Analysis
-
max time kernel
88s -
max time network
14s -
platform
windows7_x64 -
resource
win7v200722 -
submitted
20-09-2020 03:47
Static task
static1
Behavioral task
behavioral1
Sample
d5f9fa1a8dca5319432f51a5891f7794.exe
Resource
win7v200722
Behavioral task
behavioral2
Sample
d5f9fa1a8dca5319432f51a5891f7794.exe
Resource
win10
General
-
Target
d5f9fa1a8dca5319432f51a5891f7794.exe
-
Size
7.1MB
-
MD5
d5f9fa1a8dca5319432f51a5891f7794
-
SHA1
2a937328f5b99eccb9b8c13ed71d6ffb9dff4521
-
SHA256
18f4123ee42f5a29f8df7bd1cf95ab73441f082584f390aa218c2dd1134f4055
-
SHA512
87013b63a9b153c5268784928394dfbf1eeff1b91eea6bdf187025e63d25c535e468e59a33f47d23682a386605bb314311e50a7edd1d6deb1b60f5008237a7d0
Malware Config
Signatures
-
Deletes Windows Defender Definitions 2 TTPs 1 IoCs
Uses mpcmdrun utility to delete all AV definitions.
Processes:
mpcmdrun.exepid process 1216 mpcmdrun.exe -
Executes dropped EXE 2 IoCs
Processes:
d5f9fa1a8dca5319432f51a5891f7794.exex64.exepid process 1540 d5f9fa1a8dca5319432f51a5891f7794.exe 1972 x64.exe -
Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
d5f9fa1a8dca5319432f51a5891f7794.exedescription ioc process File created C:\Users\Admin\Pictures\EnterStop.raw.zhen d5f9fa1a8dca5319432f51a5891f7794.exe File created C:\Users\Admin\Pictures\EditRepair.png.zhen d5f9fa1a8dca5319432f51a5891f7794.exe File created C:\Users\Admin\Pictures\PublishUnblock.crw.zhen d5f9fa1a8dca5319432f51a5891f7794.exe File created C:\Users\Admin\Pictures\ResetRepair.raw.zhen d5f9fa1a8dca5319432f51a5891f7794.exe File created C:\Users\Admin\Pictures\WatchEnter.raw.zhen d5f9fa1a8dca5319432f51a5891f7794.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
takeown.exeicacls.exepid process 204 takeown.exe 844 icacls.exe -
Loads dropped DLL 13 IoCs
Processes:
d5f9fa1a8dca5319432f51a5891f7794.exed5f9fa1a8dca5319432f51a5891f7794.exeWerFault.exepid process 1332 d5f9fa1a8dca5319432f51a5891f7794.exe 1332 d5f9fa1a8dca5319432f51a5891f7794.exe 1540 d5f9fa1a8dca5319432f51a5891f7794.exe 1540 d5f9fa1a8dca5319432f51a5891f7794.exe 1540 d5f9fa1a8dca5319432f51a5891f7794.exe 1540 d5f9fa1a8dca5319432f51a5891f7794.exe 1540 d5f9fa1a8dca5319432f51a5891f7794.exe 1540 d5f9fa1a8dca5319432f51a5891f7794.exe 1540 d5f9fa1a8dca5319432f51a5891f7794.exe 1520 WerFault.exe 1520 WerFault.exe 1520 WerFault.exe 1520 WerFault.exe -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
icacls.exetakeown.exepid process 844 icacls.exe 204 takeown.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
d5f9fa1a8dca5319432f51a5891f7794.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\FIMHXB = "\"C:\\ProgramData\\d5f9fa1a8dca5319432f51a5891f7794.exe\" -ui" d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FIMHXB = "\"C:\\ProgramData\\d5f9fa1a8dca5319432f51a5891f7794.exe\" -ui" d5f9fa1a8dca5319432f51a5891f7794.exe -
Modifies service 2 TTPs 5 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
d5f9fa1a8dca5319432f51a5891f7794.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\1.bmp" d5f9fa1a8dca5319432f51a5891f7794.exe -
Drops file in Program Files directory 3934 IoCs
Processes:
d5f9fa1a8dca5319432f51a5891f7794.exedescription ioc process File opened for modification C:\Program Files\7-Zip\Lang\ext.txt d5f9fa1a8dca5319432f51a5891f7794.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_65_ffffff_1x400.png d5f9fa1a8dca5319432f51a5891f7794.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\RSSFeeds.js.zhen d5f9fa1a8dca5319432f51a5891f7794.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\ApothecaryLetter.dotx d5f9fa1a8dca5319432f51a5891f7794.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\PublicFunctions.js d5f9fa1a8dca5319432f51a5891f7794.exe File opened for modification C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\NL.ROGERS.COM.XML d5f9fa1a8dca5319432f51a5891f7794.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\2.png d5f9fa1a8dca5319432f51a5891f7794.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\DataSet.zip d5f9fa1a8dca5319432f51a5891f7794.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Sts.css d5f9fa1a8dca5319432f51a5891f7794.exe File created C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.ES.XML.zhen d5f9fa1a8dca5319432f51a5891f7794.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\about.html.zhen d5f9fa1a8dca5319432f51a5891f7794.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\InformationIcon.jpg d5f9fa1a8dca5319432f51a5891f7794.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0382950.JPG d5f9fa1a8dca5319432f51a5891f7794.exe File created C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0341447.JPG.zhen d5f9fa1a8dca5319432f51a5891f7794.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099188.JPG d5f9fa1a8dca5319432f51a5891f7794.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\NotifierUpArrow.jpg d5f9fa1a8dca5319432f51a5891f7794.exe File created C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\VisualElements\LogoBeta.png.zhen d5f9fa1a8dca5319432f51a5891f7794.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_winxp_olv.css d5f9fa1a8dca5319432f51a5891f7794.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-windows.xml d5f9fa1a8dca5319432f51a5891f7794.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsHomePageStyle.css d5f9fa1a8dca5319432f51a5891f7794.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\ffjcext.zip.zhen d5f9fa1a8dca5319432f51a5891f7794.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\artifacts.xml.zhen d5f9fa1a8dca5319432f51a5891f7794.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-impl.xml d5f9fa1a8dca5319432f51a5891f7794.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Casual.css.zhen d5f9fa1a8dca5319432f51a5891f7794.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\add_down.png.zhen d5f9fa1a8dca5319432f51a5891f7794.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\IMAGE.JPG.zhen d5f9fa1a8dca5319432f51a5891f7794.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099160.JPG d5f9fa1a8dca5319432f51a5891f7794.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0341554.JPG d5f9fa1a8dca5319432f51a5891f7794.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup-impl.xml.zhen d5f9fa1a8dca5319432f51a5891f7794.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm d5f9fa1a8dca5319432f51a5891f7794.exe File created C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL058.XML.zhen d5f9fa1a8dca5319432f51a5891f7794.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-bootstrap.xml d5f9fa1a8dca5319432f51a5891f7794.exe File created C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsPreviewTemplate.html.zhen d5f9fa1a8dca5319432f51a5891f7794.exe File created C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGMN109.XML.zhen d5f9fa1a8dca5319432f51a5891f7794.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\WHITEBOX.JPG d5f9fa1a8dca5319432f51a5891f7794.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\XML Files\StarterNotificationDescriptors.xml d5f9fa1a8dca5319432f51a5891f7794.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-nodes.xml d5f9fa1a8dca5319432f51a5891f7794.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0099168.JPG d5f9fa1a8dca5319432f51a5891f7794.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\SoftBlue.jpg d5f9fa1a8dca5319432f51a5891f7794.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core.xml d5f9fa1a8dca5319432f51a5891f7794.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0387895.JPG d5f9fa1a8dca5319432f51a5891f7794.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\VIEW.JS d5f9fa1a8dca5319432f51a5891f7794.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html d5f9fa1a8dca5319432f51a5891f7794.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\16.png d5f9fa1a8dca5319432f51a5891f7794.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml.zhen d5f9fa1a8dca5319432f51a5891f7794.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-heapwalker.xml.zhen d5f9fa1a8dca5319432f51a5891f7794.exe File opened for modification C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0341645.JPG d5f9fa1a8dca5319432f51a5891f7794.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\pmd.cer d5f9fa1a8dca5319432f51a5891f7794.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\QuickStyles\Perspective.dotx d5f9fa1a8dca5319432f51a5891f7794.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\next_hov.png d5f9fa1a8dca5319432f51a5891f7794.exe File opened for modification C:\Program Files\Microsoft Office\Office14\PUBWIZ\QP.XML d5f9fa1a8dca5319432f51a5891f7794.exe File opened for modification C:\Program Files (x86)\Google\Chrome\Application\84.0.4147.89\VisualElements\SmallLogo.png d5f9fa1a8dca5319432f51a5891f7794.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\license.html d5f9fa1a8dca5319432f51a5891f7794.exe File created C:\Program Files\Microsoft Office\Office14\PUBWIZ\RESUME.XML.zhen d5f9fa1a8dca5319432f51a5891f7794.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt d5f9fa1a8dca5319432f51a5891f7794.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ZoomIcons.jpg d5f9fa1a8dca5319432f51a5891f7794.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-execution.xml d5f9fa1a8dca5319432f51a5891f7794.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-multitabs.xml d5f9fa1a8dca5319432f51a5891f7794.exe File opened for modification C:\Program Files\Microsoft Office\Templates\1033\ExecutiveReport.dotx d5f9fa1a8dca5319432f51a5891f7794.exe File created C:\Program Files\Microsoft Office\CLIPART\PUB60COR\PH02897J.JPG.zhen d5f9fa1a8dca5319432f51a5891f7794.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions.css d5f9fa1a8dca5319432f51a5891f7794.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\UnreadIconImages.jpg d5f9fa1a8dca5319432f51a5891f7794.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\PublicFunctions.js d5f9fa1a8dca5319432f51a5891f7794.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml d5f9fa1a8dca5319432f51a5891f7794.exe -
Drops file in Windows directory 1 IoCs
Processes:
d5f9fa1a8dca5319432f51a5891f7794.exedescription ioc process File opened for modification C:\Windows\Web\Wallpaper\Windows\img0.jpg d5f9fa1a8dca5319432f51a5891f7794.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1520 1972 WerFault.exe x64.exe -
Kills process with taskkill 7 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 208 taskkill.exe 236 taskkill.exe 928 taskkill.exe 1216 taskkill.exe 1444 taskkill.exe 952 taskkill.exe 2004 taskkill.exe -
Modifies Control Panel 4 IoCs
Processes:
d5f9fa1a8dca5319432f51a5891f7794.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Control Panel\Desktop\TileWallpaper = "0" d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Control Panel\Desktop\WallpaperStyle = "10" d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Control Panel\Desktop\OriginalWallpaper = "C:\\ProgramData\\1.bmp" d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Control Panel\Desktop\ConvertedWallpaper = "C:\\ProgramData\\1.bmp" d5f9fa1a8dca5319432f51a5891f7794.exe -
Modifies data under HKEY_USERS 17 IoCs
Processes:
d5f9fa1a8dca5319432f51a5891f7794.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-19\Control Panel\Desktop\OriginalWallpaper = "C:\\ProgramData\\1.bmp" d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\USER\S-1-5-19\Control Panel\Desktop\ConvertedWallpaper = "C:\\ProgramData\\1.bmp" d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\USER\S-1-5-20\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\1.bmp" d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\ConvertedWallpaper = "C:\\ProgramData\\1.bmp" d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\USER\S-1-5-19\Control Panel\Desktop\WallpaperStyle = "10" d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\USER\S-1-5-19\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\1.bmp" d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run\FIMHXB = "\"C:\\ProgramData\\d5f9fa1a8dca5319432f51a5891f7794.exe\" -ui" d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\USER\S-1-5-19\Control Panel\Desktop\TileWallpaper = "0" d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WallpaperStyle = "10" d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\1.bmp" d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\OriginalWallpaper = "C:\\ProgramData\\1.bmp" d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\USER\S-1-5-20\Control Panel\Desktop\TileWallpaper = "0" d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\USER\S-1-5-20\Control Panel\Desktop\WallpaperStyle = "10" d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\TileWallpaper = "0" d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\USER\S-1-5-20\Control Panel\Desktop\ConvertedWallpaper = "C:\\ProgramData\\1.bmp" d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run\FIMHXB = "\"C:\\ProgramData\\d5f9fa1a8dca5319432f51a5891f7794.exe\" -ui" d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\USER\S-1-5-20\Control Panel\Desktop\OriginalWallpaper = "C:\\ProgramData\\1.bmp" d5f9fa1a8dca5319432f51a5891f7794.exe -
Modifies registry class 81 IoCs
Processes:
d5f9fa1a8dca5319432f51a5891f7794.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\ = "Microsoft Winsock Control 6.0" d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32\ = "C:\\ProgramData\\MSWINSCK.OCX" d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\ = "Microsoft WinSock Control, version 6.0" d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\ = "Microsoft WinSock Control, version 6.0" d5f9fa1a8dca5319432f51a5891f7794.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0 d5f9fa1a8dca5319432f51a5891f7794.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0 d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" d5f9fa1a8dca5319432f51a5891f7794.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib d5f9fa1a8dca5319432f51a5891f7794.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D} d5f9fa1a8dca5319432f51a5891f7794.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Control d5f9fa1a8dca5319432f51a5891f7794.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352} d5f9fa1a8dca5319432f51a5891f7794.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents" d5f9fa1a8dca5319432f51a5891f7794.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID d5f9fa1a8dca5319432f51a5891f7794.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32 d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\ProgramData\\MSWINSCK.OCX" d5f9fa1a8dca5319432f51a5891f7794.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version\ = "1.0" d5f9fa1a8dca5319432f51a5891f7794.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1 d5f9fa1a8dca5319432f51a5891f7794.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" d5f9fa1a8dca5319432f51a5891f7794.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID\ = "MSWinsock.Winsock.1" d5f9fa1a8dca5319432f51a5891f7794.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID d5f9fa1a8dca5319432f51a5891f7794.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl" d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl" d5f9fa1a8dca5319432f51a5891f7794.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D} d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ThreadingModel = "Apartment" d5f9fa1a8dca5319432f51a5891f7794.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS\ = "2" d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}" d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\ = "0" d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\ = "Winsock General Property Page Object" d5f9fa1a8dca5319432f51a5891f7794.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D} d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" d5f9fa1a8dca5319432f51a5891f7794.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib d5f9fa1a8dca5319432f51a5891f7794.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib d5f9fa1a8dca5319432f51a5891f7794.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D} d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents" d5f9fa1a8dca5319432f51a5891f7794.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" d5f9fa1a8dca5319432f51a5891f7794.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version d5f9fa1a8dca5319432f51a5891f7794.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} d5f9fa1a8dca5319432f51a5891f7794.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D} d5f9fa1a8dca5319432f51a5891f7794.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ = "C:\\ProgramData\\MSWINSCK.OCX" d5f9fa1a8dca5319432f51a5891f7794.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1 d5f9fa1a8dca5319432f51a5891f7794.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" d5f9fa1a8dca5319432f51a5891f7794.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D} d5f9fa1a8dca5319432f51a5891f7794.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32 d5f9fa1a8dca5319432f51a5891f7794.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Programmable d5f9fa1a8dca5319432f51a5891f7794.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352} d5f9fa1a8dca5319432f51a5891f7794.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" d5f9fa1a8dca5319432f51a5891f7794.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D} d5f9fa1a8dca5319432f51a5891f7794.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer d5f9fa1a8dca5319432f51a5891f7794.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories d5f9fa1a8dca5319432f51a5891f7794.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352} d5f9fa1a8dca5319432f51a5891f7794.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
d5f9fa1a8dca5319432f51a5891f7794.exex64.exepid process 1540 d5f9fa1a8dca5319432f51a5891f7794.exe 1540 d5f9fa1a8dca5319432f51a5891f7794.exe 1540 d5f9fa1a8dca5319432f51a5891f7794.exe 1540 d5f9fa1a8dca5319432f51a5891f7794.exe 1540 d5f9fa1a8dca5319432f51a5891f7794.exe 1540 d5f9fa1a8dca5319432f51a5891f7794.exe 1540 d5f9fa1a8dca5319432f51a5891f7794.exe 1540 d5f9fa1a8dca5319432f51a5891f7794.exe 1972 x64.exe 1972 x64.exe 1972 x64.exe 1972 x64.exe 1972 x64.exe 1972 x64.exe 1972 x64.exe 1972 x64.exe 1972 x64.exe 1972 x64.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
vssvc.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetakeown.exex64.exedescription pid process Token: SeBackupPrivilege 1572 vssvc.exe Token: SeRestorePrivilege 1572 vssvc.exe Token: SeAuditPrivilege 1572 vssvc.exe Token: SeDebugPrivilege 1216 taskkill.exe Token: SeDebugPrivilege 1444 taskkill.exe Token: SeDebugPrivilege 2004 taskkill.exe Token: SeDebugPrivilege 952 taskkill.exe Token: SeDebugPrivilege 928 taskkill.exe Token: SeDebugPrivilege 236 taskkill.exe Token: SeDebugPrivilege 208 taskkill.exe Token: SeTakeOwnershipPrivilege 204 takeown.exe Token: SeDebugPrivilege 1972 x64.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
d5f9fa1a8dca5319432f51a5891f7794.exed5f9fa1a8dca5319432f51a5891f7794.exepid process 1332 d5f9fa1a8dca5319432f51a5891f7794.exe 1540 d5f9fa1a8dca5319432f51a5891f7794.exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
d5f9fa1a8dca5319432f51a5891f7794.exed5f9fa1a8dca5319432f51a5891f7794.exex64.exedescription pid process target process PID 1332 wrote to memory of 1540 1332 d5f9fa1a8dca5319432f51a5891f7794.exe d5f9fa1a8dca5319432f51a5891f7794.exe PID 1332 wrote to memory of 1540 1332 d5f9fa1a8dca5319432f51a5891f7794.exe d5f9fa1a8dca5319432f51a5891f7794.exe PID 1332 wrote to memory of 1540 1332 d5f9fa1a8dca5319432f51a5891f7794.exe d5f9fa1a8dca5319432f51a5891f7794.exe PID 1332 wrote to memory of 1540 1332 d5f9fa1a8dca5319432f51a5891f7794.exe d5f9fa1a8dca5319432f51a5891f7794.exe PID 1540 wrote to memory of 2004 1540 d5f9fa1a8dca5319432f51a5891f7794.exe taskkill.exe PID 1540 wrote to memory of 2004 1540 d5f9fa1a8dca5319432f51a5891f7794.exe taskkill.exe PID 1540 wrote to memory of 2004 1540 d5f9fa1a8dca5319432f51a5891f7794.exe taskkill.exe PID 1540 wrote to memory of 2004 1540 d5f9fa1a8dca5319432f51a5891f7794.exe taskkill.exe PID 1540 wrote to memory of 208 1540 d5f9fa1a8dca5319432f51a5891f7794.exe taskkill.exe PID 1540 wrote to memory of 208 1540 d5f9fa1a8dca5319432f51a5891f7794.exe taskkill.exe PID 1540 wrote to memory of 208 1540 d5f9fa1a8dca5319432f51a5891f7794.exe taskkill.exe PID 1540 wrote to memory of 208 1540 d5f9fa1a8dca5319432f51a5891f7794.exe taskkill.exe PID 1540 wrote to memory of 236 1540 d5f9fa1a8dca5319432f51a5891f7794.exe taskkill.exe PID 1540 wrote to memory of 236 1540 d5f9fa1a8dca5319432f51a5891f7794.exe taskkill.exe PID 1540 wrote to memory of 236 1540 d5f9fa1a8dca5319432f51a5891f7794.exe taskkill.exe PID 1540 wrote to memory of 236 1540 d5f9fa1a8dca5319432f51a5891f7794.exe taskkill.exe PID 1540 wrote to memory of 928 1540 d5f9fa1a8dca5319432f51a5891f7794.exe taskkill.exe PID 1540 wrote to memory of 928 1540 d5f9fa1a8dca5319432f51a5891f7794.exe taskkill.exe PID 1540 wrote to memory of 928 1540 d5f9fa1a8dca5319432f51a5891f7794.exe taskkill.exe PID 1540 wrote to memory of 928 1540 d5f9fa1a8dca5319432f51a5891f7794.exe taskkill.exe PID 1540 wrote to memory of 1216 1540 d5f9fa1a8dca5319432f51a5891f7794.exe taskkill.exe PID 1540 wrote to memory of 1216 1540 d5f9fa1a8dca5319432f51a5891f7794.exe taskkill.exe PID 1540 wrote to memory of 1216 1540 d5f9fa1a8dca5319432f51a5891f7794.exe taskkill.exe PID 1540 wrote to memory of 1216 1540 d5f9fa1a8dca5319432f51a5891f7794.exe taskkill.exe PID 1540 wrote to memory of 1444 1540 d5f9fa1a8dca5319432f51a5891f7794.exe taskkill.exe PID 1540 wrote to memory of 1444 1540 d5f9fa1a8dca5319432f51a5891f7794.exe taskkill.exe PID 1540 wrote to memory of 1444 1540 d5f9fa1a8dca5319432f51a5891f7794.exe taskkill.exe PID 1540 wrote to memory of 1444 1540 d5f9fa1a8dca5319432f51a5891f7794.exe taskkill.exe PID 1540 wrote to memory of 952 1540 d5f9fa1a8dca5319432f51a5891f7794.exe taskkill.exe PID 1540 wrote to memory of 952 1540 d5f9fa1a8dca5319432f51a5891f7794.exe taskkill.exe PID 1540 wrote to memory of 952 1540 d5f9fa1a8dca5319432f51a5891f7794.exe taskkill.exe PID 1540 wrote to memory of 952 1540 d5f9fa1a8dca5319432f51a5891f7794.exe taskkill.exe PID 1540 wrote to memory of 204 1540 d5f9fa1a8dca5319432f51a5891f7794.exe takeown.exe PID 1540 wrote to memory of 204 1540 d5f9fa1a8dca5319432f51a5891f7794.exe takeown.exe PID 1540 wrote to memory of 204 1540 d5f9fa1a8dca5319432f51a5891f7794.exe takeown.exe PID 1540 wrote to memory of 204 1540 d5f9fa1a8dca5319432f51a5891f7794.exe takeown.exe PID 1540 wrote to memory of 844 1540 d5f9fa1a8dca5319432f51a5891f7794.exe icacls.exe PID 1540 wrote to memory of 844 1540 d5f9fa1a8dca5319432f51a5891f7794.exe icacls.exe PID 1540 wrote to memory of 844 1540 d5f9fa1a8dca5319432f51a5891f7794.exe icacls.exe PID 1540 wrote to memory of 844 1540 d5f9fa1a8dca5319432f51a5891f7794.exe icacls.exe PID 1540 wrote to memory of 1216 1540 d5f9fa1a8dca5319432f51a5891f7794.exe mpcmdrun.exe PID 1540 wrote to memory of 1216 1540 d5f9fa1a8dca5319432f51a5891f7794.exe mpcmdrun.exe PID 1540 wrote to memory of 1216 1540 d5f9fa1a8dca5319432f51a5891f7794.exe mpcmdrun.exe PID 1540 wrote to memory of 1216 1540 d5f9fa1a8dca5319432f51a5891f7794.exe mpcmdrun.exe PID 1540 wrote to memory of 1972 1540 d5f9fa1a8dca5319432f51a5891f7794.exe x64.exe PID 1540 wrote to memory of 1972 1540 d5f9fa1a8dca5319432f51a5891f7794.exe x64.exe PID 1540 wrote to memory of 1972 1540 d5f9fa1a8dca5319432f51a5891f7794.exe x64.exe PID 1540 wrote to memory of 1972 1540 d5f9fa1a8dca5319432f51a5891f7794.exe x64.exe PID 1972 wrote to memory of 1520 1972 x64.exe WerFault.exe PID 1972 wrote to memory of 1520 1972 x64.exe WerFault.exe PID 1972 wrote to memory of 1520 1972 x64.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5f9fa1a8dca5319432f51a5891f7794.exe"C:\Users\Admin\AppData\Local\Temp\d5f9fa1a8dca5319432f51a5891f7794.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\d5f9fa1a8dca5319432f51a5891f7794.exeC:\ProgramData\d5f9fa1a8dca5319432f51a5891f7794.exe2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Loads dropped DLL
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /F /IM MSExchange*3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /F /IM Microsoft*3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /F /IM ora*3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /F /IM tns*3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /F /IM mysql*3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /F /IM sql*3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /F /IM postgres*3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\takeown.exe"C:\Windows\System32\takeown.exe" /F C:\Windows\Web\Wallpaper\Windows\img0.jpg3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" C:\Windows\Web\Wallpaper\Windows\img0.jpg /grant Users:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Program Files\Windows Defender\mpcmdrun.exe"C:\Program Files\Windows Defender\mpcmdrun.exe" -removedefinitions -all3⤵
- Deletes Windows Defender Definitions
-
C:\ProgramData\x64.exeC:\ProgramData\x64.exe 04298718c4ed4c0a282605560f30b8f0::72a50cf6d7d1042c8b2514f9768fa499 cfad00e8748eaea::7e9372bd97ed3aec6 25427320e7f946c9::7c3a5807a37a26a9 39d6c0440ea63b::33854dce8ddd35e877 exit3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1972 -s 5564⤵
- Loads dropped DLL
- Program crash
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\d5f9fa1a8dca5319432f51a5891f7794.exe
-
C:\ProgramData\d5f9fa1a8dca5319432f51a5891f7794.exe
-
C:\ProgramData\x64.exe
-
C:\ProgramData\x64.exe
-
\ProgramData\MSWINSCK.OCX
-
\ProgramData\MSWINSCK.OCX
-
\ProgramData\MSWINSCK.OCX
-
\ProgramData\MSWINSCK.OCX
-
\ProgramData\d5f9fa1a8dca5319432f51a5891f7794.exe
-
\ProgramData\d5f9fa1a8dca5319432f51a5891f7794.exe
-
\ProgramData\d5f9fa1a8dca5319432f51a5891f7794.exe
-
\ProgramData\d5f9fa1a8dca5319432f51a5891f7794.exe
-
\ProgramData\x64.exe
-
\ProgramData\x64.exe
-
\ProgramData\x64.exe
-
\ProgramData\x64.exe
-
\ProgramData\x64.exe
-
memory/204-18-0x0000000000000000-mapping.dmp
-
memory/208-11-0x0000000000000000-mapping.dmp
-
memory/236-12-0x0000000000000000-mapping.dmp
-
memory/844-19-0x0000000000000000-mapping.dmp
-
memory/928-13-0x0000000000000000-mapping.dmp
-
memory/952-16-0x0000000000000000-mapping.dmp
-
memory/1216-24-0x0000000000000000-mapping.dmp
-
memory/1216-14-0x0000000000000000-mapping.dmp
-
memory/1444-15-0x0000000000000000-mapping.dmp
-
memory/1520-28-0x0000000000000000-mapping.dmp
-
memory/1520-29-0x0000000001D60000-0x0000000001D71000-memory.dmpFilesize
68KB
-
memory/1520-34-0x0000000002400000-0x0000000002411000-memory.dmpFilesize
68KB
-
memory/1540-4-0x0000000000000000-mapping.dmp
-
memory/1972-26-0x0000000000000000-mapping.dmp
-
memory/2004-10-0x0000000000000000-mapping.dmp