eff9b1e21d62
SHA1 4f68907deb3cbfeeb5133c44f12ae58d1c20b338
SHA512 6bbf39169cead50fdb9a5ce872ce73607627c05c5f5a040545f5c733ff2d45a4c33f54a4e2d33cad36b9d083110e947ba23d979ab570fc0917436b9e87c7f627
SSDEEP 49152:nQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9PAMEcaEae:QqPoBhz1aRxcSUDk36SAEdhvxWa9P5N
TLSH
T15BF57B13A7EC025AF6F35B28E57664519937FDCA2836D21C10A4259E0EB3F218CA177F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/404-83-0x0000000140000000-0x0000000140186000-memory.dmp

Download

memory/404-298-0x0000000140000000-0x0000000140186000-memory.dmp

Download

memory/404-85-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/404-91-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/916-101-0x0000000000870000-0x00000000008D6000-memory.dmp

Download

memory/916-315-0x0000000000400000-0x0000000000552000-memory.dmp

Download

memory/916-95-0x0000000000400000-0x0000000000552000-memory.dmp

Download

memory/916-96-0x0000000000870000-0x00000000008D6000-memory.dmp

Download

memory/1220-329-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1220-117-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1220-330-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/1220-124-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/1220-332-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1220-118-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/1532-42-0x0000000000400000-0x0000000000AFA000-memory.dmp

Download

memory/1532-13-0x00000000010E0000-0x0000000001146000-memory.dmp

Download

memory/1532-5-0x0000000000400000-0x0000000000AFA000-memory.dmp

Download

memory/1532-7-0x00000000010E0000-0x0000000001146000-memory.dmp

Download

memory/2240-334-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2240-160-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2240-161-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2240-167-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2888-348-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2888-346-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2888-105-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2888-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2888-106-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2888-112-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2972-159-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2972-28-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2972-27-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2972-36-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3224-131-0x0000000000400000-0x0000000000AFA000-memory.dmp

Download

memory/3224-23-0x00000000011A0000-0x0000000001206000-memory.dmp

Download

memory/3224-18-0x00000000011A0000-0x0000000001206000-memory.dmp

Download

memory/3392-333-0x0000000140000000-0x00000001401FA000-memory.dmp

Download

memory/3392-138-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3392-130-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3392-132-0x0000000140000000-0x00000001401FA000-memory.dmp

Download

memory/3464-197-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3464-46-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3464-47-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3464-53-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4744-153-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4744-143-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4744-156-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4744-150-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/4744-144-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/6004-68-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6004-57-0x0000000140000000-0x0000000140190000-memory.dmp

Download

memory/6004-64-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6004-70-0x0000000140000000-0x0000000140190000-memory.dmp

Download

memory/6032-272-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/6032-72-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/6032-73-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/6032-79-0x0000000000860000-0x00000000008C0000-memory.dmp

Download