Analysis
-
max time kernel
149s -
max time network
116s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
24-06-2020 14:54
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.BehavesLike.Win32.Trojan.vc.18517.exe
Resource
win7
General
-
Target
SecuriteInfo.com.BehavesLike.Win32.Trojan.vc.18517.exe
-
Size
2.6MB
-
MD5
354e05cb8730a0e260ccb68430512e7e
-
SHA1
ae1f314778d4c63fb03465f4748995b80ac423e7
-
SHA256
91fd241a76d4b4a70b4365c06e05154181722b5937fab4c3c6caa1e8fd907029
-
SHA512
797cd7013e05516e83fdbb4c5428cf7aa71d12561788fc1215ce9c18cb0432cb6e4a9e3c10e19a84ef35300f6fda755ea5309b4b93bef715ccff1c77ef5b1cad
Malware Config
Extracted
danabot
92.204.160.126
193.34.166.26
93.115.22.159
93.115.22.165
185.227.138.52
37.120.145.243
195.133.147.230
Signatures
-
Danabot x86 payload 8 IoCs
Detection of Danabot x86 payload, mapped in memory during the execution of its loader.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\SECURI~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\SECURI~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\SECURI~1.DLL family_danabot C:\ProgramData\9162E964\1255DB5F.dll family_danabot \ProgramData\9162E964\1255DB5F.dll family_danabot \ProgramData\9162E964\1255DB5F.dll family_danabot \ProgramData\9162E964\1255DB5F.dll family_danabot -
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 2180 created 1492 2180 WerFault.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.vc.18517.exe -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 2 2548 rundll32.exe -
Executes dropped EXE 2 IoCs
Processes:
winlogon.exeExplorer.EXEpid process 548 winlogon.exe 3012 Explorer.EXE -
Sets DLL path for service in the registry 2 TTPs
-
Sets service image path in registry 2 TTPs
-
Loads dropped DLL 11 IoCs
Processes:
regsvr32.exerundll32.exerundll32.exerundll32.exerundll32.exeRUNDLL32.EXEsvchost.exerundll32.exeRUNDLL32.EXErundll32.exepid process 1940 regsvr32.exe 1940 regsvr32.exe 2548 rundll32.exe 3912 rundll32.exe 992 rundll32.exe 1420 rundll32.exe 3308 RUNDLL32.EXE 1184 svchost.exe 1020 rundll32.exe 3096 RUNDLL32.EXE 2344 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
svchost.exedescription ioc process File opened (read-only) \??\I: svchost.exe File opened (read-only) \??\P: svchost.exe File opened (read-only) \??\V: svchost.exe File opened (read-only) \??\W: svchost.exe File opened (read-only) \??\X: svchost.exe File opened (read-only) \??\J: svchost.exe File opened (read-only) \??\K: svchost.exe File opened (read-only) \??\M: svchost.exe File opened (read-only) \??\U: svchost.exe File opened (read-only) \??\G: svchost.exe File opened (read-only) \??\H: svchost.exe File opened (read-only) \??\L: svchost.exe File opened (read-only) \??\N: svchost.exe File opened (read-only) \??\A: svchost.exe File opened (read-only) \??\B: svchost.exe File opened (read-only) \??\E: svchost.exe File opened (read-only) \??\F: svchost.exe File opened (read-only) \??\O: svchost.exe File opened (read-only) \??\S: svchost.exe File opened (read-only) \??\T: svchost.exe File opened (read-only) \??\Y: svchost.exe File opened (read-only) \??\Q: svchost.exe File opened (read-only) \??\R: svchost.exe File opened (read-only) \??\Z: svchost.exe -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2180 1492 WerFault.exe SecuriteInfo.com.BehavesLike.Win32.Trojan.vc.18517.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe -
Modifies data under HKEY_USERS 19 IoCs
Processes:
rundll32.exeRUNDLL32.EXEdescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer = "127.0.0.1:8080" RUNDLL32.EXE Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings RUNDLL32.EXE Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer = "127.0.0.1:8080" RUNDLL32.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates RUNDLL32.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\root rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings RUNDLL32.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "1" RUNDLL32.EXE Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings RUNDLL32.EXE Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "1" RUNDLL32.EXE Set value (str) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer = "127.0.0.1:8080" RUNDLL32.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\root RUNDLL32.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs RUNDLL32.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs RUNDLL32.EXE Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "1" RUNDLL32.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 RUNDLL32.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs rundll32.exe -
Modifies registry class 7 IoCs
Processes:
RUNDLL32.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Software RUNDLL32.EXE Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Software\Microsoft RUNDLL32.EXE Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Software\Microsoft\Windows RUNDLL32.EXE Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Software\Microsoft\Windows\CurrentVersion RUNDLL32.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "1" RUNDLL32.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer = "127.0.0.1:8080" RUNDLL32.EXE Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings RUNDLL32.EXE -
Processes:
RUNDLL32.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C0F5A371B6210EB94D8728FE3C1B287B8C10CDEB RUNDLL32.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C0F5A371B6210EB94D8728FE3C1B287B8C10CDEB\Blob = 030000000100000014000000c0f5a371b6210eb94d8728fe3c1b287b8c10cdeb02000000010000003c0000001c00000000000000010000002000000000000000000000000100000074006800610077007400650020003200410020002d002000390037000000000020000000010000000703000030820303308201eba003020102021076be066f305717ba4dfd88ceb6d44c4b300d06092a864886f70d01010505003033311730150603550403130e746861777465203241202d203937310b3009060355040a13024e54310b3009060355040b1302454e301e170d3135303632343136353933305a170d3235303632343136353933305a3033311730150603550403130e746861777465203241202d203937310b3009060355040a13024e54310b3009060355040b1302454e30820122300d06092a864886f70d01010105000382010f003082010a0282010100e38ed7e8013245267aa8b472de3baa172b854ded00e1e7d126581ed6dc57c2673b711f448b970fd9d6600beda435b3995e5208b932751cf75d8643c90f15d376f1327fc61f1fccca66b8aa7cee03863ab818ede336a9d74668244350d97d67ab16f4fa3dffcd76570f58bcd25cfe24fd7da62871e22465c3e7b841bffd8277b4b48fe2a8bda5980c07af6f79499de329cfcb0115939ef4d2ec1c15af3bf1ba3269f6ed8667cc6a4b235b84ed01bfcdd6ec44102875416208016d9eb9260e336c5fe5beedc54222340dcf460a96f43be8afa07da458d161983061c53f4974bef379523e0f36439006539050853ae0bd7acd1ef138cd57781980636807bc6fe6750203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d0101050500038201010006e5a79e0484a63206bd6d7e8de680277a9e7de90e796b732978cbcf137036d10fe50df4ff5d61c326ad6373e6679473da2696db9b0721aae9e75748eb42d8379be4687bbf5ddbe5a3f76a2e4d0006c5d81b0efee7e952fd2edf700f550b4a3e855bf4739502ec1829637b58790bfd11cb6742216f000802ed5239226ad8f5400b8d452951294d4b47c33d65305babc77ccb6d571833dcf48da3907a0b325981da19a4e88f67bec7f04ef7127dc826c3aec1ca21ab42ef5a2c4f822a66166bb3f504d2e6999bc77264359879ee83a5b3f48c0041eafbf0bed0aa7ca7925e035b6874c0f88ffe6c3d03e066c500b4734abe11b978ae6036c8cbb3eabf4361fb18 RUNDLL32.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
WerFault.exepowershell.exepowershell.exesvchost.exerundll32.exepid process 2180 WerFault.exe 2180 WerFault.exe 2180 WerFault.exe 2180 WerFault.exe 2180 WerFault.exe 2180 WerFault.exe 2180 WerFault.exe 2180 WerFault.exe 2180 WerFault.exe 2180 WerFault.exe 2180 WerFault.exe 2180 WerFault.exe 2180 WerFault.exe 3452 powershell.exe 3416 powershell.exe 3416 powershell.exe 3452 powershell.exe 3416 powershell.exe 1184 svchost.exe 1184 svchost.exe 3452 powershell.exe 1020 rundll32.exe 1020 rundll32.exe 1020 rundll32.exe 1020 rundll32.exe 1020 rundll32.exe 1020 rundll32.exe 1020 rundll32.exe 1020 rundll32.exe 1020 rundll32.exe 1020 rundll32.exe 1020 rundll32.exe 1020 rundll32.exe 1020 rundll32.exe 1020 rundll32.exe 1020 rundll32.exe 1020 rundll32.exe 1020 rundll32.exe 1020 rundll32.exe 1020 rundll32.exe 1020 rundll32.exe 1020 rundll32.exe 1020 rundll32.exe 1020 rundll32.exe 1020 rundll32.exe 1020 rundll32.exe 1020 rundll32.exe 1020 rundll32.exe 1020 rundll32.exe 1020 rundll32.exe 1020 rundll32.exe 1020 rundll32.exe 1020 rundll32.exe 1020 rundll32.exe 1020 rundll32.exe 1020 rundll32.exe 1020 rundll32.exe 1020 rundll32.exe 1020 rundll32.exe 1020 rundll32.exe 1020 rundll32.exe 1184 svchost.exe 1184 svchost.exe 1020 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 61 IoCs
Processes:
WerFault.exeRUNDLL32.EXErundll32.exepowershell.exepowershell.exeExplorer.EXEdescription pid process Token: SeRestorePrivilege 2180 WerFault.exe Token: SeBackupPrivilege 2180 WerFault.exe Token: SeDebugPrivilege 2180 WerFault.exe Token: SeDebugPrivilege 3308 RUNDLL32.EXE Token: SeDebugPrivilege 1420 rundll32.exe Token: SeDebugPrivilege 3416 powershell.exe Token: SeDebugPrivilege 3452 powershell.exe Token: SeIncreaseQuotaPrivilege 3416 powershell.exe Token: SeSecurityPrivilege 3416 powershell.exe Token: SeTakeOwnershipPrivilege 3416 powershell.exe Token: SeLoadDriverPrivilege 3416 powershell.exe Token: SeSystemProfilePrivilege 3416 powershell.exe Token: SeSystemtimePrivilege 3416 powershell.exe Token: SeProfSingleProcessPrivilege 3416 powershell.exe Token: SeIncBasePriorityPrivilege 3416 powershell.exe Token: SeCreatePagefilePrivilege 3416 powershell.exe Token: SeBackupPrivilege 3416 powershell.exe Token: SeRestorePrivilege 3416 powershell.exe Token: SeShutdownPrivilege 3416 powershell.exe Token: SeDebugPrivilege 3416 powershell.exe Token: SeSystemEnvironmentPrivilege 3416 powershell.exe Token: SeRemoteShutdownPrivilege 3416 powershell.exe Token: SeUndockPrivilege 3416 powershell.exe Token: SeManageVolumePrivilege 3416 powershell.exe Token: 33 3416 powershell.exe Token: 34 3416 powershell.exe Token: 35 3416 powershell.exe Token: 36 3416 powershell.exe Token: SeIncreaseQuotaPrivilege 3452 powershell.exe Token: SeSecurityPrivilege 3452 powershell.exe Token: SeTakeOwnershipPrivilege 3452 powershell.exe Token: SeLoadDriverPrivilege 3452 powershell.exe Token: SeSystemProfilePrivilege 3452 powershell.exe Token: SeSystemtimePrivilege 3452 powershell.exe Token: SeProfSingleProcessPrivilege 3452 powershell.exe Token: SeIncBasePriorityPrivilege 3452 powershell.exe Token: SeCreatePagefilePrivilege 3452 powershell.exe Token: SeBackupPrivilege 3452 powershell.exe Token: SeRestorePrivilege 3452 powershell.exe Token: SeShutdownPrivilege 3452 powershell.exe Token: SeDebugPrivilege 3452 powershell.exe Token: SeSystemEnvironmentPrivilege 3452 powershell.exe Token: SeRemoteShutdownPrivilege 3452 powershell.exe Token: SeUndockPrivilege 3452 powershell.exe Token: SeManageVolumePrivilege 3452 powershell.exe Token: 33 3452 powershell.exe Token: 34 3452 powershell.exe Token: 35 3452 powershell.exe Token: 36 3452 powershell.exe Token: SeShutdownPrivilege 3012 Explorer.EXE Token: SeCreatePagefilePrivilege 3012 Explorer.EXE Token: SeShutdownPrivilege 3012 Explorer.EXE Token: SeCreatePagefilePrivilege 3012 Explorer.EXE Token: SeShutdownPrivilege 3012 Explorer.EXE Token: SeCreatePagefilePrivilege 3012 Explorer.EXE Token: SeShutdownPrivilege 3012 Explorer.EXE Token: SeCreatePagefilePrivilege 3012 Explorer.EXE Token: SeShutdownPrivilege 3012 Explorer.EXE Token: SeCreatePagefilePrivilege 3012 Explorer.EXE Token: SeShutdownPrivilege 3012 Explorer.EXE Token: SeCreatePagefilePrivilege 3012 Explorer.EXE -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
Explorer.EXErundll32.exepid process 3012 Explorer.EXE 3012 Explorer.EXE 3012 Explorer.EXE 3012 Explorer.EXE 1420 rundll32.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
SecuriteInfo.com.BehavesLike.Win32.Trojan.vc.18517.exeregsvr32.exerundll32.exerundll32.exerundll32.exesvchost.exedescription pid process target process PID 1492 wrote to memory of 1940 1492 SecuriteInfo.com.BehavesLike.Win32.Trojan.vc.18517.exe regsvr32.exe PID 1492 wrote to memory of 1940 1492 SecuriteInfo.com.BehavesLike.Win32.Trojan.vc.18517.exe regsvr32.exe PID 1492 wrote to memory of 1940 1492 SecuriteInfo.com.BehavesLike.Win32.Trojan.vc.18517.exe regsvr32.exe PID 1940 wrote to memory of 2548 1940 regsvr32.exe rundll32.exe PID 1940 wrote to memory of 2548 1940 regsvr32.exe rundll32.exe PID 1940 wrote to memory of 2548 1940 regsvr32.exe rundll32.exe PID 2548 wrote to memory of 3912 2548 rundll32.exe rundll32.exe PID 2548 wrote to memory of 3912 2548 rundll32.exe rundll32.exe PID 2548 wrote to memory of 3912 2548 rundll32.exe rundll32.exe PID 3912 wrote to memory of 992 3912 rundll32.exe rundll32.exe PID 3912 wrote to memory of 992 3912 rundll32.exe rundll32.exe PID 992 wrote to memory of 1420 992 rundll32.exe rundll32.exe PID 992 wrote to memory of 1420 992 rundll32.exe rundll32.exe PID 992 wrote to memory of 1420 992 rundll32.exe rundll32.exe PID 992 wrote to memory of 3308 992 rundll32.exe RUNDLL32.EXE PID 992 wrote to memory of 3308 992 rundll32.exe RUNDLL32.EXE PID 992 wrote to memory of 3416 992 rundll32.exe powershell.exe PID 992 wrote to memory of 3416 992 rundll32.exe powershell.exe PID 992 wrote to memory of 3452 992 rundll32.exe powershell.exe PID 992 wrote to memory of 3452 992 rundll32.exe powershell.exe PID 1184 wrote to memory of 1020 1184 svchost.exe rundll32.exe PID 1184 wrote to memory of 1020 1184 svchost.exe rundll32.exe PID 1184 wrote to memory of 1020 1184 svchost.exe rundll32.exe PID 1184 wrote to memory of 548 1184 svchost.exe winlogon.exe PID 1184 wrote to memory of 3096 1184 svchost.exe RUNDLL32.EXE PID 1184 wrote to memory of 3096 1184 svchost.exe RUNDLL32.EXE PID 1184 wrote to memory of 3012 1184 svchost.exe Explorer.EXE PID 1184 wrote to memory of 2344 1184 svchost.exe rundll32.exe PID 1184 wrote to memory of 2344 1184 svchost.exe rundll32.exe PID 1184 wrote to memory of 2344 1184 svchost.exe rundll32.exe
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
- Executes dropped EXE
PID:548
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Trojan.vc.18517.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Trojan.vc.18517.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\SECURI~1.EXE@14923⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL,f04⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\\rundll32.exe C:\PROGRA~3\9162E964\1B1FB272.dll,f1 C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL@25485⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Windows\system32\rundll32.exeC:\Windows\system32\\rundll32.exe C:\PROGRA~3\9162E964\1B1FB272.dll,f1 C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL@25486⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Windows\syswow64\rundll32.exeC:\Windows\syswow64\rundll32.exe C:\ProgramData\9162E964\1255DB5F.dll,f2 F709AA619059A3AAB3E71D0ADA4623727⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1420 -
C:\Windows\system32\RUNDLL32.EXEC:\Windows\system32\RUNDLL32.EXE C:\ProgramData\9162E964\1B1FB272.dll,f2 1FCAAAC36182D72B5B244331A74217017⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3308 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\ProgramData\9162E964\1255DB5F.dll7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3416 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\ProgramData\9162E964\1B1FB272.dll7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3452 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 4003⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2180
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\syswow64\rundll32.exeC:\Windows\syswow64\rundll32.exe C:\ProgramData\9162E964\1255DB5F.dll,f32⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1020 -
C:\Windows\system32\RUNDLL32.EXEC:\Windows\system32\RUNDLL32.EXE C:\ProgramData\9162E964\1B1FB272.dll,f72⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Modifies registry class
- Modifies system certificate store
PID:3096 -
C:\Windows\syswow64\rundll32.exeC:\Windows\syswow64\rundll32.exe C:\ProgramData\9162E964\1255DB5F.dll,f2 E48E292D52AA1264BCBA6B30A9CB21132⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
PID:2344
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
d48955ca5167e1ff4edc24220cf748fa
SHA11799693b6ad300108a9837f19cd8971c1d465d54
SHA2564e45444bb7ab4263d593db5c5db19330a874c555dc577df03efa505e94f0ff77
SHA5127ea22068cdb12b72b11daa0e91996520e2147279842a95a81d18cad34247b58b609cef6cc00ca9877c6a244c4d27ea0ca3e2697bcc95fb607dab125bc3c098cc
-
MD5
151decc0fb08687834d6335729c4fd93
SHA1ce8d50e1869b3b26ed9051c17c262af747c7c7b3
SHA256742a83c76ea9ae304f6425bd84d175bfdfec7c74e946b8a7aea456b0672e7bb6
SHA5121483fea7c1181a38b35688d5cd08051a386f49994b957cf3248936b2cb2c43819a0975c16a60544e925a9db969f0017adcabfc2c7383b8fdd5529357c88d6ace
-
MD5
fe4a7bee09360093ec31c2093145da09
SHA1bd62aa16826e652eb58cd99b1ea7bfad946e53e3
SHA256917ab82f25f407e485c7595a40d4f165a7c8425c5e2438fa8184ae4734068a5b
SHA5123b366a52318c6227618cf8f72af8b2f73b91d31257393138a0e17f53854b85b1a4fa7d148c2492e786c1175dc88e917a32c13ee5560e283ecdcaae2f5c47c154
-
MD5
835a34043adf95b84531021a5b450385
SHA1b3e1485024fa9b1fbec8416f9df157313e3b8898
SHA2562753e0c6b45edc7592da0b6475cd068c22ad671f505788d7d7393c2489813918
SHA5120c9ac5821d37c568a776ef6cfd06a4e7edbef93daa437874d5422e3940c7ba1499156457dcb1638b351e90639d15c4dca32ac0b28622d3e4f52809f49d26d201
-
MD5
46e3e82d89e46544195ed9ff69158677
SHA199c9b6e056421f3f9f79d9e4a920148d2ef81676
SHA256caf418cf6cf175a05c3e27bc38acd4299955208e87b1050e6a0d8eae634ab235
SHA512c824485d5f5918a587700df5f57a263a60292c91f4eb948aedb9022b56752baec6a637453ab6e36d0975318919019f13368826dd84fa04c8931d71afd9f11f51
-
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\7738415fdb1c13502070bd7ffc94ce07_3e009a64-65d7-465c-9098-f2673dd3f416
MD52f884b004a13121bf1fb278330c2bb1e
SHA1de8011defcf20e2892ab1fc333181fedf05bf92c
SHA2564d6da958a86c95cc40f6390d7384d811b1a90fd6ef4596f2070601c510a9a61d
SHA512257fd72c117273704de686f4a07f688f081abbb9f6dd3b135946349bff81500b1886a452102efec80d0852ad11f9aa95f738f2b696fa497ecbb59ba52fd9e0fc
-
MD5
ad5cd538ca58cb28ede39c108acb5785
SHA11ae910026f3dbe90ed025e9e96ead2b5399be877
SHA256c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033
SHA512c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13
-
MD5
f8572ccfb7e0acc2c204aaf413c93817
SHA1e466a0f3c8978c2bde5bf6a9ea559dfa6c5fcc84
SHA256cdcced7a99d079584f992e32311851ef8e134686faf3b764f90fdf4bde785af1
SHA51290431a783e7ab643f9bc0202a329b9405d3768fcdb9565866770e658ad42ff0bec00817e3f86967445b2fe7d0ae3d3f0a54f06c7195964624be2ae950595dc86
-
MD5
ba5bcacdd2930de8898da02eb76bd9d1
SHA12d6cdd794b651a92753113b58139957635efea7c
SHA256a59a10879e0a2db88c6ea80f31a85962b7e4e89b6e2c4d4cac459b1580422b78
SHA512b46fb1ee60d7c22bd943462fcd5107645189b509dc564f4e1a0b6b5f04ef7a42aeaad117f217f4f3096baa09beb953eb65a7588a9ba432a3632d3fe35edf8a27
-
MD5
d48955ca5167e1ff4edc24220cf748fa
SHA11799693b6ad300108a9837f19cd8971c1d465d54
SHA2564e45444bb7ab4263d593db5c5db19330a874c555dc577df03efa505e94f0ff77
SHA5127ea22068cdb12b72b11daa0e91996520e2147279842a95a81d18cad34247b58b609cef6cc00ca9877c6a244c4d27ea0ca3e2697bcc95fb607dab125bc3c098cc
-
MD5
d48955ca5167e1ff4edc24220cf748fa
SHA11799693b6ad300108a9837f19cd8971c1d465d54
SHA2564e45444bb7ab4263d593db5c5db19330a874c555dc577df03efa505e94f0ff77
SHA5127ea22068cdb12b72b11daa0e91996520e2147279842a95a81d18cad34247b58b609cef6cc00ca9877c6a244c4d27ea0ca3e2697bcc95fb607dab125bc3c098cc
-
MD5
d48955ca5167e1ff4edc24220cf748fa
SHA11799693b6ad300108a9837f19cd8971c1d465d54
SHA2564e45444bb7ab4263d593db5c5db19330a874c555dc577df03efa505e94f0ff77
SHA5127ea22068cdb12b72b11daa0e91996520e2147279842a95a81d18cad34247b58b609cef6cc00ca9877c6a244c4d27ea0ca3e2697bcc95fb607dab125bc3c098cc
-
MD5
d48955ca5167e1ff4edc24220cf748fa
SHA11799693b6ad300108a9837f19cd8971c1d465d54
SHA2564e45444bb7ab4263d593db5c5db19330a874c555dc577df03efa505e94f0ff77
SHA5127ea22068cdb12b72b11daa0e91996520e2147279842a95a81d18cad34247b58b609cef6cc00ca9877c6a244c4d27ea0ca3e2697bcc95fb607dab125bc3c098cc
-
MD5
d48955ca5167e1ff4edc24220cf748fa
SHA11799693b6ad300108a9837f19cd8971c1d465d54
SHA2564e45444bb7ab4263d593db5c5db19330a874c555dc577df03efa505e94f0ff77
SHA5127ea22068cdb12b72b11daa0e91996520e2147279842a95a81d18cad34247b58b609cef6cc00ca9877c6a244c4d27ea0ca3e2697bcc95fb607dab125bc3c098cc
-
MD5
d48955ca5167e1ff4edc24220cf748fa
SHA11799693b6ad300108a9837f19cd8971c1d465d54
SHA2564e45444bb7ab4263d593db5c5db19330a874c555dc577df03efa505e94f0ff77
SHA5127ea22068cdb12b72b11daa0e91996520e2147279842a95a81d18cad34247b58b609cef6cc00ca9877c6a244c4d27ea0ca3e2697bcc95fb607dab125bc3c098cc
-
MD5
d48955ca5167e1ff4edc24220cf748fa
SHA11799693b6ad300108a9837f19cd8971c1d465d54
SHA2564e45444bb7ab4263d593db5c5db19330a874c555dc577df03efa505e94f0ff77
SHA5127ea22068cdb12b72b11daa0e91996520e2147279842a95a81d18cad34247b58b609cef6cc00ca9877c6a244c4d27ea0ca3e2697bcc95fb607dab125bc3c098cc
-
MD5
151decc0fb08687834d6335729c4fd93
SHA1ce8d50e1869b3b26ed9051c17c262af747c7c7b3
SHA256742a83c76ea9ae304f6425bd84d175bfdfec7c74e946b8a7aea456b0672e7bb6
SHA5121483fea7c1181a38b35688d5cd08051a386f49994b957cf3248936b2cb2c43819a0975c16a60544e925a9db969f0017adcabfc2c7383b8fdd5529357c88d6ace
-
MD5
151decc0fb08687834d6335729c4fd93
SHA1ce8d50e1869b3b26ed9051c17c262af747c7c7b3
SHA256742a83c76ea9ae304f6425bd84d175bfdfec7c74e946b8a7aea456b0672e7bb6
SHA5121483fea7c1181a38b35688d5cd08051a386f49994b957cf3248936b2cb2c43819a0975c16a60544e925a9db969f0017adcabfc2c7383b8fdd5529357c88d6ace
-
MD5
151decc0fb08687834d6335729c4fd93
SHA1ce8d50e1869b3b26ed9051c17c262af747c7c7b3
SHA256742a83c76ea9ae304f6425bd84d175bfdfec7c74e946b8a7aea456b0672e7bb6
SHA5121483fea7c1181a38b35688d5cd08051a386f49994b957cf3248936b2cb2c43819a0975c16a60544e925a9db969f0017adcabfc2c7383b8fdd5529357c88d6ace
-
MD5
ba5bcacdd2930de8898da02eb76bd9d1
SHA12d6cdd794b651a92753113b58139957635efea7c
SHA256a59a10879e0a2db88c6ea80f31a85962b7e4e89b6e2c4d4cac459b1580422b78
SHA512b46fb1ee60d7c22bd943462fcd5107645189b509dc564f4e1a0b6b5f04ef7a42aeaad117f217f4f3096baa09beb953eb65a7588a9ba432a3632d3fe35edf8a27
-
MD5
ba5bcacdd2930de8898da02eb76bd9d1
SHA12d6cdd794b651a92753113b58139957635efea7c
SHA256a59a10879e0a2db88c6ea80f31a85962b7e4e89b6e2c4d4cac459b1580422b78
SHA512b46fb1ee60d7c22bd943462fcd5107645189b509dc564f4e1a0b6b5f04ef7a42aeaad117f217f4f3096baa09beb953eb65a7588a9ba432a3632d3fe35edf8a27
-
MD5
ba5bcacdd2930de8898da02eb76bd9d1
SHA12d6cdd794b651a92753113b58139957635efea7c
SHA256a59a10879e0a2db88c6ea80f31a85962b7e4e89b6e2c4d4cac459b1580422b78
SHA512b46fb1ee60d7c22bd943462fcd5107645189b509dc564f4e1a0b6b5f04ef7a42aeaad117f217f4f3096baa09beb953eb65a7588a9ba432a3632d3fe35edf8a27