Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10_x64 -
resource
win10 -
submitted
24-06-2020 13:36
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Generic.mg.d41ebe38df97f83c.32031.exe
Resource
win7v200430
General
-
Target
SecuriteInfo.com.Generic.mg.d41ebe38df97f83c.32031.exe
-
Size
2.6MB
-
MD5
d41ebe38df97f83c16b4326b62f5d6fe
-
SHA1
7ef8c94c8338336c0392f146394987216779f3a4
-
SHA256
3eb54757dbe7d6bbbd686231340a454f3b62ecd67d756084b9369eb74bd0bb2a
-
SHA512
e5635fb574b3d74f85282273812824b02dedc658e27df720bd22c6c736ad0078981f0d9c879928cb0e8ede4c2aec12794675d0aef1c2cb80d18e72dad0daaa66
Malware Config
Extracted
danabot
92.204.160.126
193.34.166.26
93.115.22.159
93.115.22.165
185.227.138.52
37.120.145.243
195.133.147.230
Signatures
-
Danabot x86 payload 10 IoCs
Detection of Danabot x86 payload, mapped in memory during the execution of its loader.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\SECURI~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\SECURI~1.DLL family_danabot \Users\Admin\AppData\Local\Temp\SECURI~1.DLL family_danabot C:\ProgramData\D363B715\8E372931.dll family_danabot \ProgramData\D363B715\8E372931.dll family_danabot \ProgramData\D363B715\8E372931.dll family_danabot \ProgramData\D363B715\8E372931.dll family_danabot \ProgramData\D363B715\8E372931.dll family_danabot \ProgramData\D363B715\8E372931.dll family_danabot -
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 1896 created 2948 1896 WerFault.exe SecuriteInfo.com.Generic.mg.d41ebe38df97f83c.32031.exe -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 4 3532 rundll32.exe -
Executes dropped EXE 2 IoCs
Processes:
winlogon.exeExplorer.EXEpid process 560 winlogon.exe 3020 Explorer.EXE -
Sets DLL path for service in the registry 2 TTPs
-
Sets service image path in registry 2 TTPs
-
Loads dropped DLL 13 IoCs
Processes:
regsvr32.exerundll32.exerundll32.exerundll32.exerundll32.exeRUNDLL32.EXEsvchost.exerundll32.exeRUNDLL32.EXErundll32.exepid process 3476 regsvr32.exe 3532 rundll32.exe 3532 rundll32.exe 2928 rundll32.exe 2708 rundll32.exe 652 rundll32.exe 816 RUNDLL32.EXE 1236 svchost.exe 2332 rundll32.exe 2332 rundll32.exe 3028 RUNDLL32.EXE 4008 rundll32.exe 4008 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
svchost.exedescription ioc process File opened (read-only) \??\Q: svchost.exe File opened (read-only) \??\Y: svchost.exe File opened (read-only) \??\Z: svchost.exe File opened (read-only) \??\A: svchost.exe File opened (read-only) \??\G: svchost.exe File opened (read-only) \??\I: svchost.exe File opened (read-only) \??\J: svchost.exe File opened (read-only) \??\R: svchost.exe File opened (read-only) \??\H: svchost.exe File opened (read-only) \??\L: svchost.exe File opened (read-only) \??\M: svchost.exe File opened (read-only) \??\P: svchost.exe File opened (read-only) \??\O: svchost.exe File opened (read-only) \??\T: svchost.exe File opened (read-only) \??\V: svchost.exe File opened (read-only) \??\W: svchost.exe File opened (read-only) \??\B: svchost.exe File opened (read-only) \??\E: svchost.exe File opened (read-only) \??\F: svchost.exe File opened (read-only) \??\K: svchost.exe File opened (read-only) \??\N: svchost.exe File opened (read-only) \??\S: svchost.exe File opened (read-only) \??\U: svchost.exe File opened (read-only) \??\X: svchost.exe -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1896 2948 WerFault.exe SecuriteInfo.com.Generic.mg.d41ebe38df97f83c.32031.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe -
Modifies data under HKEY_USERS 19 IoCs
Processes:
rundll32.exeRUNDLL32.EXEdescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates RUNDLL32.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer = "127.0.0.1:8080踀" RUNDLL32.EXE Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings RUNDLL32.EXE Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "1" RUNDLL32.EXE Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings RUNDLL32.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\root RUNDLL32.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs RUNDLL32.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "1" RUNDLL32.EXE Set value (str) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer = "127.0.0.1:8080踀" RUNDLL32.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\root rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 RUNDLL32.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs RUNDLL32.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings RUNDLL32.EXE Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "1" RUNDLL32.EXE Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer = "127.0.0.1:8080踀" RUNDLL32.EXE -
Modifies registry class 7 IoCs
Processes:
RUNDLL32.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Software RUNDLL32.EXE Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Software\Microsoft RUNDLL32.EXE Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Software\Microsoft\Windows RUNDLL32.EXE Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Software\Microsoft\Windows\CurrentVersion RUNDLL32.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "1" RUNDLL32.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer = "127.0.0.1:8080踀" RUNDLL32.EXE Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings RUNDLL32.EXE -
Processes:
RUNDLL32.EXEdescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F333A936DE9153B06CD55F23CA553F793324053A\Blob = 030000000100000014000000f333a936de9153b06cd55f23ca553f793324053a02000000010000003c0000001c00000000000000010000002000000000000000000000000100000074006800610077007400650020004600450020002d002000350044000000000020000000010000000703000030820303308201eba003020102021034dd644ae5621eac447947b6eb179fee300d06092a864886f70d01010505003033311730150603550403130e746861777465204645202d203544310b3009060355040a13024e54310b3009060355040b1302454e301e170d3135303632343133343831315a170d3235303632343133343831315a3033311730150603550403130e746861777465204645202d203544310b3009060355040a13024e54310b3009060355040b1302454e30820122300d06092a864886f70d01010105000382010f003082010a0282010100e067a86120a0a063296c507429c1986f598883650bca4b3448564d0d7e325aeb51ae6bb49626cf48f40eb4bec3635a6fac8962023004b8fcabcfd384db68fc1727decf54271db84dd7f0a4aa6a028b63806c35145cf004018a7c7fed26b69a0eb3def420341c28865cc0dff5b3f5f457be4b78162651421cca2434a0f8aabf72761f4c6fb6cb167771c67ec830fb44499596786200136376b155b76d00ed2ffa48353c350c7defca06f7ed516a8b5870027ed6414b820208111ce4b42e98bfeb529fc62a9084896ebf9829aaebfbad9dc78ff53ddf910dea85c49e2de13e1d42574aa31331624c0f7677433539dc5742e41b60c25977ba1e9028db779e32a47d0203010001a3133011300f0603551d130101ff040530030101ff300d06092a864886f70d0101050500038201010027ad7a6c79763172ba3e97218794ebb0575175595b00a712e302d8cfb9a45b779738db6dbbf40dea38083e7affa802a3ea0bba1f59815784130349b510919d5d48e0b39ecf2fb33fa49fa32cc81890313f725f4a68aecbb0de5625b296b75d22247e4ba4fac460a504bdfac0303915dbd95f0ad76c9fe02d61fa06f7b4864cb81ac9b2108c8529daf85c1ca369deb448c9bbccec655744e1af75be2d4e5a9ee482d62d36fe578885f0f546ea570ac1ff2858f7de1bb966b52ac835374de17be0003a00fcd9c30087fccdb5da3992e7b9393609aeabed7808048d88fa2dbe8a0a54f3d08dc18b4dfad186130ac7232e8193b5c6b9557e65258d5fe8fe687e4a4d RUNDLL32.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F333A936DE9153B06CD55F23CA553F793324053A RUNDLL32.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
WerFault.exepowershell.exepowershell.exesvchost.exerundll32.exepid process 1896 WerFault.exe 1896 WerFault.exe 1896 WerFault.exe 1896 WerFault.exe 1896 WerFault.exe 1896 WerFault.exe 1896 WerFault.exe 1896 WerFault.exe 1896 WerFault.exe 1896 WerFault.exe 1896 WerFault.exe 1896 WerFault.exe 1896 WerFault.exe 1204 powershell.exe 1048 powershell.exe 1204 powershell.exe 1236 svchost.exe 1236 svchost.exe 1048 powershell.exe 1204 powershell.exe 2332 rundll32.exe 2332 rundll32.exe 2332 rundll32.exe 2332 rundll32.exe 2332 rundll32.exe 2332 rundll32.exe 2332 rundll32.exe 2332 rundll32.exe 2332 rundll32.exe 2332 rundll32.exe 2332 rundll32.exe 2332 rundll32.exe 2332 rundll32.exe 2332 rundll32.exe 2332 rundll32.exe 2332 rundll32.exe 1048 powershell.exe 2332 rundll32.exe 2332 rundll32.exe 2332 rundll32.exe 2332 rundll32.exe 2332 rundll32.exe 2332 rundll32.exe 2332 rundll32.exe 2332 rundll32.exe 2332 rundll32.exe 2332 rundll32.exe 2332 rundll32.exe 2332 rundll32.exe 2332 rundll32.exe 2332 rundll32.exe 2332 rundll32.exe 2332 rundll32.exe 2332 rundll32.exe 2332 rundll32.exe 2332 rundll32.exe 2332 rundll32.exe 2332 rundll32.exe 2332 rundll32.exe 2332 rundll32.exe 2332 rundll32.exe 1236 svchost.exe 1236 svchost.exe 2332 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 61 IoCs
Processes:
WerFault.exerundll32.exeRUNDLL32.EXEpowershell.exepowershell.exeExplorer.EXEdescription pid process Token: SeRestorePrivilege 1896 WerFault.exe Token: SeBackupPrivilege 1896 WerFault.exe Token: SeDebugPrivilege 1896 WerFault.exe Token: SeDebugPrivilege 652 rundll32.exe Token: SeDebugPrivilege 816 RUNDLL32.EXE Token: SeDebugPrivilege 1204 powershell.exe Token: SeDebugPrivilege 1048 powershell.exe Token: SeIncreaseQuotaPrivilege 1204 powershell.exe Token: SeSecurityPrivilege 1204 powershell.exe Token: SeTakeOwnershipPrivilege 1204 powershell.exe Token: SeLoadDriverPrivilege 1204 powershell.exe Token: SeSystemProfilePrivilege 1204 powershell.exe Token: SeSystemtimePrivilege 1204 powershell.exe Token: SeProfSingleProcessPrivilege 1204 powershell.exe Token: SeIncBasePriorityPrivilege 1204 powershell.exe Token: SeCreatePagefilePrivilege 1204 powershell.exe Token: SeBackupPrivilege 1204 powershell.exe Token: SeRestorePrivilege 1204 powershell.exe Token: SeShutdownPrivilege 1204 powershell.exe Token: SeDebugPrivilege 1204 powershell.exe Token: SeSystemEnvironmentPrivilege 1204 powershell.exe Token: SeRemoteShutdownPrivilege 1204 powershell.exe Token: SeUndockPrivilege 1204 powershell.exe Token: SeManageVolumePrivilege 1204 powershell.exe Token: 33 1204 powershell.exe Token: 34 1204 powershell.exe Token: 35 1204 powershell.exe Token: 36 1204 powershell.exe Token: SeIncreaseQuotaPrivilege 1048 powershell.exe Token: SeSecurityPrivilege 1048 powershell.exe Token: SeTakeOwnershipPrivilege 1048 powershell.exe Token: SeLoadDriverPrivilege 1048 powershell.exe Token: SeSystemProfilePrivilege 1048 powershell.exe Token: SeSystemtimePrivilege 1048 powershell.exe Token: SeProfSingleProcessPrivilege 1048 powershell.exe Token: SeIncBasePriorityPrivilege 1048 powershell.exe Token: SeCreatePagefilePrivilege 1048 powershell.exe Token: SeBackupPrivilege 1048 powershell.exe Token: SeRestorePrivilege 1048 powershell.exe Token: SeShutdownPrivilege 1048 powershell.exe Token: SeDebugPrivilege 1048 powershell.exe Token: SeSystemEnvironmentPrivilege 1048 powershell.exe Token: SeRemoteShutdownPrivilege 1048 powershell.exe Token: SeUndockPrivilege 1048 powershell.exe Token: SeManageVolumePrivilege 1048 powershell.exe Token: 33 1048 powershell.exe Token: 34 1048 powershell.exe Token: 35 1048 powershell.exe Token: 36 1048 powershell.exe Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
Explorer.EXErundll32.exepid process 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 652 rundll32.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
SecuriteInfo.com.Generic.mg.d41ebe38df97f83c.32031.exeregsvr32.exerundll32.exerundll32.exerundll32.exesvchost.exedescription pid process target process PID 2948 wrote to memory of 3476 2948 SecuriteInfo.com.Generic.mg.d41ebe38df97f83c.32031.exe regsvr32.exe PID 2948 wrote to memory of 3476 2948 SecuriteInfo.com.Generic.mg.d41ebe38df97f83c.32031.exe regsvr32.exe PID 2948 wrote to memory of 3476 2948 SecuriteInfo.com.Generic.mg.d41ebe38df97f83c.32031.exe regsvr32.exe PID 3476 wrote to memory of 3532 3476 regsvr32.exe rundll32.exe PID 3476 wrote to memory of 3532 3476 regsvr32.exe rundll32.exe PID 3476 wrote to memory of 3532 3476 regsvr32.exe rundll32.exe PID 3532 wrote to memory of 2928 3532 rundll32.exe rundll32.exe PID 3532 wrote to memory of 2928 3532 rundll32.exe rundll32.exe PID 3532 wrote to memory of 2928 3532 rundll32.exe rundll32.exe PID 2928 wrote to memory of 2708 2928 rundll32.exe rundll32.exe PID 2928 wrote to memory of 2708 2928 rundll32.exe rundll32.exe PID 2708 wrote to memory of 652 2708 rundll32.exe rundll32.exe PID 2708 wrote to memory of 652 2708 rundll32.exe rundll32.exe PID 2708 wrote to memory of 652 2708 rundll32.exe rundll32.exe PID 2708 wrote to memory of 816 2708 rundll32.exe RUNDLL32.EXE PID 2708 wrote to memory of 816 2708 rundll32.exe RUNDLL32.EXE PID 2708 wrote to memory of 1048 2708 rundll32.exe powershell.exe PID 2708 wrote to memory of 1048 2708 rundll32.exe powershell.exe PID 2708 wrote to memory of 1204 2708 rundll32.exe powershell.exe PID 2708 wrote to memory of 1204 2708 rundll32.exe powershell.exe PID 1236 wrote to memory of 2332 1236 svchost.exe rundll32.exe PID 1236 wrote to memory of 2332 1236 svchost.exe rundll32.exe PID 1236 wrote to memory of 2332 1236 svchost.exe rundll32.exe PID 1236 wrote to memory of 560 1236 svchost.exe winlogon.exe PID 1236 wrote to memory of 3028 1236 svchost.exe RUNDLL32.EXE PID 1236 wrote to memory of 3028 1236 svchost.exe RUNDLL32.EXE PID 1236 wrote to memory of 3020 1236 svchost.exe Explorer.EXE PID 1236 wrote to memory of 4008 1236 svchost.exe rundll32.exe PID 1236 wrote to memory of 4008 1236 svchost.exe rundll32.exe PID 1236 wrote to memory of 4008 1236 svchost.exe rundll32.exe
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
- Executes dropped EXE
PID:560
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.d41ebe38df97f83c.32031.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.mg.d41ebe38df97f83c.32031.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL f1 C:\Users\Admin\AppData\Local\Temp\SECURI~1.EXE@29483⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL,f04⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\\rundll32.exe C:\PROGRA~3\D363B715\A6AA2224.dll,f1 C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL@35325⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\system32\rundll32.exeC:\Windows\system32\\rundll32.exe C:\PROGRA~3\D363B715\A6AA2224.dll,f1 C:\Users\Admin\AppData\Local\Temp\SECURI~1.DLL@35326⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\syswow64\rundll32.exeC:\Windows\syswow64\rundll32.exe C:\ProgramData\D363B715\8E372931.dll,f2 F709AA619059A3AAB3E71D0ADA4623727⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:652 -
C:\Windows\system32\RUNDLL32.EXEC:\Windows\system32\RUNDLL32.EXE C:\ProgramData\D363B715\A6AA2224.dll,f2 1FCAAAC36182D72B5B244331A74217017⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:816 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\ProgramData\D363B715\8E372931.dll7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1048 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\ProgramData\D363B715\A6AA2224.dll7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1204 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 4243⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1896
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Windows\syswow64\rundll32.exeC:\Windows\syswow64\rundll32.exe C:\ProgramData\D363B715\8E372931.dll,f32⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2332 -
C:\Windows\system32\RUNDLL32.EXEC:\Windows\system32\RUNDLL32.EXE C:\ProgramData\D363B715\A6AA2224.dll,f72⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Modifies registry class
- Modifies system certificate store
PID:3028 -
C:\Windows\syswow64\rundll32.exeC:\Windows\syswow64\rundll32.exe C:\ProgramData\D363B715\8E372931.dll,f2 E48E292D52AA1264BCBA6B30A9CB21132⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
PID:4008
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
d48955ca5167e1ff4edc24220cf748fa
SHA11799693b6ad300108a9837f19cd8971c1d465d54
SHA2564e45444bb7ab4263d593db5c5db19330a874c555dc577df03efa505e94f0ff77
SHA5127ea22068cdb12b72b11daa0e91996520e2147279842a95a81d18cad34247b58b609cef6cc00ca9877c6a244c4d27ea0ca3e2697bcc95fb607dab125bc3c098cc
-
MD5
1a9a9dc8357bb9db05fbc8f410907710
SHA1532b8b80cd30b8f26e630977a3da25b89f59eecb
SHA256adace364b43df110eca1e0ad1499ff43ff08723417f97c80ff18453bdbd1964c
SHA5126cd668534f141ee5dc81d552d022f7c9930a9afa350ac242191dff2d71fbe1f56bf2a83030c38df50587c8b6f37cd343933c4fdedd2e858599d8ea33d0e48d21
-
MD5
151decc0fb08687834d6335729c4fd93
SHA1ce8d50e1869b3b26ed9051c17c262af747c7c7b3
SHA256742a83c76ea9ae304f6425bd84d175bfdfec7c74e946b8a7aea456b0672e7bb6
SHA5121483fea7c1181a38b35688d5cd08051a386f49994b957cf3248936b2cb2c43819a0975c16a60544e925a9db969f0017adcabfc2c7383b8fdd5529357c88d6ace
-
MD5
f1d28a8a20a74cb6790fd9dd61247606
SHA1c8b0ee7eb5ee711be93d71fc6138c0b7a5e4e5c9
SHA256a2f391620da108aac4e4c6d64644b42f2853aaf9e5dcbe284d1601914dca8501
SHA51271b43c190b5fa07fd7cbed8280b4d617d453713a2eef0b9fd26b1953958fc8b4c22e6bdfadac6567cf40b30375366ccd3a902f38692d14aa8a2034d2691eb2cf
-
MD5
27e76287e4d6531cd12d1915504876a4
SHA1a6b2460565f75f77d510c968821b0052a6f45b40
SHA25605c0ebec7c07b40f5d19d5412b8635b0e05eb79b72351163a2ec98816949f6de
SHA512e3d8f7b8bd3e6b5652d82d70ef989635a06c94bfcc6cf0bc7222e722e6170e493064056e3e667c4108ccebe5a11b55cad211d41e1e2c4f75ab4e6af30316e8a6
-
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\912095c182f40be99820fd0fdfee9564_664a9041-4ac4-46f3-b3dc-87db4d57890e
MD5673019194e1eceaea98d8e440395d732
SHA1e3d37216d9162e80823624d238e659de5d6b0c74
SHA25677c1cdf4948c4d4da4c0c206998f1ea4cc321f16ef42ba6faa507c621ff5d25b
SHA5129b66f2fbe8b0f68b5815ef5b7500a4ae0368a8a79a01b75709ca35b224eb8dfb976f97bbfad0fb2c7498485bb24f08e2cdfbdeae82a75f79bc1c72fa4a5a6b4a
-
MD5
ad5cd538ca58cb28ede39c108acb5785
SHA11ae910026f3dbe90ed025e9e96ead2b5399be877
SHA256c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033
SHA512c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13
-
MD5
7c64241c9b9747b1024efeaf2a446602
SHA1c8dc19d5258baa656e4f25d753bb47356793ca9f
SHA2566e93521cfbbd47c01f537d6df87188feafbd4b7c3d97b5f9f33c130c2d01a101
SHA512a29bc67f2c7e35f4fef9e8cab58d94c8a9b8e8e052378ee52d86f90f5ff55416c3e6b77c97837ae74723fcc51a4c145c9161d66046f4e4afa31d1642a932eb6e
-
MD5
ba5bcacdd2930de8898da02eb76bd9d1
SHA12d6cdd794b651a92753113b58139957635efea7c
SHA256a59a10879e0a2db88c6ea80f31a85962b7e4e89b6e2c4d4cac459b1580422b78
SHA512b46fb1ee60d7c22bd943462fcd5107645189b509dc564f4e1a0b6b5f04ef7a42aeaad117f217f4f3096baa09beb953eb65a7588a9ba432a3632d3fe35edf8a27
-
MD5
d48955ca5167e1ff4edc24220cf748fa
SHA11799693b6ad300108a9837f19cd8971c1d465d54
SHA2564e45444bb7ab4263d593db5c5db19330a874c555dc577df03efa505e94f0ff77
SHA5127ea22068cdb12b72b11daa0e91996520e2147279842a95a81d18cad34247b58b609cef6cc00ca9877c6a244c4d27ea0ca3e2697bcc95fb607dab125bc3c098cc
-
MD5
d48955ca5167e1ff4edc24220cf748fa
SHA11799693b6ad300108a9837f19cd8971c1d465d54
SHA2564e45444bb7ab4263d593db5c5db19330a874c555dc577df03efa505e94f0ff77
SHA5127ea22068cdb12b72b11daa0e91996520e2147279842a95a81d18cad34247b58b609cef6cc00ca9877c6a244c4d27ea0ca3e2697bcc95fb607dab125bc3c098cc
-
MD5
d48955ca5167e1ff4edc24220cf748fa
SHA11799693b6ad300108a9837f19cd8971c1d465d54
SHA2564e45444bb7ab4263d593db5c5db19330a874c555dc577df03efa505e94f0ff77
SHA5127ea22068cdb12b72b11daa0e91996520e2147279842a95a81d18cad34247b58b609cef6cc00ca9877c6a244c4d27ea0ca3e2697bcc95fb607dab125bc3c098cc
-
MD5
d48955ca5167e1ff4edc24220cf748fa
SHA11799693b6ad300108a9837f19cd8971c1d465d54
SHA2564e45444bb7ab4263d593db5c5db19330a874c555dc577df03efa505e94f0ff77
SHA5127ea22068cdb12b72b11daa0e91996520e2147279842a95a81d18cad34247b58b609cef6cc00ca9877c6a244c4d27ea0ca3e2697bcc95fb607dab125bc3c098cc
-
MD5
d48955ca5167e1ff4edc24220cf748fa
SHA11799693b6ad300108a9837f19cd8971c1d465d54
SHA2564e45444bb7ab4263d593db5c5db19330a874c555dc577df03efa505e94f0ff77
SHA5127ea22068cdb12b72b11daa0e91996520e2147279842a95a81d18cad34247b58b609cef6cc00ca9877c6a244c4d27ea0ca3e2697bcc95fb607dab125bc3c098cc
-
MD5
d48955ca5167e1ff4edc24220cf748fa
SHA11799693b6ad300108a9837f19cd8971c1d465d54
SHA2564e45444bb7ab4263d593db5c5db19330a874c555dc577df03efa505e94f0ff77
SHA5127ea22068cdb12b72b11daa0e91996520e2147279842a95a81d18cad34247b58b609cef6cc00ca9877c6a244c4d27ea0ca3e2697bcc95fb607dab125bc3c098cc
-
MD5
d48955ca5167e1ff4edc24220cf748fa
SHA11799693b6ad300108a9837f19cd8971c1d465d54
SHA2564e45444bb7ab4263d593db5c5db19330a874c555dc577df03efa505e94f0ff77
SHA5127ea22068cdb12b72b11daa0e91996520e2147279842a95a81d18cad34247b58b609cef6cc00ca9877c6a244c4d27ea0ca3e2697bcc95fb607dab125bc3c098cc
-
MD5
151decc0fb08687834d6335729c4fd93
SHA1ce8d50e1869b3b26ed9051c17c262af747c7c7b3
SHA256742a83c76ea9ae304f6425bd84d175bfdfec7c74e946b8a7aea456b0672e7bb6
SHA5121483fea7c1181a38b35688d5cd08051a386f49994b957cf3248936b2cb2c43819a0975c16a60544e925a9db969f0017adcabfc2c7383b8fdd5529357c88d6ace
-
MD5
151decc0fb08687834d6335729c4fd93
SHA1ce8d50e1869b3b26ed9051c17c262af747c7c7b3
SHA256742a83c76ea9ae304f6425bd84d175bfdfec7c74e946b8a7aea456b0672e7bb6
SHA5121483fea7c1181a38b35688d5cd08051a386f49994b957cf3248936b2cb2c43819a0975c16a60544e925a9db969f0017adcabfc2c7383b8fdd5529357c88d6ace
-
MD5
151decc0fb08687834d6335729c4fd93
SHA1ce8d50e1869b3b26ed9051c17c262af747c7c7b3
SHA256742a83c76ea9ae304f6425bd84d175bfdfec7c74e946b8a7aea456b0672e7bb6
SHA5121483fea7c1181a38b35688d5cd08051a386f49994b957cf3248936b2cb2c43819a0975c16a60544e925a9db969f0017adcabfc2c7383b8fdd5529357c88d6ace
-
MD5
151decc0fb08687834d6335729c4fd93
SHA1ce8d50e1869b3b26ed9051c17c262af747c7c7b3
SHA256742a83c76ea9ae304f6425bd84d175bfdfec7c74e946b8a7aea456b0672e7bb6
SHA5121483fea7c1181a38b35688d5cd08051a386f49994b957cf3248936b2cb2c43819a0975c16a60544e925a9db969f0017adcabfc2c7383b8fdd5529357c88d6ace
-
MD5
151decc0fb08687834d6335729c4fd93
SHA1ce8d50e1869b3b26ed9051c17c262af747c7c7b3
SHA256742a83c76ea9ae304f6425bd84d175bfdfec7c74e946b8a7aea456b0672e7bb6
SHA5121483fea7c1181a38b35688d5cd08051a386f49994b957cf3248936b2cb2c43819a0975c16a60544e925a9db969f0017adcabfc2c7383b8fdd5529357c88d6ace
-
MD5
ba5bcacdd2930de8898da02eb76bd9d1
SHA12d6cdd794b651a92753113b58139957635efea7c
SHA256a59a10879e0a2db88c6ea80f31a85962b7e4e89b6e2c4d4cac459b1580422b78
SHA512b46fb1ee60d7c22bd943462fcd5107645189b509dc564f4e1a0b6b5f04ef7a42aeaad117f217f4f3096baa09beb953eb65a7588a9ba432a3632d3fe35edf8a27
-
MD5
ba5bcacdd2930de8898da02eb76bd9d1
SHA12d6cdd794b651a92753113b58139957635efea7c
SHA256a59a10879e0a2db88c6ea80f31a85962b7e4e89b6e2c4d4cac459b1580422b78
SHA512b46fb1ee60d7c22bd943462fcd5107645189b509dc564f4e1a0b6b5f04ef7a42aeaad117f217f4f3096baa09beb953eb65a7588a9ba432a3632d3fe35edf8a27
-
MD5
ba5bcacdd2930de8898da02eb76bd9d1
SHA12d6cdd794b651a92753113b58139957635efea7c
SHA256a59a10879e0a2db88c6ea80f31a85962b7e4e89b6e2c4d4cac459b1580422b78
SHA512b46fb1ee60d7c22bd943462fcd5107645189b509dc564f4e1a0b6b5f04ef7a42aeaad117f217f4f3096baa09beb953eb65a7588a9ba432a3632d3fe35edf8a27