5511834808385536.zip
General
Target
Filesize
Completed
485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
106KB
06-04-2020 23:09
Score
8
/10
MD5
SHA1
SHA256
8c7ba09e5e8a46926f2e9233c2cbf3c5
29b031dc4829b82bc35382ed3b00202653af6eee
485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf
Malware Config
Signatures 8
Filter: none
Lateral Movement
Persistence
-
Drops startup file485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
Reported IOCs
description ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe -
Drops autorun.inf file485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
Tags
TTPs
Reported IOCs
description ioc process File created C:\autorun.inf 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe File opened for modification C:\autorun.inf 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe -
Disables Task Manager via registry modification
Tags
-
Suspicious use of WriteProcessMemory485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
Reported IOCs
description pid process target process PID 2500 wrote to memory of 2812 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe netsh.exe PID 2500 wrote to memory of 2812 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe netsh.exe PID 2500 wrote to memory of 2812 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe netsh.exe -
Suspicious use of AdjustPrivilegeToken485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
Reported IOCs
description pid process Token: SeDebugPrivilege 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe Token: 33 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe Token: SeIncBasePriorityPrivilege 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe Token: 33 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe Token: SeIncBasePriorityPrivilege 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe Token: 33 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe Token: SeIncBasePriorityPrivilege 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe Token: 33 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe Token: SeIncBasePriorityPrivilege 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe Token: 33 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe Token: SeIncBasePriorityPrivilege 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe Token: 33 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe Token: SeIncBasePriorityPrivilege 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe Token: 33 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe Token: SeIncBasePriorityPrivilege 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe Token: 33 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe Token: SeIncBasePriorityPrivilege 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe Token: 33 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe Token: SeIncBasePriorityPrivilege 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe Token: 33 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe Token: SeIncBasePriorityPrivilege 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe Token: 33 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe Token: SeIncBasePriorityPrivilege 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe Token: 33 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe Token: SeIncBasePriorityPrivilege 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe Token: 33 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe Token: SeIncBasePriorityPrivilege 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe Token: 33 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe Token: SeIncBasePriorityPrivilege 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe Token: 33 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe Token: SeIncBasePriorityPrivilege 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe Token: 33 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe Token: SeIncBasePriorityPrivilege 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe Token: 33 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe Token: SeIncBasePriorityPrivilege 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe -
Suspicious behavior: EnumeratesProcesses485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
Reported IOCs
pid process 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe -
Suspicious behavior: GetForegroundWindowSpam485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe
Reported IOCs
pid process 2500 485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe -
Modifies Windows Firewall
Tags
TTPs
Processes 2
-
C:\Users\Admin\AppData\Local\Temp\485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exePID:2500"C:\Users\Admin\AppData\Local\Temp\485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe"Drops startup fileDrops autorun.inf fileSuspicious use of WriteProcessMemorySuspicious use of AdjustPrivilegeTokenSuspicious behavior: EnumeratesProcessesSuspicious behavior: GetForegroundWindowSpam
-
C:\Windows\SysWOW64\netsh.exePID:2812netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe" "485731953357c358a63d27adb2740b43cd12a647b26aaa4672ae269b07dbcdbf.exe" ENABLE
Network
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Replay Monitor
00:00
00:00
Downloads
Title
Loading Data