Task
task1
Task
task2
General
-
Target
Exes_0679ff8965a354cbe614a19cb8d2844b.exe
-
Sample
190801-1d8jq5cce2
-
SHA256
c27b2d312a9e203b0fca4df49aa1d9ef1c974764f6d46eaa85fba3616e61414a
Score
N/A
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 TTPs 1 IoCs
description Token: SeDebugPrivilege -
Modifies Winlogon for persistence 2 TTPs 1 IoCs
description \REGISTRY\USER\S-1-5-21-1548117458-596549244-604853198-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\EwmxaE49afjah0c4\\E44hqPj1QUe4.exe\",explorer.exe" -
Suspicious use of WriteProcessMemory 1 TTPs 1 IoCs
description pid PID 1312 wrote to memory of 1968 1968 -
Suspicious behavior: EnumeratesProcesses
-
Suspicious use of SetThreadContext 1 IoCs
description pid PID 1312 set thread context of 1968 1968 -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of WriteProcessMemory 1 TTPs 1 IoCs
description pid PID 1968 wrote to memory of 552 552 -
Suspicious use of SetThreadContext 1 IoCs
description pid PID 1968 set thread context of 552 552 -
Suspicious behavior: EnumeratesProcesses