Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
30-03-2021 12:05
Static task
static1
Behavioral task
behavioral1
Sample
5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe
Resource
win7v20201028
General
-
Target
5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe
-
Size
50KB
-
MD5
faf9368f40e64b2ad9d47b1b6e0b958b
-
SHA1
2531f7690b37dc1b11d1c6d36ce91dea22425742
-
SHA256
5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95
-
SHA512
bd0f9b716626b7caf40198a8951c31b35d9fe31d47623bf44cbae1682284036501de988703db41257969f2a9008e927e334e86f1a3509a88807fa569b4aa5475
Malware Config
Extracted
amadey
2.14
176.111.174.66/Hq13Vdsv2W/index.php
Signatures
-
Turns off Windows Defender SpyNet reporting 2 TTPs
-
Nirsoft 6 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\98535a81-2835-4be7-99ca-b49a2e499191\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\98535a81-2835-4be7-99ca-b49a2e499191\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\98535a81-2835-4be7-99ca-b49a2e499191\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\accad042-7c71-4dcd-9060-f99eaa01136f\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\accad042-7c71-4dcd-9060-f99eaa01136f\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\accad042-7c71-4dcd-9060-f99eaa01136f\AdvancedRun.exe Nirsoft -
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exerundll32.exeflow pid process 24 4280 rundll32.exe 25 4312 rundll32.exe -
Executes dropped EXE 6 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exebkdm.exeAdvancedRun.exeAdvancedRun.exebkdm.exepid process 2268 AdvancedRun.exe 2156 AdvancedRun.exe 3768 bkdm.exe 2264 AdvancedRun.exe 2308 AdvancedRun.exe 3684 bkdm.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 4280 rundll32.exe 4312 rundll32.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Processes:
5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exebkdm.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0" 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0" 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe = "0" 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\d23c4bc78e\bkdm.exe = "0" bkdm.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 33 IoCs
Processes:
5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exebkdm.exepid process 580 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe 580 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe 580 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe 580 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe 580 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe 580 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe 580 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe 580 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe 580 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe 580 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe 580 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe 580 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe 580 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe 580 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe 580 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe 580 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe 580 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe 3768 bkdm.exe 3768 bkdm.exe 3768 bkdm.exe 3768 bkdm.exe 3768 bkdm.exe 3768 bkdm.exe 3768 bkdm.exe 3768 bkdm.exe 3768 bkdm.exe 3768 bkdm.exe 3768 bkdm.exe 3768 bkdm.exe 3768 bkdm.exe 3768 bkdm.exe 3768 bkdm.exe 3768 bkdm.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exebkdm.exedescription pid process target process PID 580 set thread context of 2292 580 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe PID 3768 set thread context of 3684 3768 bkdm.exe bkdm.exe -
Drops file in Windows directory 1 IoCs
Processes:
WerFault.exedescription ioc process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1552 580 WerFault.exe 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe 3856 3768 WerFault.exe bkdm.exe -
Delays execution with timeout.exe 2 IoCs
Processes:
timeout.exetimeout.exepid process 988 timeout.exe 3848 timeout.exe -
Suspicious behavior: EnumeratesProcesses 63 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exepowershell.exe5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exeWerFault.exeAdvancedRun.exeAdvancedRun.exepowershell.exebkdm.exeWerFault.exerundll32.exepid process 2268 AdvancedRun.exe 2268 AdvancedRun.exe 2268 AdvancedRun.exe 2268 AdvancedRun.exe 2156 AdvancedRun.exe 2156 AdvancedRun.exe 2156 AdvancedRun.exe 2156 AdvancedRun.exe 1320 powershell.exe 580 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe 580 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe 1320 powershell.exe 580 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe 1320 powershell.exe 1552 WerFault.exe 1552 WerFault.exe 1552 WerFault.exe 1552 WerFault.exe 1552 WerFault.exe 1552 WerFault.exe 1552 WerFault.exe 1552 WerFault.exe 1552 WerFault.exe 1552 WerFault.exe 1552 WerFault.exe 1552 WerFault.exe 1552 WerFault.exe 1552 WerFault.exe 1552 WerFault.exe 2264 AdvancedRun.exe 2264 AdvancedRun.exe 2264 AdvancedRun.exe 2264 AdvancedRun.exe 2308 AdvancedRun.exe 2308 AdvancedRun.exe 2308 AdvancedRun.exe 2308 AdvancedRun.exe 3896 powershell.exe 3896 powershell.exe 3768 bkdm.exe 3896 powershell.exe 3768 bkdm.exe 3768 bkdm.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 3856 WerFault.exe 4280 rundll32.exe 4280 rundll32.exe 4280 rundll32.exe 4280 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
Processes:
5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exeAdvancedRun.exeAdvancedRun.exepowershell.exebkdm.exeWerFault.exeAdvancedRun.exeAdvancedRun.exepowershell.exeWerFault.exedescription pid process Token: SeDebugPrivilege 580 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe Token: SeDebugPrivilege 2268 AdvancedRun.exe Token: SeImpersonatePrivilege 2268 AdvancedRun.exe Token: SeDebugPrivilege 2156 AdvancedRun.exe Token: SeImpersonatePrivilege 2156 AdvancedRun.exe Token: SeDebugPrivilege 1320 powershell.exe Token: SeDebugPrivilege 3768 bkdm.exe Token: SeRestorePrivilege 1552 WerFault.exe Token: SeBackupPrivilege 1552 WerFault.exe Token: SeBackupPrivilege 1552 WerFault.exe Token: SeDebugPrivilege 1552 WerFault.exe Token: SeDebugPrivilege 2264 AdvancedRun.exe Token: SeImpersonatePrivilege 2264 AdvancedRun.exe Token: SeDebugPrivilege 2308 AdvancedRun.exe Token: SeImpersonatePrivilege 2308 AdvancedRun.exe Token: SeDebugPrivilege 3896 powershell.exe Token: SeDebugPrivilege 3856 WerFault.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exeAdvancedRun.execmd.exe5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exebkdm.exeAdvancedRun.execmd.exebkdm.execmd.exedescription pid process target process PID 580 wrote to memory of 2268 580 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe AdvancedRun.exe PID 580 wrote to memory of 2268 580 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe AdvancedRun.exe PID 580 wrote to memory of 2268 580 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe AdvancedRun.exe PID 2268 wrote to memory of 2156 2268 AdvancedRun.exe AdvancedRun.exe PID 2268 wrote to memory of 2156 2268 AdvancedRun.exe AdvancedRun.exe PID 2268 wrote to memory of 2156 2268 AdvancedRun.exe AdvancedRun.exe PID 580 wrote to memory of 1320 580 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe powershell.exe PID 580 wrote to memory of 1320 580 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe powershell.exe PID 580 wrote to memory of 1320 580 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe powershell.exe PID 580 wrote to memory of 1176 580 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe cmd.exe PID 580 wrote to memory of 1176 580 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe cmd.exe PID 580 wrote to memory of 1176 580 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe cmd.exe PID 1176 wrote to memory of 988 1176 cmd.exe timeout.exe PID 1176 wrote to memory of 988 1176 cmd.exe timeout.exe PID 1176 wrote to memory of 988 1176 cmd.exe timeout.exe PID 580 wrote to memory of 2292 580 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe PID 580 wrote to memory of 2292 580 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe PID 580 wrote to memory of 2292 580 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe PID 580 wrote to memory of 2292 580 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe PID 580 wrote to memory of 2292 580 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe PID 580 wrote to memory of 2292 580 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe PID 580 wrote to memory of 2292 580 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe PID 580 wrote to memory of 2292 580 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe PID 580 wrote to memory of 2292 580 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe PID 580 wrote to memory of 2292 580 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe PID 2292 wrote to memory of 3768 2292 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe bkdm.exe PID 2292 wrote to memory of 3768 2292 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe bkdm.exe PID 2292 wrote to memory of 3768 2292 5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe bkdm.exe PID 3768 wrote to memory of 2264 3768 bkdm.exe AdvancedRun.exe PID 3768 wrote to memory of 2264 3768 bkdm.exe AdvancedRun.exe PID 3768 wrote to memory of 2264 3768 bkdm.exe AdvancedRun.exe PID 2264 wrote to memory of 2308 2264 AdvancedRun.exe AdvancedRun.exe PID 2264 wrote to memory of 2308 2264 AdvancedRun.exe AdvancedRun.exe PID 2264 wrote to memory of 2308 2264 AdvancedRun.exe AdvancedRun.exe PID 3768 wrote to memory of 3896 3768 bkdm.exe powershell.exe PID 3768 wrote to memory of 3896 3768 bkdm.exe powershell.exe PID 3768 wrote to memory of 3896 3768 bkdm.exe powershell.exe PID 3768 wrote to memory of 2240 3768 bkdm.exe cmd.exe PID 3768 wrote to memory of 2240 3768 bkdm.exe cmd.exe PID 3768 wrote to memory of 2240 3768 bkdm.exe cmd.exe PID 2240 wrote to memory of 3848 2240 cmd.exe timeout.exe PID 2240 wrote to memory of 3848 2240 cmd.exe timeout.exe PID 2240 wrote to memory of 3848 2240 cmd.exe timeout.exe PID 3768 wrote to memory of 3684 3768 bkdm.exe bkdm.exe PID 3768 wrote to memory of 3684 3768 bkdm.exe bkdm.exe PID 3768 wrote to memory of 3684 3768 bkdm.exe bkdm.exe PID 3768 wrote to memory of 3684 3768 bkdm.exe bkdm.exe PID 3768 wrote to memory of 3684 3768 bkdm.exe bkdm.exe PID 3768 wrote to memory of 3684 3768 bkdm.exe bkdm.exe PID 3768 wrote to memory of 3684 3768 bkdm.exe bkdm.exe PID 3768 wrote to memory of 3684 3768 bkdm.exe bkdm.exe PID 3768 wrote to memory of 3684 3768 bkdm.exe bkdm.exe PID 3768 wrote to memory of 3684 3768 bkdm.exe bkdm.exe PID 3684 wrote to memory of 3840 3684 bkdm.exe cmd.exe PID 3684 wrote to memory of 3840 3684 bkdm.exe cmd.exe PID 3684 wrote to memory of 3840 3684 bkdm.exe cmd.exe PID 3840 wrote to memory of 4156 3840 cmd.exe reg.exe PID 3840 wrote to memory of 4156 3840 cmd.exe reg.exe PID 3840 wrote to memory of 4156 3840 cmd.exe reg.exe PID 3684 wrote to memory of 4280 3684 bkdm.exe rundll32.exe PID 3684 wrote to memory of 4280 3684 bkdm.exe rundll32.exe PID 3684 wrote to memory of 4280 3684 bkdm.exe rundll32.exe PID 3684 wrote to memory of 4312 3684 bkdm.exe rundll32.exe PID 3684 wrote to memory of 4312 3684 bkdm.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe"C:\Users\Admin\AppData\Local\Temp\5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe"1⤵
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\98535a81-2835-4be7-99ca-b49a2e499191\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\98535a81-2835-4be7-99ca-b49a2e499191\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\98535a81-2835-4be7-99ca-b49a2e499191\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\98535a81-2835-4be7-99ca-b49a2e499191\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\98535a81-2835-4be7-99ca-b49a2e499191\AdvancedRun.exe" /SpecialRun 4101d8 22683⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe"C:\Users\Admin\AppData\Local\Temp\5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\d23c4bc78e\bkdm.exe"C:\ProgramData\d23c4bc78e\bkdm.exe"3⤵
- Executes dropped EXE
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\accad042-7c71-4dcd-9060-f99eaa01136f\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\accad042-7c71-4dcd-9060-f99eaa01136f\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\accad042-7c71-4dcd-9060-f99eaa01136f\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\accad042-7c71-4dcd-9060-f99eaa01136f\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\accad042-7c71-4dcd-9060-f99eaa01136f\AdvancedRun.exe" /SpecialRun 4101d8 22645⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\d23c4bc78e\bkdm.exe" -Force4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 14⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 15⤵
- Delays execution with timeout.exe
-
C:\ProgramData\d23c4bc78e\bkdm.exe"C:\ProgramData\d23c4bc78e\bkdm.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\d23c4bc78e\5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\d23c4bc78e\6⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\ProgramData\8a8a4f61cb34cb\cred.dll, Main5⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\ProgramData\8a8a4f61cb34cb\scr.dll, Main5⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 20844⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 580 -s 20962⤵
- Drops file in Windows directory
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\152119853632563005190890MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\ProgramData\8a8a4f61cb34cb\cred.dllMD5
46ac8c4f3321213418793a0d3c8494c6
SHA1a0aced08e0fbfc7db096cd95f7146531d071ceb7
SHA256f6352437eda89bc239bd7594f3103cafc397c1790f01a333fc72d2e8b11b7fa4
SHA512d6568b07f825c6da519f2a7fb30931f93b074ffbd54fce9032b17a17d1f3605e3eee9f737d1a78613c474aa1ca16eca83a200dd96f0647d0f319332270e639ca
-
C:\ProgramData\8a8a4f61cb34cb\scr.dllMD5
ff01369d27e69d473384573d0cbf2328
SHA1b2545747b253e785b392340d65ae33c63bc11975
SHA256913f9b9727460bfa771f6ea6709375c564f00fcdaac6c25479a9eea5275a8ee3
SHA5125f17682f35595548c1c70dd7b22cba0a1d599bdaf586e0e2ab56f79a3aba891673c70b48001ce0e5eb7f766226eb2c425b7867da91b42ad09dd2fbda62e1d83a
-
C:\ProgramData\d23c4bc78e\bkdm.exeMD5
faf9368f40e64b2ad9d47b1b6e0b958b
SHA12531f7690b37dc1b11d1c6d36ce91dea22425742
SHA2565abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95
SHA512bd0f9b716626b7caf40198a8951c31b35d9fe31d47623bf44cbae1682284036501de988703db41257969f2a9008e927e334e86f1a3509a88807fa569b4aa5475
-
C:\ProgramData\d23c4bc78e\bkdm.exeMD5
faf9368f40e64b2ad9d47b1b6e0b958b
SHA12531f7690b37dc1b11d1c6d36ce91dea22425742
SHA2565abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95
SHA512bd0f9b716626b7caf40198a8951c31b35d9fe31d47623bf44cbae1682284036501de988703db41257969f2a9008e927e334e86f1a3509a88807fa569b4aa5475
-
C:\ProgramData\d23c4bc78e\bkdm.exeMD5
faf9368f40e64b2ad9d47b1b6e0b958b
SHA12531f7690b37dc1b11d1c6d36ce91dea22425742
SHA2565abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95
SHA512bd0f9b716626b7caf40198a8951c31b35d9fe31d47623bf44cbae1682284036501de988703db41257969f2a9008e927e334e86f1a3509a88807fa569b4aa5475
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logMD5
db01a2c1c7e70b2b038edf8ad5ad9826
SHA1540217c647a73bad8d8a79e3a0f3998b5abd199b
SHA256413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d
SHA512c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
e042da4bd11f1e98f001f49c822c658c
SHA16833118e456f171dcf0398d99d8d3ba22f32267a
SHA256d2983929087135258d80d0efe6f3f91f1d4051c30fe3afece7859a87046ad21d
SHA5128150ad932038f147bc6ab18860b658efe4ef5eecaaa6708a091cbffc229b68b78cf8fba41a3ea8573a9c2c70540f2882b8b16b7fe27a82d7de19c488956ddcf1
-
C:\Users\Admin\AppData\Local\Temp\98535a81-2835-4be7-99ca-b49a2e499191\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\98535a81-2835-4be7-99ca-b49a2e499191\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\98535a81-2835-4be7-99ca-b49a2e499191\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\accad042-7c71-4dcd-9060-f99eaa01136f\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\accad042-7c71-4dcd-9060-f99eaa01136f\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\accad042-7c71-4dcd-9060-f99eaa01136f\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\ProgramData\8a8a4f61cb34cb\cred.dllMD5
46ac8c4f3321213418793a0d3c8494c6
SHA1a0aced08e0fbfc7db096cd95f7146531d071ceb7
SHA256f6352437eda89bc239bd7594f3103cafc397c1790f01a333fc72d2e8b11b7fa4
SHA512d6568b07f825c6da519f2a7fb30931f93b074ffbd54fce9032b17a17d1f3605e3eee9f737d1a78613c474aa1ca16eca83a200dd96f0647d0f319332270e639ca
-
\ProgramData\8a8a4f61cb34cb\scr.dllMD5
ff01369d27e69d473384573d0cbf2328
SHA1b2545747b253e785b392340d65ae33c63bc11975
SHA256913f9b9727460bfa771f6ea6709375c564f00fcdaac6c25479a9eea5275a8ee3
SHA5125f17682f35595548c1c70dd7b22cba0a1d599bdaf586e0e2ab56f79a3aba891673c70b48001ce0e5eb7f766226eb2c425b7867da91b42ad09dd2fbda62e1d83a
-
memory/580-3-0x0000000000930000-0x0000000000931000-memory.dmpFilesize
4KB
-
memory/580-5-0x0000000005380000-0x0000000005381000-memory.dmpFilesize
4KB
-
memory/580-6-0x0000000007E80000-0x0000000007E81000-memory.dmpFilesize
4KB
-
memory/580-7-0x000000000A710000-0x000000000A711000-memory.dmpFilesize
4KB
-
memory/580-2-0x0000000073F30000-0x000000007461E000-memory.dmpFilesize
6.9MB
-
memory/580-8-0x000000000A210000-0x000000000A2B9000-memory.dmpFilesize
676KB
-
memory/988-19-0x0000000000000000-mapping.dmp
-
memory/1176-16-0x0000000000000000-mapping.dmp
-
memory/1320-75-0x0000000007F50000-0x0000000007F51000-memory.dmpFilesize
4KB
-
memory/1320-20-0x00000000010E0000-0x00000000010E1000-memory.dmpFilesize
4KB
-
memory/1320-15-0x0000000073F30000-0x000000007461E000-memory.dmpFilesize
6.9MB
-
memory/1320-14-0x0000000000000000-mapping.dmp
-
memory/1320-35-0x0000000007A00000-0x0000000007A01000-memory.dmpFilesize
4KB
-
memory/1320-34-0x00000000079E0000-0x00000000079E1000-memory.dmpFilesize
4KB
-
memory/1320-77-0x0000000007F20000-0x0000000007F21000-memory.dmpFilesize
4KB
-
memory/1320-60-0x0000000008FA0000-0x0000000008FA1000-memory.dmpFilesize
4KB
-
memory/1320-25-0x00000000075D0000-0x00000000075D1000-memory.dmpFilesize
4KB
-
memory/1320-17-0x00000000010F0000-0x00000000010F1000-memory.dmpFilesize
4KB
-
memory/1320-39-0x0000000007D10000-0x0000000007D11000-memory.dmpFilesize
4KB
-
memory/1320-21-0x00000000010E2000-0x00000000010E3000-memory.dmpFilesize
4KB
-
memory/1320-24-0x0000000007560000-0x0000000007561000-memory.dmpFilesize
4KB
-
memory/1320-23-0x0000000006CD0000-0x0000000006CD1000-memory.dmpFilesize
4KB
-
memory/1320-22-0x0000000006C30000-0x0000000006C31000-memory.dmpFilesize
4KB
-
memory/1320-18-0x0000000006E30000-0x0000000006E31000-memory.dmpFilesize
4KB
-
memory/1320-49-0x0000000008A90000-0x0000000008AC3000-memory.dmpFilesize
204KB
-
memory/1320-56-0x0000000008A70000-0x0000000008A71000-memory.dmpFilesize
4KB
-
memory/1320-57-0x0000000008E20000-0x0000000008E21000-memory.dmpFilesize
4KB
-
memory/1320-58-0x000000007F0A0000-0x000000007F0A1000-memory.dmpFilesize
4KB
-
memory/1320-59-0x00000000010E3000-0x00000000010E4000-memory.dmpFilesize
4KB
-
memory/1552-36-0x0000000004780000-0x0000000004781000-memory.dmpFilesize
4KB
-
memory/2156-12-0x0000000000000000-mapping.dmp
-
memory/2240-62-0x0000000000000000-mapping.dmp
-
memory/2264-43-0x0000000000000000-mapping.dmp
-
memory/2268-9-0x0000000000000000-mapping.dmp
-
memory/2292-26-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/2292-27-0x000000000040F0BB-mapping.dmp
-
memory/2292-37-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/2308-46-0x0000000000000000-mapping.dmp
-
memory/3684-86-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/3684-81-0x000000000040F0BB-mapping.dmp
-
memory/3768-38-0x0000000004E60000-0x0000000004E61000-memory.dmpFilesize
4KB
-
memory/3768-28-0x0000000000000000-mapping.dmp
-
memory/3768-31-0x0000000073F30000-0x000000007461E000-memory.dmpFilesize
6.9MB
-
memory/3840-85-0x0000000000000000-mapping.dmp
-
memory/3848-66-0x0000000000000000-mapping.dmp
-
memory/3856-84-0x0000000004970000-0x0000000004971000-memory.dmpFilesize
4KB
-
memory/3896-61-0x0000000000000000-mapping.dmp
-
memory/3896-99-0x00000000069C3000-0x00000000069C4000-memory.dmpFilesize
4KB
-
memory/3896-98-0x000000007F170000-0x000000007F171000-memory.dmpFilesize
4KB
-
memory/3896-63-0x0000000073F30000-0x000000007461E000-memory.dmpFilesize
6.9MB
-
memory/3896-74-0x00000000069C2000-0x00000000069C3000-memory.dmpFilesize
4KB
-
memory/3896-73-0x00000000069C0000-0x00000000069C1000-memory.dmpFilesize
4KB
-
memory/4156-87-0x0000000000000000-mapping.dmp
-
memory/4280-107-0x0000000000000000-mapping.dmp
-
memory/4312-110-0x0000000000000000-mapping.dmp