Overview
overview
10Static
static
10ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
7ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
7ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
6ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
9ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
3ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
7ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
10Resubmissions
24-08-2023 11:16
230824-nda8msdf8z 1005-08-2023 22:52
230805-2tn2bsfa82 1024-07-2023 06:25
230724-g6s6laag35 1022-07-2023 15:57
230722-tee6wabg5w 1020-07-2023 23:19
230720-3bb5gsbf5v 1020-07-2023 23:06
230720-23f23sba63 1003-02-2021 11:43
210203-6bgge2nfan 1022-11-2020 06:42
201122-6x1at779dj 10Analysis
-
max time kernel
1119s -
max time network
1127s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
22-11-2020 06:42
Static task
static1
Behavioral task
behavioral1
Sample
Endermanch@000.exe
Resource
win10v20201028
Behavioral task
behavioral2
Sample
Endermanch@7ev3n.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
Endermanch@AnViPC2009.exe
Resource
win10v20201028
Behavioral task
behavioral4
Sample
Endermanch@Antivirus.exe
Resource
win10v20201028
Behavioral task
behavioral5
Sample
Endermanch@AntivirusPlatinum.exe
Resource
win10v20201028
Behavioral task
behavioral6
Sample
Endermanch@AntivirusPro2017.exe
Resource
win10v20201028
Behavioral task
behavioral7
Sample
Endermanch@BadRabbit.exe
Resource
win10v20201028
Behavioral task
behavioral8
Sample
Endermanch@Birele.exe
Resource
win10v20201028
Behavioral task
behavioral9
Sample
Endermanch@Cerber5.exe
Resource
win10v20201028
Behavioral task
behavioral10
Sample
Endermanch@CleanThis.exe
Resource
win10v20201028
Behavioral task
behavioral11
Sample
Endermanch@ColorBug.exe
Resource
win10v20201028
Behavioral task
behavioral12
Sample
Endermanch@DeriaLock.exe
Resource
win10v20201028
Behavioral task
behavioral13
Sample
Endermanch@Deskbottom.exe
Resource
win10v20201028
Behavioral task
behavioral14
Sample
Endermanch@DesktopPuzzle.exe
Resource
win10v20201028
Behavioral task
behavioral15
Sample
Endermanch@FakeAdwCleaner.exe
Resource
win10v20201028
Behavioral task
behavioral16
Sample
Endermanch@FreeYoutubeDownloader.exe
Resource
win10v20201028
Behavioral task
behavioral17
Sample
Endermanch@HMBlocker.exe
Resource
win10v20201028
Behavioral task
behavioral18
Sample
Endermanch@HappyAntivirus.exe
Resource
win10v20201028
Behavioral task
behavioral19
Sample
Endermanch@Illerka.C.exe
Resource
win10v20201028
Behavioral task
behavioral20
Sample
Endermanch@InternetSecurityGuard.exe
Resource
win10v20201028
Behavioral task
behavioral21
Sample
Endermanch@Koteyka2.exe
Resource
win10v20201028
Behavioral task
behavioral22
Sample
Endermanch@LPS2019.exe
Resource
win10v20201028
Behavioral task
behavioral23
Sample
Endermanch@Movie.mpeg.exe
Resource
win10v20201028
Behavioral task
behavioral24
Sample
Endermanch@NavaShield(1).exe
Resource
win10v20201028
Behavioral task
behavioral25
Sample
Endermanch@NavaShield.exe
Resource
win10v20201028
Behavioral task
behavioral26
Sample
Endermanch@PCDefender.exe
Resource
win10v20201028
Behavioral task
behavioral27
Sample
Endermanch@PCDefenderv2.msi
Resource
win10v20201028
Behavioral task
behavioral28
Sample
Endermanch@PolyRansom.exe
Resource
win10v20201028
Behavioral task
behavioral29
Sample
Endermanch@PowerPoint.exe
Resource
win10v20201028
Behavioral task
behavioral30
Sample
Endermanch@ProgramOverflow.exe
Resource
win10v20201028
Behavioral task
behavioral31
Sample
Endermanch@RegistrySmart.exe
Resource
win10v20201028
Behavioral task
behavioral32
Sample
Endermanch@SE2011.exe
Resource
win10v20201028
Errors
General
-
Target
Endermanch@DeriaLock.exe
-
Size
484KB
-
MD5
0a7b70efba0aa93d4bc0857b87ac2fcb
-
SHA1
01a6c963b2f5f36ff21a1043587dcf921ae5f5cd
-
SHA256
4f5bff64160044d9a769ab277ff85ba954e2a2e182c6da4d0672790cf1d48309
-
SHA512
2033f9637b8d023242c93f54c140dd561592a3380a15a9fdc8ebfa33385ff4fc569d66c846a01b4ac005f0521b3c219e87f4b1ed2a83557f9d95fa066ad25e14
Malware Config
Signatures
-
BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
-
Deletes NTFS Change Journal 2 TTPs
The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.
-
Clears Windows event logs 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
9215.tmppid process 4476 9215.tmp -
Modifies WinLogon to allow AutoLogon 2 TTPs 1 IoCs
Enables rebooting of the machine without requiring login credentials.
Processes:
LogonUI.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoLogonChecked LogonUI.exe -
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
Endermanch@DeriaLock.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\RestoreClose.png.deria Endermanch@DeriaLock.exe -
Drops startup file 1 IoCs
Processes:
Endermanch@DeriaLock.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LOGON.exe Endermanch@DeriaLock.exe -
Drops file in Windows directory 4 IoCs
Processes:
rundll32.exedescription ioc process File created C:\Windows\cscc.dat rundll32.exe File created C:\Windows\dispci.exe rundll32.exe File opened for modification C:\Windows\9215.tmp rundll32.exe File opened for modification C:\Windows\infpub.dat rundll32.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 15 IoCs
Processes:
LogonUI.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe -
Suspicious behavior: EnumeratesProcesses 61759 IoCs
Processes:
Endermanch@DeriaLock.exepid process 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
Processes:
Endermanch@DeriaLock.exerundll32.exe9215.tmpwevtutil.exewevtutil.exewevtutil.exewevtutil.exedescription pid process Token: SeDebugPrivilege 4724 Endermanch@DeriaLock.exe Token: SeShutdownPrivilege 4372 rundll32.exe Token: SeDebugPrivilege 4372 rundll32.exe Token: SeTcbPrivilege 4372 rundll32.exe Token: SeDebugPrivilege 4476 9215.tmp Token: SeSecurityPrivilege 4688 wevtutil.exe Token: SeBackupPrivilege 4688 wevtutil.exe Token: SeSecurityPrivilege 4680 wevtutil.exe Token: SeBackupPrivilege 4680 wevtutil.exe Token: SeSecurityPrivilege 4668 wevtutil.exe Token: SeBackupPrivilege 4668 wevtutil.exe Token: SeSecurityPrivilege 4256 wevtutil.exe Token: SeBackupPrivilege 4256 wevtutil.exe -
Suspicious use of FindShellTrayWindow 44 IoCs
Processes:
Endermanch@DeriaLock.exepid process 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe 4724 Endermanch@DeriaLock.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
LogonUI.exepid process 3748 LogonUI.exe -
Suspicious use of WriteProcessMemory 47 IoCs
Processes:
rundll32.exerundll32.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 4060 wrote to memory of 4372 4060 rundll32.exe rundll32.exe PID 4060 wrote to memory of 4372 4060 rundll32.exe rundll32.exe PID 4060 wrote to memory of 4372 4060 rundll32.exe rundll32.exe PID 4372 wrote to memory of 3104 4372 rundll32.exe cmd.exe PID 4372 wrote to memory of 3104 4372 rundll32.exe cmd.exe PID 4372 wrote to memory of 3104 4372 rundll32.exe cmd.exe PID 3104 wrote to memory of 4444 3104 cmd.exe schtasks.exe PID 3104 wrote to memory of 4444 3104 cmd.exe schtasks.exe PID 3104 wrote to memory of 4444 3104 cmd.exe schtasks.exe PID 4372 wrote to memory of 4432 4372 rundll32.exe cmd.exe PID 4372 wrote to memory of 4432 4372 rundll32.exe cmd.exe PID 4372 wrote to memory of 4432 4372 rundll32.exe cmd.exe PID 4432 wrote to memory of 1584 4432 cmd.exe schtasks.exe PID 4432 wrote to memory of 1584 4432 cmd.exe schtasks.exe PID 4432 wrote to memory of 1584 4432 cmd.exe schtasks.exe PID 4372 wrote to memory of 4520 4372 rundll32.exe cmd.exe PID 4372 wrote to memory of 4520 4372 rundll32.exe cmd.exe PID 4372 wrote to memory of 4520 4372 rundll32.exe cmd.exe PID 4372 wrote to memory of 4476 4372 rundll32.exe 9215.tmp PID 4372 wrote to memory of 4476 4372 rundll32.exe 9215.tmp PID 4520 wrote to memory of 816 4520 cmd.exe schtasks.exe PID 4520 wrote to memory of 816 4520 cmd.exe schtasks.exe PID 4520 wrote to memory of 816 4520 cmd.exe schtasks.exe PID 4372 wrote to memory of 3868 4372 rundll32.exe cmd.exe PID 4372 wrote to memory of 3868 4372 rundll32.exe cmd.exe PID 4372 wrote to memory of 3868 4372 rundll32.exe cmd.exe PID 3868 wrote to memory of 4688 3868 cmd.exe wevtutil.exe PID 3868 wrote to memory of 4688 3868 cmd.exe wevtutil.exe PID 3868 wrote to memory of 4688 3868 cmd.exe wevtutil.exe PID 3868 wrote to memory of 4680 3868 cmd.exe wevtutil.exe PID 3868 wrote to memory of 4680 3868 cmd.exe wevtutil.exe PID 3868 wrote to memory of 4680 3868 cmd.exe wevtutil.exe PID 3868 wrote to memory of 4668 3868 cmd.exe wevtutil.exe PID 3868 wrote to memory of 4668 3868 cmd.exe wevtutil.exe PID 3868 wrote to memory of 4668 3868 cmd.exe wevtutil.exe PID 3868 wrote to memory of 4256 3868 cmd.exe wevtutil.exe PID 3868 wrote to memory of 4256 3868 cmd.exe wevtutil.exe PID 3868 wrote to memory of 4256 3868 cmd.exe wevtutil.exe PID 3868 wrote to memory of 188 3868 cmd.exe fsutil.exe PID 3868 wrote to memory of 188 3868 cmd.exe fsutil.exe PID 3868 wrote to memory of 188 3868 cmd.exe fsutil.exe PID 4372 wrote to memory of 2948 4372 rundll32.exe cmd.exe PID 4372 wrote to memory of 2948 4372 rundll32.exe cmd.exe PID 4372 wrote to memory of 2948 4372 rundll32.exe cmd.exe PID 2948 wrote to memory of 1416 2948 cmd.exe schtasks.exe PID 2948 wrote to memory of 1416 2948 cmd.exe schtasks.exe PID 2948 wrote to memory of 1416 2948 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Endermanch@DeriaLock.exe"C:\Users\Admin\AppData\Local\Temp\Endermanch@DeriaLock.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\infpub.dat",#2 151⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 152⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c schtasks /Delete /F /TN rhaegal3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /F /TN rhaegal4⤵
-
C:\Windows\SysWOW64\cmd.exe/c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 573915960 && exit"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 573915960 && exit"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe/c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 07:02:003⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 07:02:004⤵
- Creates scheduled task(s)
-
C:\Windows\9215.tmp"C:\Windows\9215.tmp" \\.\pipe\{81324A74-2CE2-44E9-86C8-0D3AB20603B4}3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe/c wevtutil cl Setup & wevtutil cl System & wevtutil cl Security & wevtutil cl Application & fsutil usn deletejournal /D C:3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wevtutil.exewevtutil cl Setup4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wevtutil.exewevtutil cl System4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wevtutil.exewevtutil cl Security4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wevtutil.exewevtutil cl Application4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\fsutil.exefsutil usn deletejournal /D C:4⤵
-
C:\Windows\SysWOW64\cmd.exe/c schtasks /Delete /F /TN drogon3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /F /TN drogon4⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3ad2855 /state1:0x41c64e6d1⤵
- Modifies WinLogon to allow AutoLogon
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\9215.tmpMD5
347ac3b6b791054de3e5720a7144a977
SHA1413eba3973a15c1a6429d9f170f3e8287f98c21c
SHA256301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c
SHA5129a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787
-
C:\Windows\9215.tmpMD5
347ac3b6b791054de3e5720a7144a977
SHA1413eba3973a15c1a6429d9f170f3e8287f98c21c
SHA256301b905eb98d8d6bb559c04bbda26628a942b2c4107c07a02e8f753bdcfe347c
SHA5129a399916bc681964af1e1061bc0a8e2926307642557539ad587ce6f9b5ef93bdf1820fe5d7b5ffe5f0bb38e5b4dc6add213ba04048c0c7c264646375fcd01787
-
memory/188-24-0x0000000000000000-mapping.dmp
-
memory/816-18-0x0000000000000000-mapping.dmp
-
memory/1416-26-0x0000000000000000-mapping.dmp
-
memory/1584-13-0x0000000000000000-mapping.dmp
-
memory/2948-25-0x0000000000000000-mapping.dmp
-
memory/3104-10-0x0000000000000000-mapping.dmp
-
memory/3868-19-0x0000000000000000-mapping.dmp
-
memory/4256-23-0x0000000000000000-mapping.dmp
-
memory/4372-9-0x0000000002D30000-0x0000000002D98000-memory.dmpFilesize
416KB
-
memory/4372-8-0x0000000000000000-mapping.dmp
-
memory/4432-12-0x0000000000000000-mapping.dmp
-
memory/4444-11-0x0000000000000000-mapping.dmp
-
memory/4476-15-0x0000000000000000-mapping.dmp
-
memory/4520-14-0x0000000000000000-mapping.dmp
-
memory/4668-22-0x0000000000000000-mapping.dmp
-
memory/4680-21-0x0000000000000000-mapping.dmp
-
memory/4688-20-0x0000000000000000-mapping.dmp
-
memory/4724-5-0x0000000005110000-0x0000000005111000-memory.dmpFilesize
4KB
-
memory/4724-0-0x0000000073530000-0x0000000073C1E000-memory.dmpFilesize
6.9MB
-
memory/4724-6-0x0000000004FA0000-0x0000000004FA1000-memory.dmpFilesize
4KB
-
memory/4724-7-0x00000000052D0000-0x00000000052D1000-memory.dmpFilesize
4KB
-
memory/4724-4-0x0000000005610000-0x0000000005611000-memory.dmpFilesize
4KB
-
memory/4724-3-0x0000000005070000-0x0000000005071000-memory.dmpFilesize
4KB
-
memory/4724-1-0x0000000000710000-0x0000000000711000-memory.dmpFilesize
4KB