Analysis
-
max time kernel
34s -
max time network
44s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
30-03-2021 05:41
Static task
static1
Behavioral task
behavioral1
Sample
fda422a54b108ec592b499e0dc59e6c6.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
fda422a54b108ec592b499e0dc59e6c6.exe
Resource
win10v20201028
General
-
Target
fda422a54b108ec592b499e0dc59e6c6.exe
-
Size
704KB
-
MD5
fda422a54b108ec592b499e0dc59e6c6
-
SHA1
8ee655935d7620a6d2f18f26d0532f9dfa8b56e8
-
SHA256
0e55e17532909ad5ad34eb4e35d791b27c6951dd15a8baba34c29ae572c884d0
-
SHA512
11a8e56836af1b1b86dbea68fc570535d2f74266fecda6fa9e6f90431d9596740632a35fa0ca86d8b9f58706425f3ecda2dc572f3c47bf7e2323c02f43ead52e
Malware Config
Signatures
-
Taurus Stealer
Taurus is an infostealer first seen in June 2020.
-
Executes dropped EXE 2 IoCs
Processes:
updatewin.exe5.exepid process 1956 updatewin.exe 1700 5.exe -
Loads dropped DLL 10 IoCs
Processes:
fda422a54b108ec592b499e0dc59e6c6.exeupdatewin.exe5.exepid process 688 fda422a54b108ec592b499e0dc59e6c6.exe 1956 updatewin.exe 1956 updatewin.exe 1956 updatewin.exe 688 fda422a54b108ec592b499e0dc59e6c6.exe 688 fda422a54b108ec592b499e0dc59e6c6.exe 1700 5.exe 1700 5.exe 1700 5.exe 1700 5.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
fda422a54b108ec592b499e0dc59e6c6.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\88c9e5cb-510e-4aa9-a971-a8c1b4ac4ae8\\fda422a54b108ec592b499e0dc59e6c6.exe\" --AutoStart" fda422a54b108ec592b499e0dc59e6c6.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 api.2ip.ua 7 api.2ip.ua 15 api.2ip.ua -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
5.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 5.exe -
Delays execution with timeout.exe 2 IoCs
Processes:
timeout.exetimeout.exepid process 1012 timeout.exe 1052 timeout.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1068 taskkill.exe -
Processes:
5.exefda422a54b108ec592b499e0dc59e6c6.exefda422a54b108ec592b499e0dc59e6c6.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde 5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 fda422a54b108ec592b499e0dc59e6c6.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e fda422a54b108ec592b499e0dc59e6c6.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e fda422a54b108ec592b499e0dc59e6c6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 fda422a54b108ec592b499e0dc59e6c6.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e fda422a54b108ec592b499e0dc59e6c6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 5.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
fda422a54b108ec592b499e0dc59e6c6.exefda422a54b108ec592b499e0dc59e6c6.exe5.exepid process 2004 fda422a54b108ec592b499e0dc59e6c6.exe 2004 fda422a54b108ec592b499e0dc59e6c6.exe 688 fda422a54b108ec592b499e0dc59e6c6.exe 688 fda422a54b108ec592b499e0dc59e6c6.exe 1700 5.exe 1700 5.exe 1700 5.exe 1700 5.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
updatewin.exetaskkill.exedescription pid process Token: SeRestorePrivilege 1956 updatewin.exe Token: SeBackupPrivilege 1956 updatewin.exe Token: SeDebugPrivilege 1068 taskkill.exe -
Suspicious use of WriteProcessMemory 45 IoCs
Processes:
fda422a54b108ec592b499e0dc59e6c6.exefda422a54b108ec592b499e0dc59e6c6.exeupdatewin.execmd.exe5.execmd.exedescription pid process target process PID 2004 wrote to memory of 1364 2004 fda422a54b108ec592b499e0dc59e6c6.exe icacls.exe PID 2004 wrote to memory of 1364 2004 fda422a54b108ec592b499e0dc59e6c6.exe icacls.exe PID 2004 wrote to memory of 1364 2004 fda422a54b108ec592b499e0dc59e6c6.exe icacls.exe PID 2004 wrote to memory of 1364 2004 fda422a54b108ec592b499e0dc59e6c6.exe icacls.exe PID 2004 wrote to memory of 688 2004 fda422a54b108ec592b499e0dc59e6c6.exe fda422a54b108ec592b499e0dc59e6c6.exe PID 2004 wrote to memory of 688 2004 fda422a54b108ec592b499e0dc59e6c6.exe fda422a54b108ec592b499e0dc59e6c6.exe PID 2004 wrote to memory of 688 2004 fda422a54b108ec592b499e0dc59e6c6.exe fda422a54b108ec592b499e0dc59e6c6.exe PID 2004 wrote to memory of 688 2004 fda422a54b108ec592b499e0dc59e6c6.exe fda422a54b108ec592b499e0dc59e6c6.exe PID 688 wrote to memory of 1956 688 fda422a54b108ec592b499e0dc59e6c6.exe updatewin.exe PID 688 wrote to memory of 1956 688 fda422a54b108ec592b499e0dc59e6c6.exe updatewin.exe PID 688 wrote to memory of 1956 688 fda422a54b108ec592b499e0dc59e6c6.exe updatewin.exe PID 688 wrote to memory of 1956 688 fda422a54b108ec592b499e0dc59e6c6.exe updatewin.exe PID 688 wrote to memory of 1956 688 fda422a54b108ec592b499e0dc59e6c6.exe updatewin.exe PID 688 wrote to memory of 1956 688 fda422a54b108ec592b499e0dc59e6c6.exe updatewin.exe PID 688 wrote to memory of 1956 688 fda422a54b108ec592b499e0dc59e6c6.exe updatewin.exe PID 688 wrote to memory of 1700 688 fda422a54b108ec592b499e0dc59e6c6.exe 5.exe PID 688 wrote to memory of 1700 688 fda422a54b108ec592b499e0dc59e6c6.exe 5.exe PID 688 wrote to memory of 1700 688 fda422a54b108ec592b499e0dc59e6c6.exe 5.exe PID 688 wrote to memory of 1700 688 fda422a54b108ec592b499e0dc59e6c6.exe 5.exe PID 1956 wrote to memory of 1016 1956 updatewin.exe cmd.exe PID 1956 wrote to memory of 1016 1956 updatewin.exe cmd.exe PID 1956 wrote to memory of 1016 1956 updatewin.exe cmd.exe PID 1956 wrote to memory of 1016 1956 updatewin.exe cmd.exe PID 1956 wrote to memory of 1016 1956 updatewin.exe cmd.exe PID 1956 wrote to memory of 1016 1956 updatewin.exe cmd.exe PID 1956 wrote to memory of 1016 1956 updatewin.exe cmd.exe PID 1016 wrote to memory of 1012 1016 cmd.exe timeout.exe PID 1016 wrote to memory of 1012 1016 cmd.exe timeout.exe PID 1016 wrote to memory of 1012 1016 cmd.exe timeout.exe PID 1016 wrote to memory of 1012 1016 cmd.exe timeout.exe PID 1016 wrote to memory of 1012 1016 cmd.exe timeout.exe PID 1016 wrote to memory of 1012 1016 cmd.exe timeout.exe PID 1016 wrote to memory of 1012 1016 cmd.exe timeout.exe PID 1700 wrote to memory of 556 1700 5.exe cmd.exe PID 1700 wrote to memory of 556 1700 5.exe cmd.exe PID 1700 wrote to memory of 556 1700 5.exe cmd.exe PID 1700 wrote to memory of 556 1700 5.exe cmd.exe PID 556 wrote to memory of 1068 556 cmd.exe taskkill.exe PID 556 wrote to memory of 1068 556 cmd.exe taskkill.exe PID 556 wrote to memory of 1068 556 cmd.exe taskkill.exe PID 556 wrote to memory of 1068 556 cmd.exe taskkill.exe PID 556 wrote to memory of 1052 556 cmd.exe timeout.exe PID 556 wrote to memory of 1052 556 cmd.exe timeout.exe PID 556 wrote to memory of 1052 556 cmd.exe timeout.exe PID 556 wrote to memory of 1052 556 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fda422a54b108ec592b499e0dc59e6c6.exe"C:\Users\Admin\AppData\Local\Temp\fda422a54b108ec592b499e0dc59e6c6.exe"1⤵
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\88c9e5cb-510e-4aa9-a971-a8c1b4ac4ae8" /deny *S-1-1-0:(OI)(CI)(DE,DC)2⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\fda422a54b108ec592b499e0dc59e6c6.exe"C:\Users\Admin\AppData\Local\Temp\fda422a54b108ec592b499e0dc59e6c6.exe" --Admin IsNotAutoStart IsNotTask2⤵
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\f272405a-94d1-44db-b216-54f54db40b68\updatewin.exe"C:\Users\Admin\AppData\Local\f272405a-94d1-44db-b216-54f54db40b68\updatewin.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Local\f272405a-94d1-44db-b216-54f54db40b68\updatewin.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 35⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\f272405a-94d1-44db-b216-54f54db40b68\5.exe"C:\Users\Admin\AppData\Local\f272405a-94d1-44db-b216-54f54db40b68\5.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 5.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\f272405a-94d1-44db-b216-54f54db40b68\5.exe" & del C:\ProgramData\*.dll & exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 5.exe /f5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\timeout.exetimeout /t 65⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\freebl3.dllMD5
ef2834ac4ee7d6724f255beaf527e635
SHA15be8c1e73a21b49f353c2ecfa4108e43a883cb7b
SHA256a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba
SHA512c6ea0e4347cbd7ef5e80ae8c0afdca20ea23ac2bdd963361dfaf562a9aed58dcbc43f89dd826692a064d76c3f4b3e92361af7b79a6d16a75d9951591ae3544d2
-
C:\ProgramData\mozglue.dllMD5
8f73c08a9660691143661bf7332c3c27
SHA137fa65dd737c50fda710fdbde89e51374d0c204a
SHA2563fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd
SHA5120042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89
-
C:\ProgramData\msvcp140.dllMD5
109f0f02fd37c84bfc7508d4227d7ed5
SHA1ef7420141bb15ac334d3964082361a460bfdb975
SHA256334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4
SHA51246eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39
-
C:\ProgramData\nss3.dllMD5
bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
C:\ProgramData\softokn3.dllMD5
a2ee53de9167bf0d6c019303b7ca84e5
SHA12a3c737fa1157e8483815e98b666408a18c0db42
SHA25643536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083
SHA51245b56432244f86321fa88fbcca6a0d2a2f7f4e0648c1d7d7b1866adc9daa5eddd9f6bb73662149f279c9ab60930dad1113c8337cb5e6ec9eed5048322f65f7d8
-
C:\ProgramData\vcruntime140.dllMD5
7587bf9cb4147022cd5681b015183046
SHA1f2106306a8f6f0da5afb7fc765cfa0757ad5a628
SHA256c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d
SHA5120b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DMD5
54e60fd0149fe960a1bb51d1a63724b3
SHA18edc3d0d641441a72c642c3e96dabfe8aa9877a8
SHA2567cdb049d052b55ee9c2ba9096e8cf7e1f9117d2898c1679ab2ef2e8683356309
SHA512090766a3ae2e7d091ee0f22ce954373327d9642e10451f55342b76b1aa444c8e16cc4102957570e08d7fa19b1e17fe34f8a764f8c041c82f799d095ccf0f357b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015MD5
61a03d15cf62612f50b74867090dbe79
SHA115228f34067b4b107e917bebaf17cc7c3c1280a8
SHA256f9e23dc21553daa34c6eb778cd262831e466ce794f4bea48150e8d70d3e6af6d
SHA5125fece89ccbbf994e4f1e3ef89a502f25a72f359d445c034682758d26f01d9f3aa20a43010b9a87f2687da7ba201476922aa46d4906d442d56eb59b2b881259d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EMD5
3be96afd7b9e0ff481b665d594167224
SHA1aff8ca9cc93425b2c20b55aaf1c1e0b56f347144
SHA25636981629cd13aef6fa93a598db9dd7745d491fb7bee57b235ddcb66f1a8c5799
SHA51276df4e5a44f6be6e75136550ebdc4bad504cafeef08c2a3f3730343f43b22771b8a3f9ba6ea5b755ed4e674257754bf29b2b8197f9bc0894219dde5f34821299
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DMD5
499902adece917a9824840870430f3e4
SHA12849ee4a6d5fb61dcdb9993d946335c0d8290512
SHA256b2487c859e94ce8525f5588237f555b4c7b9123de1df635264ad4e8f67340a18
SHA5124c6334c24b93ed62d0ed41738200d3d1cfe5afdaf9a2fd265693b21fd8aac8ea79710446a8e1b89b340d58d683b1ba33558161a4d397366fb6acd51257da0ec7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015MD5
7004764b9279bec9b0134c9e042076ec
SHA1d782681344f32f23330bc570160f7e0663bb130d
SHA256a096afe2b4f8d1add9b93e0ad0a37b74676fa721bc99035595ebdc5755d5c1ca
SHA51220f4467ef1082d61782c1628a7b86516cdf245dd38f45792218d35fcf5ecdddf0411c36b76f33f4d748b6b5a2161d4941004f73a4289ab77f18e91f5f5cd7099
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EMD5
12c599535f7271ecb9589c83675a8665
SHA16b88e620f1ef0e7a891e94e819cccc435473cad4
SHA256b187d36283da4e506e2d9c40c2c1e56c257eeab0bf1a7a3ca1a94393c8e2c219
SHA5122e0be3edfea3348202f74d98db5704084a4511af8f41c76fd876fd2eb9bf55c5306bcc710f17f2c532d2d8407a2106e30655c818097a0c930c0989ebf6851193
-
C:\Users\Admin\AppData\Local\88c9e5cb-510e-4aa9-a971-a8c1b4ac4ae8\fda422a54b108ec592b499e0dc59e6c6.exeMD5
fda422a54b108ec592b499e0dc59e6c6
SHA18ee655935d7620a6d2f18f26d0532f9dfa8b56e8
SHA2560e55e17532909ad5ad34eb4e35d791b27c6951dd15a8baba34c29ae572c884d0
SHA51211a8e56836af1b1b86dbea68fc570535d2f74266fecda6fa9e6f90431d9596740632a35fa0ca86d8b9f58706425f3ecda2dc572f3c47bf7e2323c02f43ead52e
-
C:\Users\Admin\AppData\Local\f272405a-94d1-44db-b216-54f54db40b68\5.exeMD5
e1edad05494a14cefa05fa28c3611a6e
SHA1718fe9cf4e4a7272ffa0583c0851e3134d6f1547
SHA25600b09aba4c90b634ce887da826fc74284f171698c203dcfd7da3e8b529ac6db1
SHA5127230dd424bb0e28f436239ab45a7bb93867e9ec8533b3fdd780b430762a0f5f6e8bc514841f09e49be608334f77c8d11b1ae884f032df2c05aca5739cfdacca5
-
C:\Users\Admin\AppData\Local\f272405a-94d1-44db-b216-54f54db40b68\5.exeMD5
e1edad05494a14cefa05fa28c3611a6e
SHA1718fe9cf4e4a7272ffa0583c0851e3134d6f1547
SHA25600b09aba4c90b634ce887da826fc74284f171698c203dcfd7da3e8b529ac6db1
SHA5127230dd424bb0e28f436239ab45a7bb93867e9ec8533b3fdd780b430762a0f5f6e8bc514841f09e49be608334f77c8d11b1ae884f032df2c05aca5739cfdacca5
-
C:\Users\Admin\AppData\Local\f272405a-94d1-44db-b216-54f54db40b68\updatewin.exeMD5
2ba02a23e7b421bb51d9c47665ed540b
SHA1f5e6d401c61760fe7f6edad47a0517fb85d9cdeb
SHA25653430b4106efc011a26b50b14b9cead42607cb1de2a6a7ef7bbb04b960baea92
SHA51216c9c254b8f78212f949d78c5e4679dcc9d365ad3188ffa0d12d6ad7f6f3e41b7db229075c99f31e35b58f7e6764f9177f9d1c4bf3bc5827503a8a793b54ade2
-
C:\Users\Admin\AppData\Local\f272405a-94d1-44db-b216-54f54db40b68\updatewin.exeMD5
2ba02a23e7b421bb51d9c47665ed540b
SHA1f5e6d401c61760fe7f6edad47a0517fb85d9cdeb
SHA25653430b4106efc011a26b50b14b9cead42607cb1de2a6a7ef7bbb04b960baea92
SHA51216c9c254b8f78212f949d78c5e4679dcc9d365ad3188ffa0d12d6ad7f6f3e41b7db229075c99f31e35b58f7e6764f9177f9d1c4bf3bc5827503a8a793b54ade2
-
\ProgramData\mozglue.dllMD5
8f73c08a9660691143661bf7332c3c27
SHA137fa65dd737c50fda710fdbde89e51374d0c204a
SHA2563fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd
SHA5120042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89
-
\ProgramData\msvcp140.dllMD5
109f0f02fd37c84bfc7508d4227d7ed5
SHA1ef7420141bb15ac334d3964082361a460bfdb975
SHA256334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4
SHA51246eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39
-
\ProgramData\nss3.dllMD5
bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
\ProgramData\vcruntime140.dllMD5
7587bf9cb4147022cd5681b015183046
SHA1f2106306a8f6f0da5afb7fc765cfa0757ad5a628
SHA256c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d
SHA5120b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f
-
\Users\Admin\AppData\Local\f272405a-94d1-44db-b216-54f54db40b68\5.exeMD5
e1edad05494a14cefa05fa28c3611a6e
SHA1718fe9cf4e4a7272ffa0583c0851e3134d6f1547
SHA25600b09aba4c90b634ce887da826fc74284f171698c203dcfd7da3e8b529ac6db1
SHA5127230dd424bb0e28f436239ab45a7bb93867e9ec8533b3fdd780b430762a0f5f6e8bc514841f09e49be608334f77c8d11b1ae884f032df2c05aca5739cfdacca5
-
\Users\Admin\AppData\Local\f272405a-94d1-44db-b216-54f54db40b68\5.exeMD5
e1edad05494a14cefa05fa28c3611a6e
SHA1718fe9cf4e4a7272ffa0583c0851e3134d6f1547
SHA25600b09aba4c90b634ce887da826fc74284f171698c203dcfd7da3e8b529ac6db1
SHA5127230dd424bb0e28f436239ab45a7bb93867e9ec8533b3fdd780b430762a0f5f6e8bc514841f09e49be608334f77c8d11b1ae884f032df2c05aca5739cfdacca5
-
\Users\Admin\AppData\Local\f272405a-94d1-44db-b216-54f54db40b68\updatewin.exeMD5
2ba02a23e7b421bb51d9c47665ed540b
SHA1f5e6d401c61760fe7f6edad47a0517fb85d9cdeb
SHA25653430b4106efc011a26b50b14b9cead42607cb1de2a6a7ef7bbb04b960baea92
SHA51216c9c254b8f78212f949d78c5e4679dcc9d365ad3188ffa0d12d6ad7f6f3e41b7db229075c99f31e35b58f7e6764f9177f9d1c4bf3bc5827503a8a793b54ade2
-
\Users\Admin\AppData\Local\f272405a-94d1-44db-b216-54f54db40b68\updatewin.exeMD5
2ba02a23e7b421bb51d9c47665ed540b
SHA1f5e6d401c61760fe7f6edad47a0517fb85d9cdeb
SHA25653430b4106efc011a26b50b14b9cead42607cb1de2a6a7ef7bbb04b960baea92
SHA51216c9c254b8f78212f949d78c5e4679dcc9d365ad3188ffa0d12d6ad7f6f3e41b7db229075c99f31e35b58f7e6764f9177f9d1c4bf3bc5827503a8a793b54ade2
-
\Users\Admin\AppData\Local\f272405a-94d1-44db-b216-54f54db40b68\updatewin.exeMD5
2ba02a23e7b421bb51d9c47665ed540b
SHA1f5e6d401c61760fe7f6edad47a0517fb85d9cdeb
SHA25653430b4106efc011a26b50b14b9cead42607cb1de2a6a7ef7bbb04b960baea92
SHA51216c9c254b8f78212f949d78c5e4679dcc9d365ad3188ffa0d12d6ad7f6f3e41b7db229075c99f31e35b58f7e6764f9177f9d1c4bf3bc5827503a8a793b54ade2
-
\Users\Admin\AppData\Local\f272405a-94d1-44db-b216-54f54db40b68\updatewin.exeMD5
2ba02a23e7b421bb51d9c47665ed540b
SHA1f5e6d401c61760fe7f6edad47a0517fb85d9cdeb
SHA25653430b4106efc011a26b50b14b9cead42607cb1de2a6a7ef7bbb04b960baea92
SHA51216c9c254b8f78212f949d78c5e4679dcc9d365ad3188ffa0d12d6ad7f6f3e41b7db229075c99f31e35b58f7e6764f9177f9d1c4bf3bc5827503a8a793b54ade2
-
memory/556-53-0x0000000000000000-mapping.dmp
-
memory/688-19-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/688-9-0x0000000000000000-mapping.dmp
-
memory/688-10-0x00000000022D0000-0x00000000022E1000-memory.dmpFilesize
68KB
-
memory/1012-37-0x0000000000000000-mapping.dmp
-
memory/1016-35-0x0000000000000000-mapping.dmp
-
memory/1052-56-0x0000000000000000-mapping.dmp
-
memory/1068-55-0x0000000000000000-mapping.dmp
-
memory/1096-6-0x000007FEF6770000-0x000007FEF69EA000-memory.dmpFilesize
2.5MB
-
memory/1364-7-0x0000000000000000-mapping.dmp
-
memory/1700-30-0x0000000000000000-mapping.dmp
-
memory/1700-42-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/1700-41-0x0000000000880000-0x0000000000915000-memory.dmpFilesize
596KB
-
memory/1700-39-0x0000000002390000-0x00000000023A1000-memory.dmpFilesize
68KB
-
memory/1956-34-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/1956-33-0x0000000000840000-0x0000000000876000-memory.dmpFilesize
216KB
-
memory/1956-31-0x00000000024E0000-0x00000000024F1000-memory.dmpFilesize
68KB
-
memory/1956-21-0x0000000000000000-mapping.dmp
-
memory/2004-2-0x00000000020F0000-0x0000000002101000-memory.dmpFilesize
68KB
-
memory/2004-5-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2004-4-0x00000000020F0000-0x000000000220A000-memory.dmpFilesize
1.1MB
-
memory/2004-3-0x0000000076641000-0x0000000076643000-memory.dmpFilesize
8KB