Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
10-03-2021 16:56
Static task
static1
Behavioral task
behavioral1
Sample
638127191.exe
Resource
win7v20201028
General
-
Target
638127191.exe
-
Size
256KB
-
MD5
5c9e61f7399d08070ee86d8796b4b126
-
SHA1
12e16e5c06ae479d216975ac63ac6a935ec9b189
-
SHA256
23861faf3ed06c8f76c905f6d592e3aacd4adfb0a63a3af08f94aa42c1a3f57f
-
SHA512
bc5243e325e9c57b743bf1919b84bff709387554b2f028a37aefcfa7b0e8f61c3265666d5a99e7fc24c5cae85ed7240f6856b70e70bd3c28d236edcb7fcc4226
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1608-48-0x0000000000400000-0x0000000000426000-memory.dmp family_redline behavioral1/memory/1608-49-0x000000000041E192-mapping.dmp family_redline behavioral1/memory/1608-52-0x0000000000400000-0x0000000000426000-memory.dmp family_redline -
Executes dropped EXE 3 IoCs
Processes:
794066702.exe1712476341.exe1712476341.exepid process 1000 794066702.exe 788 1712476341.exe 1608 1712476341.exe -
Loads dropped DLL 16 IoCs
Processes:
638127191.exeWerFault.exe1712476341.exeWerFault.exepid process 1340 638127191.exe 1340 638127191.exe 1340 638127191.exe 384 WerFault.exe 384 WerFault.exe 384 WerFault.exe 384 WerFault.exe 384 WerFault.exe 384 WerFault.exe 384 WerFault.exe 788 1712476341.exe 900 WerFault.exe 900 WerFault.exe 900 WerFault.exe 900 WerFault.exe 900 WerFault.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
1712476341.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths 1712476341.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions 1712476341.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\1712476341.exe = "0" 1712476341.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
1712476341.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 1712476341.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1712476341.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs
Processes:
1712476341.exepid process 788 1712476341.exe 788 1712476341.exe 788 1712476341.exe 788 1712476341.exe 788 1712476341.exe 788 1712476341.exe 788 1712476341.exe 788 1712476341.exe 788 1712476341.exe 788 1712476341.exe 788 1712476341.exe 788 1712476341.exe 788 1712476341.exe 788 1712476341.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1712476341.exedescription pid process target process PID 788 set thread context of 1608 788 1712476341.exe 1712476341.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 384 1000 WerFault.exe 794066702.exe 900 788 WerFault.exe 1712476341.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1392 timeout.exe -
Processes:
638127191.exe1712476341.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 638127191.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 638127191.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 1712476341.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 1712476341.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 1712476341.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 1712476341.exe -
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
WerFault.exepowershell.exe1712476341.exeWerFault.exe1712476341.exepid process 384 WerFault.exe 384 WerFault.exe 384 WerFault.exe 384 WerFault.exe 384 WerFault.exe 1112 powershell.exe 788 1712476341.exe 788 1712476341.exe 788 1712476341.exe 1112 powershell.exe 900 WerFault.exe 900 WerFault.exe 900 WerFault.exe 900 WerFault.exe 900 WerFault.exe 1608 1712476341.exe 1608 1712476341.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
WerFault.exepid process 384 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
638127191.exeWerFault.exe1712476341.exepowershell.exeWerFault.exe1712476341.exedescription pid process Token: SeDebugPrivilege 1340 638127191.exe Token: SeDebugPrivilege 384 WerFault.exe Token: SeDebugPrivilege 788 1712476341.exe Token: SeDebugPrivilege 1112 powershell.exe Token: SeDebugPrivilege 900 WerFault.exe Token: SeDebugPrivilege 1608 1712476341.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
638127191.exe794066702.exe1712476341.execmd.exedescription pid process target process PID 1340 wrote to memory of 1000 1340 638127191.exe 794066702.exe PID 1340 wrote to memory of 1000 1340 638127191.exe 794066702.exe PID 1340 wrote to memory of 1000 1340 638127191.exe 794066702.exe PID 1340 wrote to memory of 1000 1340 638127191.exe 794066702.exe PID 1000 wrote to memory of 384 1000 794066702.exe WerFault.exe PID 1000 wrote to memory of 384 1000 794066702.exe WerFault.exe PID 1000 wrote to memory of 384 1000 794066702.exe WerFault.exe PID 1000 wrote to memory of 384 1000 794066702.exe WerFault.exe PID 1340 wrote to memory of 788 1340 638127191.exe 1712476341.exe PID 1340 wrote to memory of 788 1340 638127191.exe 1712476341.exe PID 1340 wrote to memory of 788 1340 638127191.exe 1712476341.exe PID 1340 wrote to memory of 788 1340 638127191.exe 1712476341.exe PID 788 wrote to memory of 1112 788 1712476341.exe powershell.exe PID 788 wrote to memory of 1112 788 1712476341.exe powershell.exe PID 788 wrote to memory of 1112 788 1712476341.exe powershell.exe PID 788 wrote to memory of 1112 788 1712476341.exe powershell.exe PID 788 wrote to memory of 1656 788 1712476341.exe cmd.exe PID 788 wrote to memory of 1656 788 1712476341.exe cmd.exe PID 788 wrote to memory of 1656 788 1712476341.exe cmd.exe PID 788 wrote to memory of 1656 788 1712476341.exe cmd.exe PID 1656 wrote to memory of 1392 1656 cmd.exe timeout.exe PID 1656 wrote to memory of 1392 1656 cmd.exe timeout.exe PID 1656 wrote to memory of 1392 1656 cmd.exe timeout.exe PID 1656 wrote to memory of 1392 1656 cmd.exe timeout.exe PID 788 wrote to memory of 1608 788 1712476341.exe 1712476341.exe PID 788 wrote to memory of 1608 788 1712476341.exe 1712476341.exe PID 788 wrote to memory of 1608 788 1712476341.exe 1712476341.exe PID 788 wrote to memory of 1608 788 1712476341.exe 1712476341.exe PID 788 wrote to memory of 1608 788 1712476341.exe 1712476341.exe PID 788 wrote to memory of 1608 788 1712476341.exe 1712476341.exe PID 788 wrote to memory of 1608 788 1712476341.exe 1712476341.exe PID 788 wrote to memory of 1608 788 1712476341.exe 1712476341.exe PID 788 wrote to memory of 1608 788 1712476341.exe 1712476341.exe PID 788 wrote to memory of 900 788 1712476341.exe WerFault.exe PID 788 wrote to memory of 900 788 1712476341.exe WerFault.exe PID 788 wrote to memory of 900 788 1712476341.exe WerFault.exe PID 788 wrote to memory of 900 788 1712476341.exe WerFault.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
1712476341.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1712476341.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\638127191.exe"C:\Users\Admin\AppData\Local\Temp\638127191.exe"1⤵
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\794066702.exe"C:\Users\Admin\AppData\Local\Temp\794066702.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 883⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1712476341.exe"C:\Users\Admin\AppData\Local\Temp\1712476341.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1712476341.exe" -Force3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 14⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\1712476341.exe"C:\Users\Admin\AppData\Local\Temp\1712476341.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 788 -s 17723⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1712476341.exeMD5
0230b090e69b97194d25a53f2d5514eb
SHA1ac76b29802d240f721fb09adff57950f32989fb7
SHA2561b51a62c1d975227247671411dfa82b3521e82eeaa665e420e81e1f8bf0616f7
SHA5124f907e2624cf9c87c8d5aae709329f20cd59077ba370ba7b581100aa980cb9a92186b4f8436568bb0b8d1ef3551b514c967febdf2f717f3be718a8bc39035907
-
C:\Users\Admin\AppData\Local\Temp\1712476341.exeMD5
0230b090e69b97194d25a53f2d5514eb
SHA1ac76b29802d240f721fb09adff57950f32989fb7
SHA2561b51a62c1d975227247671411dfa82b3521e82eeaa665e420e81e1f8bf0616f7
SHA5124f907e2624cf9c87c8d5aae709329f20cd59077ba370ba7b581100aa980cb9a92186b4f8436568bb0b8d1ef3551b514c967febdf2f717f3be718a8bc39035907
-
C:\Users\Admin\AppData\Local\Temp\1712476341.exeMD5
0230b090e69b97194d25a53f2d5514eb
SHA1ac76b29802d240f721fb09adff57950f32989fb7
SHA2561b51a62c1d975227247671411dfa82b3521e82eeaa665e420e81e1f8bf0616f7
SHA5124f907e2624cf9c87c8d5aae709329f20cd59077ba370ba7b581100aa980cb9a92186b4f8436568bb0b8d1ef3551b514c967febdf2f717f3be718a8bc39035907
-
C:\Users\Admin\AppData\Local\Temp\794066702.exeMD5
58f807333c6bf89503690d4ac187a596
SHA16835874207df9383886662a5f0378e0d760c1a94
SHA25618b2fb824c91d5901e2b6a2515b62de3b7b541353c5b2c79709505bc477b7b1a
SHA5120eba783fdebe3c6ec2fa58cc196c23f407eddcc617d0a2904fb484efd148fba1c1aed7e3533b0c9927e192aab508ae36e5e2d4d3519b3a677cb15ca64ad71cb4
-
C:\Users\Admin\AppData\Local\Temp\794066702.exeMD5
58f807333c6bf89503690d4ac187a596
SHA16835874207df9383886662a5f0378e0d760c1a94
SHA25618b2fb824c91d5901e2b6a2515b62de3b7b541353c5b2c79709505bc477b7b1a
SHA5120eba783fdebe3c6ec2fa58cc196c23f407eddcc617d0a2904fb484efd148fba1c1aed7e3533b0c9927e192aab508ae36e5e2d4d3519b3a677cb15ca64ad71cb4
-
\Users\Admin\AppData\Local\Temp\1712476341.exeMD5
0230b090e69b97194d25a53f2d5514eb
SHA1ac76b29802d240f721fb09adff57950f32989fb7
SHA2561b51a62c1d975227247671411dfa82b3521e82eeaa665e420e81e1f8bf0616f7
SHA5124f907e2624cf9c87c8d5aae709329f20cd59077ba370ba7b581100aa980cb9a92186b4f8436568bb0b8d1ef3551b514c967febdf2f717f3be718a8bc39035907
-
\Users\Admin\AppData\Local\Temp\1712476341.exeMD5
0230b090e69b97194d25a53f2d5514eb
SHA1ac76b29802d240f721fb09adff57950f32989fb7
SHA2561b51a62c1d975227247671411dfa82b3521e82eeaa665e420e81e1f8bf0616f7
SHA5124f907e2624cf9c87c8d5aae709329f20cd59077ba370ba7b581100aa980cb9a92186b4f8436568bb0b8d1ef3551b514c967febdf2f717f3be718a8bc39035907
-
\Users\Admin\AppData\Local\Temp\1712476341.exeMD5
0230b090e69b97194d25a53f2d5514eb
SHA1ac76b29802d240f721fb09adff57950f32989fb7
SHA2561b51a62c1d975227247671411dfa82b3521e82eeaa665e420e81e1f8bf0616f7
SHA5124f907e2624cf9c87c8d5aae709329f20cd59077ba370ba7b581100aa980cb9a92186b4f8436568bb0b8d1ef3551b514c967febdf2f717f3be718a8bc39035907
-
\Users\Admin\AppData\Local\Temp\1712476341.exeMD5
0230b090e69b97194d25a53f2d5514eb
SHA1ac76b29802d240f721fb09adff57950f32989fb7
SHA2561b51a62c1d975227247671411dfa82b3521e82eeaa665e420e81e1f8bf0616f7
SHA5124f907e2624cf9c87c8d5aae709329f20cd59077ba370ba7b581100aa980cb9a92186b4f8436568bb0b8d1ef3551b514c967febdf2f717f3be718a8bc39035907
-
\Users\Admin\AppData\Local\Temp\1712476341.exeMD5
0230b090e69b97194d25a53f2d5514eb
SHA1ac76b29802d240f721fb09adff57950f32989fb7
SHA2561b51a62c1d975227247671411dfa82b3521e82eeaa665e420e81e1f8bf0616f7
SHA5124f907e2624cf9c87c8d5aae709329f20cd59077ba370ba7b581100aa980cb9a92186b4f8436568bb0b8d1ef3551b514c967febdf2f717f3be718a8bc39035907
-
\Users\Admin\AppData\Local\Temp\1712476341.exeMD5
0230b090e69b97194d25a53f2d5514eb
SHA1ac76b29802d240f721fb09adff57950f32989fb7
SHA2561b51a62c1d975227247671411dfa82b3521e82eeaa665e420e81e1f8bf0616f7
SHA5124f907e2624cf9c87c8d5aae709329f20cd59077ba370ba7b581100aa980cb9a92186b4f8436568bb0b8d1ef3551b514c967febdf2f717f3be718a8bc39035907
-
\Users\Admin\AppData\Local\Temp\1712476341.exeMD5
0230b090e69b97194d25a53f2d5514eb
SHA1ac76b29802d240f721fb09adff57950f32989fb7
SHA2561b51a62c1d975227247671411dfa82b3521e82eeaa665e420e81e1f8bf0616f7
SHA5124f907e2624cf9c87c8d5aae709329f20cd59077ba370ba7b581100aa980cb9a92186b4f8436568bb0b8d1ef3551b514c967febdf2f717f3be718a8bc39035907
-
\Users\Admin\AppData\Local\Temp\794066702.exeMD5
58f807333c6bf89503690d4ac187a596
SHA16835874207df9383886662a5f0378e0d760c1a94
SHA25618b2fb824c91d5901e2b6a2515b62de3b7b541353c5b2c79709505bc477b7b1a
SHA5120eba783fdebe3c6ec2fa58cc196c23f407eddcc617d0a2904fb484efd148fba1c1aed7e3533b0c9927e192aab508ae36e5e2d4d3519b3a677cb15ca64ad71cb4
-
\Users\Admin\AppData\Local\Temp\794066702.exeMD5
58f807333c6bf89503690d4ac187a596
SHA16835874207df9383886662a5f0378e0d760c1a94
SHA25618b2fb824c91d5901e2b6a2515b62de3b7b541353c5b2c79709505bc477b7b1a
SHA5120eba783fdebe3c6ec2fa58cc196c23f407eddcc617d0a2904fb484efd148fba1c1aed7e3533b0c9927e192aab508ae36e5e2d4d3519b3a677cb15ca64ad71cb4
-
\Users\Admin\AppData\Local\Temp\794066702.exeMD5
58f807333c6bf89503690d4ac187a596
SHA16835874207df9383886662a5f0378e0d760c1a94
SHA25618b2fb824c91d5901e2b6a2515b62de3b7b541353c5b2c79709505bc477b7b1a
SHA5120eba783fdebe3c6ec2fa58cc196c23f407eddcc617d0a2904fb484efd148fba1c1aed7e3533b0c9927e192aab508ae36e5e2d4d3519b3a677cb15ca64ad71cb4
-
\Users\Admin\AppData\Local\Temp\794066702.exeMD5
58f807333c6bf89503690d4ac187a596
SHA16835874207df9383886662a5f0378e0d760c1a94
SHA25618b2fb824c91d5901e2b6a2515b62de3b7b541353c5b2c79709505bc477b7b1a
SHA5120eba783fdebe3c6ec2fa58cc196c23f407eddcc617d0a2904fb484efd148fba1c1aed7e3533b0c9927e192aab508ae36e5e2d4d3519b3a677cb15ca64ad71cb4
-
\Users\Admin\AppData\Local\Temp\794066702.exeMD5
58f807333c6bf89503690d4ac187a596
SHA16835874207df9383886662a5f0378e0d760c1a94
SHA25618b2fb824c91d5901e2b6a2515b62de3b7b541353c5b2c79709505bc477b7b1a
SHA5120eba783fdebe3c6ec2fa58cc196c23f407eddcc617d0a2904fb484efd148fba1c1aed7e3533b0c9927e192aab508ae36e5e2d4d3519b3a677cb15ca64ad71cb4
-
\Users\Admin\AppData\Local\Temp\794066702.exeMD5
58f807333c6bf89503690d4ac187a596
SHA16835874207df9383886662a5f0378e0d760c1a94
SHA25618b2fb824c91d5901e2b6a2515b62de3b7b541353c5b2c79709505bc477b7b1a
SHA5120eba783fdebe3c6ec2fa58cc196c23f407eddcc617d0a2904fb484efd148fba1c1aed7e3533b0c9927e192aab508ae36e5e2d4d3519b3a677cb15ca64ad71cb4
-
\Users\Admin\AppData\Local\Temp\794066702.exeMD5
58f807333c6bf89503690d4ac187a596
SHA16835874207df9383886662a5f0378e0d760c1a94
SHA25618b2fb824c91d5901e2b6a2515b62de3b7b541353c5b2c79709505bc477b7b1a
SHA5120eba783fdebe3c6ec2fa58cc196c23f407eddcc617d0a2904fb484efd148fba1c1aed7e3533b0c9927e192aab508ae36e5e2d4d3519b3a677cb15ca64ad71cb4
-
\Users\Admin\AppData\Local\Temp\794066702.exeMD5
58f807333c6bf89503690d4ac187a596
SHA16835874207df9383886662a5f0378e0d760c1a94
SHA25618b2fb824c91d5901e2b6a2515b62de3b7b541353c5b2c79709505bc477b7b1a
SHA5120eba783fdebe3c6ec2fa58cc196c23f407eddcc617d0a2904fb484efd148fba1c1aed7e3533b0c9927e192aab508ae36e5e2d4d3519b3a677cb15ca64ad71cb4
-
\Users\Admin\AppData\Local\Temp\794066702.exeMD5
58f807333c6bf89503690d4ac187a596
SHA16835874207df9383886662a5f0378e0d760c1a94
SHA25618b2fb824c91d5901e2b6a2515b62de3b7b541353c5b2c79709505bc477b7b1a
SHA5120eba783fdebe3c6ec2fa58cc196c23f407eddcc617d0a2904fb484efd148fba1c1aed7e3533b0c9927e192aab508ae36e5e2d4d3519b3a677cb15ca64ad71cb4
-
memory/384-33-0x00000000025F0000-0x0000000002601000-memory.dmpFilesize
68KB
-
memory/384-35-0x0000000000380000-0x0000000000381000-memory.dmpFilesize
4KB
-
memory/384-20-0x0000000001FF0000-0x0000000002001000-memory.dmpFilesize
68KB
-
memory/384-24-0x0000000001FF0000-0x0000000002001000-memory.dmpFilesize
68KB
-
memory/384-15-0x0000000000000000-mapping.dmp
-
memory/788-36-0x00000000005B0000-0x0000000000646000-memory.dmpFilesize
600KB
-
memory/788-21-0x0000000000A80000-0x0000000000A81000-memory.dmpFilesize
4KB
-
memory/788-32-0x0000000004F40000-0x0000000004F41000-memory.dmpFilesize
4KB
-
memory/788-19-0x0000000073760000-0x0000000073E4E000-memory.dmpFilesize
6.9MB
-
memory/788-16-0x0000000000000000-mapping.dmp
-
memory/900-62-0x00000000007C0000-0x00000000007C1000-memory.dmpFilesize
4KB
-
memory/900-55-0x0000000001F20000-0x0000000001F31000-memory.dmpFilesize
68KB
-
memory/900-54-0x0000000000000000-mapping.dmp
-
memory/1000-12-0x0000000000000000-mapping.dmp
-
memory/1112-41-0x0000000000AB0000-0x0000000000AB1000-memory.dmpFilesize
4KB
-
memory/1112-79-0x0000000006280000-0x0000000006281000-memory.dmpFilesize
4KB
-
memory/1112-95-0x0000000006310000-0x0000000006311000-memory.dmpFilesize
4KB
-
memory/1112-42-0x0000000004960000-0x0000000004961000-memory.dmpFilesize
4KB
-
memory/1112-43-0x0000000004920000-0x0000000004921000-memory.dmpFilesize
4KB
-
memory/1112-44-0x0000000004922000-0x0000000004923000-memory.dmpFilesize
4KB
-
memory/1112-94-0x0000000006300000-0x0000000006301000-memory.dmpFilesize
4KB
-
memory/1112-46-0x0000000001140000-0x0000000001141000-memory.dmpFilesize
4KB
-
memory/1112-80-0x0000000005650000-0x0000000005651000-memory.dmpFilesize
4KB
-
memory/1112-37-0x0000000000000000-mapping.dmp
-
memory/1112-72-0x0000000006120000-0x0000000006121000-memory.dmpFilesize
4KB
-
memory/1112-71-0x000000007EF30000-0x000000007EF31000-memory.dmpFilesize
4KB
-
memory/1112-70-0x00000000060C0000-0x00000000060C1000-memory.dmpFilesize
4KB
-
memory/1112-65-0x0000000005690000-0x0000000005691000-memory.dmpFilesize
4KB
-
memory/1112-38-0x0000000076691000-0x0000000076693000-memory.dmpFilesize
8KB
-
memory/1112-40-0x0000000073760000-0x0000000073E4E000-memory.dmpFilesize
6.9MB
-
memory/1112-61-0x0000000005280000-0x0000000005281000-memory.dmpFilesize
4KB
-
memory/1340-6-0x00000000020F1000-0x00000000020F2000-memory.dmpFilesize
4KB
-
memory/1340-8-0x00000000020F3000-0x00000000020F4000-memory.dmpFilesize
4KB
-
memory/1340-5-0x0000000000550000-0x0000000000559000-memory.dmpFilesize
36KB
-
memory/1340-3-0x0000000074480000-0x0000000074B6E000-memory.dmpFilesize
6.9MB
-
memory/1340-7-0x00000000020F2000-0x00000000020F3000-memory.dmpFilesize
4KB
-
memory/1340-2-0x0000000001E00000-0x0000000001E11000-memory.dmpFilesize
68KB
-
memory/1340-9-0x00000000020F4000-0x00000000020F6000-memory.dmpFilesize
8KB
-
memory/1340-4-0x0000000000350000-0x000000000035A000-memory.dmpFilesize
40KB
-
memory/1392-45-0x0000000000000000-mapping.dmp
-
memory/1608-51-0x0000000073760000-0x0000000073E4E000-memory.dmpFilesize
6.9MB
-
memory/1608-49-0x000000000041E192-mapping.dmp
-
memory/1608-48-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1608-52-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1608-96-0x00000000042D0000-0x00000000042D1000-memory.dmpFilesize
4KB
-
memory/1656-39-0x0000000000000000-mapping.dmp