Analysis
-
max time kernel
26s -
max time network
46s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
29-03-2021 23:26
Static task
static1
Behavioral task
behavioral1
Sample
f3f35dcb69fca49ae55a22812770ecb2.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
f3f35dcb69fca49ae55a22812770ecb2.exe
Resource
win10v20201028
General
-
Target
f3f35dcb69fca49ae55a22812770ecb2.exe
-
Size
774KB
-
MD5
f3f35dcb69fca49ae55a22812770ecb2
-
SHA1
eb8c95dc050978d10c05073b0d5311f86da986ed
-
SHA256
a3d26db7812778043abdf20ad3ff5caf68be3752fcd33de75d1bea8f515ed3d2
-
SHA512
098d6f2f768811004ef87b51074fbbd9d36ee483cce637efe1f97dae0bec1bcc7c37e737d9ddb082cd1870c7c0952b334b4dbd07a7eb2b293b7a2646a7e10632
Malware Config
Signatures
-
Taurus Stealer
Taurus is an infostealer first seen in June 2020.
-
Executes dropped EXE 2 IoCs
Processes:
updatewin.exe5.exepid process 1072 updatewin.exe 1824 5.exe -
Loads dropped DLL 10 IoCs
Processes:
f3f35dcb69fca49ae55a22812770ecb2.exeupdatewin.exe5.exepid process 1544 f3f35dcb69fca49ae55a22812770ecb2.exe 1072 updatewin.exe 1072 updatewin.exe 1072 updatewin.exe 1544 f3f35dcb69fca49ae55a22812770ecb2.exe 1544 f3f35dcb69fca49ae55a22812770ecb2.exe 1824 5.exe 1824 5.exe 1824 5.exe 1824 5.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
f3f35dcb69fca49ae55a22812770ecb2.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\82785e4e-ba27-410e-8328-ec4c4cc925e7\\f3f35dcb69fca49ae55a22812770ecb2.exe\" --AutoStart" f3f35dcb69fca49ae55a22812770ecb2.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 api.2ip.ua 7 api.2ip.ua 15 api.2ip.ua -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
5.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 5.exe -
Delays execution with timeout.exe 2 IoCs
Processes:
timeout.exetimeout.exepid process 1380 timeout.exe 1240 timeout.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1484 taskkill.exe -
Processes:
5.exef3f35dcb69fca49ae55a22812770ecb2.exef3f35dcb69fca49ae55a22812770ecb2.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 5.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde 5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 f3f35dcb69fca49ae55a22812770ecb2.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e f3f35dcb69fca49ae55a22812770ecb2.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e f3f35dcb69fca49ae55a22812770ecb2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 f3f35dcb69fca49ae55a22812770ecb2.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e f3f35dcb69fca49ae55a22812770ecb2.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
f3f35dcb69fca49ae55a22812770ecb2.exef3f35dcb69fca49ae55a22812770ecb2.exe5.exepid process 1044 f3f35dcb69fca49ae55a22812770ecb2.exe 1044 f3f35dcb69fca49ae55a22812770ecb2.exe 1544 f3f35dcb69fca49ae55a22812770ecb2.exe 1544 f3f35dcb69fca49ae55a22812770ecb2.exe 1824 5.exe 1824 5.exe 1824 5.exe 1824 5.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
updatewin.exetaskkill.exedescription pid process Token: SeRestorePrivilege 1072 updatewin.exe Token: SeBackupPrivilege 1072 updatewin.exe Token: SeDebugPrivilege 1484 taskkill.exe -
Suspicious use of WriteProcessMemory 45 IoCs
Processes:
f3f35dcb69fca49ae55a22812770ecb2.exef3f35dcb69fca49ae55a22812770ecb2.exeupdatewin.execmd.exe5.execmd.exedescription pid process target process PID 1044 wrote to memory of 532 1044 f3f35dcb69fca49ae55a22812770ecb2.exe icacls.exe PID 1044 wrote to memory of 532 1044 f3f35dcb69fca49ae55a22812770ecb2.exe icacls.exe PID 1044 wrote to memory of 532 1044 f3f35dcb69fca49ae55a22812770ecb2.exe icacls.exe PID 1044 wrote to memory of 532 1044 f3f35dcb69fca49ae55a22812770ecb2.exe icacls.exe PID 1044 wrote to memory of 1544 1044 f3f35dcb69fca49ae55a22812770ecb2.exe f3f35dcb69fca49ae55a22812770ecb2.exe PID 1044 wrote to memory of 1544 1044 f3f35dcb69fca49ae55a22812770ecb2.exe f3f35dcb69fca49ae55a22812770ecb2.exe PID 1044 wrote to memory of 1544 1044 f3f35dcb69fca49ae55a22812770ecb2.exe f3f35dcb69fca49ae55a22812770ecb2.exe PID 1044 wrote to memory of 1544 1044 f3f35dcb69fca49ae55a22812770ecb2.exe f3f35dcb69fca49ae55a22812770ecb2.exe PID 1544 wrote to memory of 1072 1544 f3f35dcb69fca49ae55a22812770ecb2.exe updatewin.exe PID 1544 wrote to memory of 1072 1544 f3f35dcb69fca49ae55a22812770ecb2.exe updatewin.exe PID 1544 wrote to memory of 1072 1544 f3f35dcb69fca49ae55a22812770ecb2.exe updatewin.exe PID 1544 wrote to memory of 1072 1544 f3f35dcb69fca49ae55a22812770ecb2.exe updatewin.exe PID 1544 wrote to memory of 1072 1544 f3f35dcb69fca49ae55a22812770ecb2.exe updatewin.exe PID 1544 wrote to memory of 1072 1544 f3f35dcb69fca49ae55a22812770ecb2.exe updatewin.exe PID 1544 wrote to memory of 1072 1544 f3f35dcb69fca49ae55a22812770ecb2.exe updatewin.exe PID 1544 wrote to memory of 1824 1544 f3f35dcb69fca49ae55a22812770ecb2.exe 5.exe PID 1544 wrote to memory of 1824 1544 f3f35dcb69fca49ae55a22812770ecb2.exe 5.exe PID 1544 wrote to memory of 1824 1544 f3f35dcb69fca49ae55a22812770ecb2.exe 5.exe PID 1544 wrote to memory of 1824 1544 f3f35dcb69fca49ae55a22812770ecb2.exe 5.exe PID 1072 wrote to memory of 1476 1072 updatewin.exe cmd.exe PID 1072 wrote to memory of 1476 1072 updatewin.exe cmd.exe PID 1072 wrote to memory of 1476 1072 updatewin.exe cmd.exe PID 1072 wrote to memory of 1476 1072 updatewin.exe cmd.exe PID 1072 wrote to memory of 1476 1072 updatewin.exe cmd.exe PID 1072 wrote to memory of 1476 1072 updatewin.exe cmd.exe PID 1072 wrote to memory of 1476 1072 updatewin.exe cmd.exe PID 1476 wrote to memory of 1380 1476 cmd.exe timeout.exe PID 1476 wrote to memory of 1380 1476 cmd.exe timeout.exe PID 1476 wrote to memory of 1380 1476 cmd.exe timeout.exe PID 1476 wrote to memory of 1380 1476 cmd.exe timeout.exe PID 1476 wrote to memory of 1380 1476 cmd.exe timeout.exe PID 1476 wrote to memory of 1380 1476 cmd.exe timeout.exe PID 1476 wrote to memory of 1380 1476 cmd.exe timeout.exe PID 1824 wrote to memory of 964 1824 5.exe cmd.exe PID 1824 wrote to memory of 964 1824 5.exe cmd.exe PID 1824 wrote to memory of 964 1824 5.exe cmd.exe PID 1824 wrote to memory of 964 1824 5.exe cmd.exe PID 964 wrote to memory of 1484 964 cmd.exe taskkill.exe PID 964 wrote to memory of 1484 964 cmd.exe taskkill.exe PID 964 wrote to memory of 1484 964 cmd.exe taskkill.exe PID 964 wrote to memory of 1484 964 cmd.exe taskkill.exe PID 964 wrote to memory of 1240 964 cmd.exe timeout.exe PID 964 wrote to memory of 1240 964 cmd.exe timeout.exe PID 964 wrote to memory of 1240 964 cmd.exe timeout.exe PID 964 wrote to memory of 1240 964 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3f35dcb69fca49ae55a22812770ecb2.exe"C:\Users\Admin\AppData\Local\Temp\f3f35dcb69fca49ae55a22812770ecb2.exe"1⤵
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\82785e4e-ba27-410e-8328-ec4c4cc925e7" /deny *S-1-1-0:(OI)(CI)(DE,DC)2⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\f3f35dcb69fca49ae55a22812770ecb2.exe"C:\Users\Admin\AppData\Local\Temp\f3f35dcb69fca49ae55a22812770ecb2.exe" --Admin IsNotAutoStart IsNotTask2⤵
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\d14ebee5-8f0f-4251-97a6-f53c6a599a15\updatewin.exe"C:\Users\Admin\AppData\Local\d14ebee5-8f0f-4251-97a6-f53c6a599a15\updatewin.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Local\d14ebee5-8f0f-4251-97a6-f53c6a599a15\updatewin.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 35⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\d14ebee5-8f0f-4251-97a6-f53c6a599a15\5.exe"C:\Users\Admin\AppData\Local\d14ebee5-8f0f-4251-97a6-f53c6a599a15\5.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 5.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\d14ebee5-8f0f-4251-97a6-f53c6a599a15\5.exe" & del C:\ProgramData\*.dll & exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 5.exe /f5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\timeout.exetimeout /t 65⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\freebl3.dllMD5
ef2834ac4ee7d6724f255beaf527e635
SHA15be8c1e73a21b49f353c2ecfa4108e43a883cb7b
SHA256a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba
SHA512c6ea0e4347cbd7ef5e80ae8c0afdca20ea23ac2bdd963361dfaf562a9aed58dcbc43f89dd826692a064d76c3f4b3e92361af7b79a6d16a75d9951591ae3544d2
-
C:\ProgramData\mozglue.dllMD5
8f73c08a9660691143661bf7332c3c27
SHA137fa65dd737c50fda710fdbde89e51374d0c204a
SHA2563fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd
SHA5120042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89
-
C:\ProgramData\msvcp140.dllMD5
109f0f02fd37c84bfc7508d4227d7ed5
SHA1ef7420141bb15ac334d3964082361a460bfdb975
SHA256334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4
SHA51246eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39
-
C:\ProgramData\nss3.dllMD5
bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
C:\ProgramData\softokn3.dllMD5
a2ee53de9167bf0d6c019303b7ca84e5
SHA12a3c737fa1157e8483815e98b666408a18c0db42
SHA25643536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083
SHA51245b56432244f86321fa88fbcca6a0d2a2f7f4e0648c1d7d7b1866adc9daa5eddd9f6bb73662149f279c9ab60930dad1113c8337cb5e6ec9eed5048322f65f7d8
-
C:\ProgramData\vcruntime140.dllMD5
7587bf9cb4147022cd5681b015183046
SHA1f2106306a8f6f0da5afb7fc765cfa0757ad5a628
SHA256c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d
SHA5120b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DMD5
54e60fd0149fe960a1bb51d1a63724b3
SHA18edc3d0d641441a72c642c3e96dabfe8aa9877a8
SHA2567cdb049d052b55ee9c2ba9096e8cf7e1f9117d2898c1679ab2ef2e8683356309
SHA512090766a3ae2e7d091ee0f22ce954373327d9642e10451f55342b76b1aa444c8e16cc4102957570e08d7fa19b1e17fe34f8a764f8c041c82f799d095ccf0f357b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015MD5
61a03d15cf62612f50b74867090dbe79
SHA115228f34067b4b107e917bebaf17cc7c3c1280a8
SHA256f9e23dc21553daa34c6eb778cd262831e466ce794f4bea48150e8d70d3e6af6d
SHA5125fece89ccbbf994e4f1e3ef89a502f25a72f359d445c034682758d26f01d9f3aa20a43010b9a87f2687da7ba201476922aa46d4906d442d56eb59b2b881259d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EMD5
3be96afd7b9e0ff481b665d594167224
SHA1aff8ca9cc93425b2c20b55aaf1c1e0b56f347144
SHA25636981629cd13aef6fa93a598db9dd7745d491fb7bee57b235ddcb66f1a8c5799
SHA51276df4e5a44f6be6e75136550ebdc4bad504cafeef08c2a3f3730343f43b22771b8a3f9ba6ea5b755ed4e674257754bf29b2b8197f9bc0894219dde5f34821299
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DMD5
7e6ad81a639a3879aee8754ffbe0b3cd
SHA1896cbb048ce7bf0dca699c75a1c04d43fa8a3d67
SHA2564a8eef8205c8483c286597bf5d689b3f8b2f84c3aa6c8cec59a9af5564674667
SHA51291fac19dd5c0971be3e9f343e6ce14bfadf80eb832df9e308c04a9d7a03d6f73ad8921ee4fe275cdc32b0ed65ff9e319502986532a4239baee78f02fd9498f9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015MD5
751e3f49ef6b54e420a83cf94022ef15
SHA1544afd953c4a4531d5ae2875bfcd31067b623e09
SHA256fb2ffc6dea0db1326449460375fb902859ad9a4976a19678c136e8f16869ffce
SHA5121ade9dda3f730801b1f4abc580138dccdc7effe9b9e4f8c2dd382e91f606885fee54ebadf720db09b55cacb9acd2e13848bfe21c02cd3c503e3e09dda5ac104b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EMD5
5abd4943139828a51eca216c26dab48f
SHA10f5b2b5f96865d354bb8858afe54e1a73cebd989
SHA256dd54dc1526b66bb3a53ca01d664533fb3b20630817dabb97b0ab88f715d5b5b1
SHA512efc3cbbb5122fd4071e1c952f4fc8a605f2d44d49de8a65648773d85d783cd9cd3bbd09a50454dde675354b06262a55301184ba345c0b0c40ccdfff3aad07b68
-
C:\Users\Admin\AppData\Local\82785e4e-ba27-410e-8328-ec4c4cc925e7\f3f35dcb69fca49ae55a22812770ecb2.exeMD5
f3f35dcb69fca49ae55a22812770ecb2
SHA1eb8c95dc050978d10c05073b0d5311f86da986ed
SHA256a3d26db7812778043abdf20ad3ff5caf68be3752fcd33de75d1bea8f515ed3d2
SHA512098d6f2f768811004ef87b51074fbbd9d36ee483cce637efe1f97dae0bec1bcc7c37e737d9ddb082cd1870c7c0952b334b4dbd07a7eb2b293b7a2646a7e10632
-
C:\Users\Admin\AppData\Local\d14ebee5-8f0f-4251-97a6-f53c6a599a15\5.exeMD5
e1edad05494a14cefa05fa28c3611a6e
SHA1718fe9cf4e4a7272ffa0583c0851e3134d6f1547
SHA25600b09aba4c90b634ce887da826fc74284f171698c203dcfd7da3e8b529ac6db1
SHA5127230dd424bb0e28f436239ab45a7bb93867e9ec8533b3fdd780b430762a0f5f6e8bc514841f09e49be608334f77c8d11b1ae884f032df2c05aca5739cfdacca5
-
C:\Users\Admin\AppData\Local\d14ebee5-8f0f-4251-97a6-f53c6a599a15\5.exeMD5
e1edad05494a14cefa05fa28c3611a6e
SHA1718fe9cf4e4a7272ffa0583c0851e3134d6f1547
SHA25600b09aba4c90b634ce887da826fc74284f171698c203dcfd7da3e8b529ac6db1
SHA5127230dd424bb0e28f436239ab45a7bb93867e9ec8533b3fdd780b430762a0f5f6e8bc514841f09e49be608334f77c8d11b1ae884f032df2c05aca5739cfdacca5
-
C:\Users\Admin\AppData\Local\d14ebee5-8f0f-4251-97a6-f53c6a599a15\updatewin.exeMD5
2ba02a23e7b421bb51d9c47665ed540b
SHA1f5e6d401c61760fe7f6edad47a0517fb85d9cdeb
SHA25653430b4106efc011a26b50b14b9cead42607cb1de2a6a7ef7bbb04b960baea92
SHA51216c9c254b8f78212f949d78c5e4679dcc9d365ad3188ffa0d12d6ad7f6f3e41b7db229075c99f31e35b58f7e6764f9177f9d1c4bf3bc5827503a8a793b54ade2
-
C:\Users\Admin\AppData\Local\d14ebee5-8f0f-4251-97a6-f53c6a599a15\updatewin.exeMD5
2ba02a23e7b421bb51d9c47665ed540b
SHA1f5e6d401c61760fe7f6edad47a0517fb85d9cdeb
SHA25653430b4106efc011a26b50b14b9cead42607cb1de2a6a7ef7bbb04b960baea92
SHA51216c9c254b8f78212f949d78c5e4679dcc9d365ad3188ffa0d12d6ad7f6f3e41b7db229075c99f31e35b58f7e6764f9177f9d1c4bf3bc5827503a8a793b54ade2
-
\ProgramData\mozglue.dllMD5
8f73c08a9660691143661bf7332c3c27
SHA137fa65dd737c50fda710fdbde89e51374d0c204a
SHA2563fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd
SHA5120042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89
-
\ProgramData\msvcp140.dllMD5
109f0f02fd37c84bfc7508d4227d7ed5
SHA1ef7420141bb15ac334d3964082361a460bfdb975
SHA256334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4
SHA51246eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39
-
\ProgramData\nss3.dllMD5
bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
\ProgramData\vcruntime140.dllMD5
7587bf9cb4147022cd5681b015183046
SHA1f2106306a8f6f0da5afb7fc765cfa0757ad5a628
SHA256c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d
SHA5120b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f
-
\Users\Admin\AppData\Local\d14ebee5-8f0f-4251-97a6-f53c6a599a15\5.exeMD5
e1edad05494a14cefa05fa28c3611a6e
SHA1718fe9cf4e4a7272ffa0583c0851e3134d6f1547
SHA25600b09aba4c90b634ce887da826fc74284f171698c203dcfd7da3e8b529ac6db1
SHA5127230dd424bb0e28f436239ab45a7bb93867e9ec8533b3fdd780b430762a0f5f6e8bc514841f09e49be608334f77c8d11b1ae884f032df2c05aca5739cfdacca5
-
\Users\Admin\AppData\Local\d14ebee5-8f0f-4251-97a6-f53c6a599a15\5.exeMD5
e1edad05494a14cefa05fa28c3611a6e
SHA1718fe9cf4e4a7272ffa0583c0851e3134d6f1547
SHA25600b09aba4c90b634ce887da826fc74284f171698c203dcfd7da3e8b529ac6db1
SHA5127230dd424bb0e28f436239ab45a7bb93867e9ec8533b3fdd780b430762a0f5f6e8bc514841f09e49be608334f77c8d11b1ae884f032df2c05aca5739cfdacca5
-
\Users\Admin\AppData\Local\d14ebee5-8f0f-4251-97a6-f53c6a599a15\updatewin.exeMD5
2ba02a23e7b421bb51d9c47665ed540b
SHA1f5e6d401c61760fe7f6edad47a0517fb85d9cdeb
SHA25653430b4106efc011a26b50b14b9cead42607cb1de2a6a7ef7bbb04b960baea92
SHA51216c9c254b8f78212f949d78c5e4679dcc9d365ad3188ffa0d12d6ad7f6f3e41b7db229075c99f31e35b58f7e6764f9177f9d1c4bf3bc5827503a8a793b54ade2
-
\Users\Admin\AppData\Local\d14ebee5-8f0f-4251-97a6-f53c6a599a15\updatewin.exeMD5
2ba02a23e7b421bb51d9c47665ed540b
SHA1f5e6d401c61760fe7f6edad47a0517fb85d9cdeb
SHA25653430b4106efc011a26b50b14b9cead42607cb1de2a6a7ef7bbb04b960baea92
SHA51216c9c254b8f78212f949d78c5e4679dcc9d365ad3188ffa0d12d6ad7f6f3e41b7db229075c99f31e35b58f7e6764f9177f9d1c4bf3bc5827503a8a793b54ade2
-
\Users\Admin\AppData\Local\d14ebee5-8f0f-4251-97a6-f53c6a599a15\updatewin.exeMD5
2ba02a23e7b421bb51d9c47665ed540b
SHA1f5e6d401c61760fe7f6edad47a0517fb85d9cdeb
SHA25653430b4106efc011a26b50b14b9cead42607cb1de2a6a7ef7bbb04b960baea92
SHA51216c9c254b8f78212f949d78c5e4679dcc9d365ad3188ffa0d12d6ad7f6f3e41b7db229075c99f31e35b58f7e6764f9177f9d1c4bf3bc5827503a8a793b54ade2
-
\Users\Admin\AppData\Local\d14ebee5-8f0f-4251-97a6-f53c6a599a15\updatewin.exeMD5
2ba02a23e7b421bb51d9c47665ed540b
SHA1f5e6d401c61760fe7f6edad47a0517fb85d9cdeb
SHA25653430b4106efc011a26b50b14b9cead42607cb1de2a6a7ef7bbb04b960baea92
SHA51216c9c254b8f78212f949d78c5e4679dcc9d365ad3188ffa0d12d6ad7f6f3e41b7db229075c99f31e35b58f7e6764f9177f9d1c4bf3bc5827503a8a793b54ade2
-
memory/532-7-0x0000000000000000-mapping.dmp
-
memory/964-52-0x0000000000000000-mapping.dmp
-
memory/1044-4-0x0000000001800000-0x000000000191A000-memory.dmpFilesize
1.1MB
-
memory/1044-5-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1044-2-0x0000000001A50000-0x0000000001A61000-memory.dmpFilesize
68KB
-
memory/1044-3-0x00000000760A1000-0x00000000760A3000-memory.dmpFilesize
8KB
-
memory/1072-35-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/1072-33-0x00000000002E0000-0x0000000000316000-memory.dmpFilesize
216KB
-
memory/1072-21-0x0000000000000000-mapping.dmp
-
memory/1072-32-0x00000000023A0000-0x00000000023B1000-memory.dmpFilesize
68KB
-
memory/1240-54-0x0000000000000000-mapping.dmp
-
memory/1380-50-0x0000000000000000-mapping.dmp
-
memory/1476-48-0x0000000000000000-mapping.dmp
-
memory/1484-53-0x0000000000000000-mapping.dmp
-
memory/1536-6-0x000007FEF77C0000-0x000007FEF7A3A000-memory.dmpFilesize
2.5MB
-
memory/1544-10-0x0000000001AB0000-0x0000000001AC1000-memory.dmpFilesize
68KB
-
memory/1544-9-0x0000000000000000-mapping.dmp
-
memory/1544-19-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1824-38-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/1824-37-0x0000000000220000-0x00000000002B5000-memory.dmpFilesize
596KB
-
memory/1824-34-0x0000000002340000-0x0000000002351000-memory.dmpFilesize
68KB
-
memory/1824-30-0x0000000000000000-mapping.dmp