Overview
overview
10Static
static
10ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
7ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
7ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
6ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
9ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
3ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
7ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
10Resubmissions
03-07-2024 22:59
240703-2yn7wszhlp 1003-07-2024 16:13
240703-tn93lsyglf 1003-07-2024 16:11
240703-tm84xsyfma 1010-05-2024 16:25
240510-tw1h5shh47 1024-08-2023 11:16
230824-nda8msdf8z 10Analysis
-
max time kernel
338s -
max time network
362s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
22-11-2020 06:42
Static task
static1
Behavioral task
behavioral24
Sample
Endermanch@NavaShield(1).exe
Resource
win10v20201028
General
-
Target
-
Size
313KB
-
MD5
fe1bc60a95b2c2d77cd5d232296a7fa4
-
SHA1
c07dfdea8da2da5bad036e7c2f5d37582e1cf684
-
SHA256
b3e1e9d97d74c416c2a30dd11858789af5554cf2de62f577c13944a19623777d
-
SHA512
266c541a421878e1e175db5d94185c991cec5825a4bc50178f57264f3556080e6fe984ed0380acf022ce659aa1ca46c9a5e97efc25ff46cbfd67b9385fd75f89
Malware Config
Extracted
\??\c:\_R_E_A_D___T_H_I_S___S9T11QD_.txt
cerber
http://xpcx6erilkjced3j.onion/0595-186B-78CE-0098-BEB7
http://xpcx6erilkjced3j.1n5mod.top/0595-186B-78CE-0098-BEB7
http://xpcx6erilkjced3j.19kdeh.top/0595-186B-78CE-0098-BEB7
http://xpcx6erilkjced3j.1mpsnr.top/0595-186B-78CE-0098-BEB7
http://xpcx6erilkjced3j.18ey8e.top/0595-186B-78CE-0098-BEB7
http://xpcx6erilkjced3j.17gcun.top/0595-186B-78CE-0098-BEB7
Extracted
C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___PZECJ_.hta
http://xpcx6erilkjced3j.1n5mod.top/0595-186B-78CE-0098-BEB7http://xpcx6erilkjced3j.19kdeh.top/0595-186B-78CE-0098-BEB7http://xpcx6erilkjced3j.1mpsnr.top/0595-186B-78CE-0098-BEB7http://xpcx6erilkjced3j.18ey8e.top/0595-186B-78CE-0098-BEB7http://xpcx6erilkjced3j.17gcun.top/0595-186B-78CE-0098-BEB7
http://xpcx6erilkjced3j.onion/0595-186B-78CE-0098-BEB7
https://www.baidu.com
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Blacklisted process makes network request 8 IoCs
Processes:
mshta.exeflow pid Process 2199 1152 mshta.exe 2202 1152 mshta.exe 2204 1152 mshta.exe 2206 1152 mshta.exe 2208 1152 mshta.exe 2210 1152 mshta.exe 2212 1152 mshta.exe 2214 1152 mshta.exe -
Modifies Windows Firewall 1 TTPs
-
Drops startup file 1 IoCs
Processes:
description ioc Process File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\word\startup\ [email protected] -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
description ioc Process File opened (read-only) \??\r: [email protected] File opened (read-only) \??\z: [email protected] File opened (read-only) \??\f: [email protected] File opened (read-only) \??\g: [email protected] File opened (read-only) \??\h: [email protected] File opened (read-only) \??\j: [email protected] File opened (read-only) \??\x: [email protected] File opened (read-only) \??\e: [email protected] File opened (read-only) \??\i: [email protected] File opened (read-only) \??\n: [email protected] File opened (read-only) \??\t: [email protected] File opened (read-only) \??\u: [email protected] File opened (read-only) \??\w: [email protected] File opened (read-only) \??\b: [email protected] File opened (read-only) \??\l: [email protected] File opened (read-only) \??\p: [email protected] File opened (read-only) \??\q: [email protected] File opened (read-only) \??\s: [email protected] File opened (read-only) \??\v: [email protected] File opened (read-only) \??\y: [email protected] File opened (read-only) \??\a: [email protected] File opened (read-only) \??\k: [email protected] File opened (read-only) \??\m: [email protected] File opened (read-only) \??\o: [email protected] -
Drops file in System32 directory 38 IoCs
Processes:
description ioc Process File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat! [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat! [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\documents [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\desktop [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook [email protected] File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird [email protected] -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp3CDB.bmp" [email protected] -
Drops file in Program Files directory 20 IoCs
Processes:
description ioc Process File opened for modification \??\c:\program files\ [email protected] File opened for modification \??\c:\program files (x86)\microsoft sql server [email protected] File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server [email protected] File opened for modification \??\c:\program files (x86)\microsoft\office [email protected] File opened for modification \??\c:\program files (x86)\office [email protected] File opened for modification \??\c:\program files (x86)\steam [email protected] File opened for modification \??\c:\program files (x86)\thunderbird [email protected] File opened for modification \??\c:\program files (x86)\microsoft\excel [email protected] File opened for modification \??\c:\program files (x86)\microsoft\outlook [email protected] File opened for modification \??\c:\program files (x86)\microsoft\powerpoint [email protected] File opened for modification \??\c:\program files (x86)\microsoft\word [email protected] File opened for modification \??\c:\program files (x86)\onenote [email protected] File opened for modification \??\c:\program files (x86)\bitcoin [email protected] File opened for modification \??\c:\program files (x86)\excel [email protected] File opened for modification \??\c:\program files (x86)\microsoft\onenote [email protected] File opened for modification \??\c:\program files (x86)\outlook [email protected] File opened for modification \??\c:\program files (x86)\ [email protected] File opened for modification \??\c:\program files (x86)\powerpoint [email protected] File opened for modification \??\c:\program files (x86)\the bat! [email protected] File opened for modification \??\c:\program files (x86)\word [email protected] -
Drops file in Windows directory 77 IoCs
Processes:
description ioc Process File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\word [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\desktop [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\excel [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\office [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\onenote [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\onenote [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat! [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\word [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\steam [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\excel [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\office [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\steam [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\office [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat! [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\onenote [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft sql server [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\word [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\documents [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\desktop [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat! [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\the bat! [email protected] File opened for modification \??\c:\windows\ [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\outlook [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\documents [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server [email protected] File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint [email protected] File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird [email protected] -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid Process 3448 taskkill.exe -
Modifies registry class 1 IoCs
Processes:
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings [email protected] -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid Process 3864 NOTEPAD.EXE -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
[email protected]taskkill.exedescription pid Process Token: SeShutdownPrivilege 1812 [email protected] Token: SeCreatePagefilePrivilege 1812 [email protected] Token: SeDebugPrivilege 3448 taskkill.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
[email protected]cmd.exedescription pid Process procid_target PID 1812 wrote to memory of 3472 1812 [email protected] 75 PID 1812 wrote to memory of 3472 1812 [email protected] 75 PID 1812 wrote to memory of 3472 1812 [email protected] 75 PID 1812 wrote to memory of 776 1812 [email protected] 77 PID 1812 wrote to memory of 776 1812 [email protected] 77 PID 1812 wrote to memory of 776 1812 [email protected] 77 PID 1812 wrote to memory of 1152 1812 [email protected] 83 PID 1812 wrote to memory of 1152 1812 [email protected] 83 PID 1812 wrote to memory of 1152 1812 [email protected] 83 PID 1812 wrote to memory of 3864 1812 [email protected] 84 PID 1812 wrote to memory of 3864 1812 [email protected] 84 PID 1812 wrote to memory of 3864 1812 [email protected] 84 PID 1812 wrote to memory of 3976 1812 [email protected] 87 PID 1812 wrote to memory of 3976 1812 [email protected] 87 PID 1812 wrote to memory of 3976 1812 [email protected] 87 PID 3976 wrote to memory of 3448 3976 cmd.exe 89 PID 3976 wrote to memory of 3448 3976 cmd.exe 89 PID 3976 wrote to memory of 3448 3976 cmd.exe 89 PID 3976 wrote to memory of 804 3976 cmd.exe 91 PID 3976 wrote to memory of 804 3976 cmd.exe 91 PID 3976 wrote to memory of 804 3976 cmd.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\[email protected]"C:\Users\Admin\AppData\Local\Temp\[email protected]"1⤵
- Drops startup file
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall set allprofiles state on2⤵PID:3472
-
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall reset2⤵PID:776
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___PZECJ_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
- Blacklisted process makes network request
PID:1152
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___JYZCQ5C_.txt2⤵
- Opens file in notepad (likely ransom note)
PID:3864
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /d /c taskkill /f /im "E" > NUL & ping -n 1 127.0.0.1 > NUL & del "C" > NUL && exit2⤵
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "E"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3448
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
PID:804
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
afdb155a8a05b501d7d4c3a0fd81609f
SHA1453241a8a70bba95ef75e87e04178213a8095aac
SHA25687246544a7d13160eda0ad4cfb43545f2adeb5ee7a0ec31bbd5e05f0268200c8
SHA5124604b553dfc72145551d9d5cdc22a26505368ff7c97e02437d72b7dd85de1df55f787e4fa5cb410e9d49232c495ac50ef5cc2fe0f56cb678a1cdd01b1a638027
-
MD5
0b827572dae7f3e2a497e79229669bf6
SHA16865512dc34d545106fb1fd038dce5f756d2c750
SHA256c22f964d6930174fa70eb49ea72e343d47d80981fab7a4ac76cf6e8f75b9d2b0
SHA51205e7a6bbb3ee4b81036dd7ba365c01ef1f65c37efe8d73538c204f3f11c6164d1b54723ff747907faf8e374617e52326d32f52978ba7a68a1e92e39036d63025