Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
06-05-2021 01:56
Static task
static1
Behavioral task
behavioral1
Sample
Factura Serfinanza051053709735077235764653194.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Factura Serfinanza051053709735077235764653194.exe
Resource
win10v20210410
General
-
Target
Factura Serfinanza051053709735077235764653194.exe
-
Size
3.3MB
-
MD5
8e3a6cfb86a8c0696133c3526fe9f04b
-
SHA1
0f35083e3cbffe8eabd59f84c5a0e58c3a284c2a
-
SHA256
673500aef66cdad3be016e872ca2cf17bd814857bf53f7ef24a0f534a3a47dcd
-
SHA512
ed74bfc86a85b64ebddbc50a170ed63245f872a72a682c21a3b80776ebba8f54d3042b7750d7d61dcfde9b9b5884b277765cfae51c2ec538df6cffe4ba431b28
Malware Config
Extracted
remcos
databasepropersonombrecomercialideasearchwords.services:3521
Signatures
-
Turns off Windows Defender SpyNet reporting 2 TTPs
-
Nirsoft 6 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\05dc87f7-0583-4fb6-b23a-e94106bbf318\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\05dc87f7-0583-4fb6-b23a-e94106bbf318\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\05dc87f7-0583-4fb6-b23a-e94106bbf318\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\88001b03-ad66-4a75-89ca-ce514dd33353\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\88001b03-ad66-4a75-89ca-ce514dd33353\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\88001b03-ad66-4a75-89ca-ce514dd33353\AdvancedRun.exe Nirsoft -
Executes dropped EXE 6 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exePxxoServicesTrialNet1.exeAdvancedRun.exeAdvancedRun.exePxxoServicesTrialNet1.exepid process 2472 AdvancedRun.exe 3828 AdvancedRun.exe 2412 PxxoServicesTrialNet1.exe 2816 AdvancedRun.exe 4124 AdvancedRun.exe 4536 PxxoServicesTrialNet1.exe -
Processes:
Factura Serfinanza051053709735077235764653194.exePxxoServicesTrialNet1.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features Factura Serfinanza051053709735077235764653194.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" Factura Serfinanza051053709735077235764653194.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe = "0" PxxoServicesTrialNet1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths Factura Serfinanza051053709735077235764653194.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions Factura Serfinanza051053709735077235764653194.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza051053709735077235764653194.exe = "0" Factura Serfinanza051053709735077235764653194.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0" Factura Serfinanza051053709735077235764653194.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection Factura Serfinanza051053709735077235764653194.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" Factura Serfinanza051053709735077235764653194.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet Factura Serfinanza051053709735077235764653194.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0" Factura Serfinanza051053709735077235764653194.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
PxxoServicesTrialNet1.exeFactura Serfinanza051053709735077235764653194.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\MservicesOrg2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PxxoServicesTrialNet1.exe\"" PxxoServicesTrialNet1.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\ Factura Serfinanza051053709735077235764653194.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\MservicesOrg2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PxxoServicesTrialNet1.exe\"" Factura Serfinanza051053709735077235764653194.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\ PxxoServicesTrialNet1.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 24 IoCs
Processes:
Factura Serfinanza051053709735077235764653194.exePxxoServicesTrialNet1.exepid process 496 Factura Serfinanza051053709735077235764653194.exe 496 Factura Serfinanza051053709735077235764653194.exe 496 Factura Serfinanza051053709735077235764653194.exe 496 Factura Serfinanza051053709735077235764653194.exe 496 Factura Serfinanza051053709735077235764653194.exe 496 Factura Serfinanza051053709735077235764653194.exe 496 Factura Serfinanza051053709735077235764653194.exe 496 Factura Serfinanza051053709735077235764653194.exe 496 Factura Serfinanza051053709735077235764653194.exe 496 Factura Serfinanza051053709735077235764653194.exe 496 Factura Serfinanza051053709735077235764653194.exe 496 Factura Serfinanza051053709735077235764653194.exe 2412 PxxoServicesTrialNet1.exe 2412 PxxoServicesTrialNet1.exe 2412 PxxoServicesTrialNet1.exe 2412 PxxoServicesTrialNet1.exe 2412 PxxoServicesTrialNet1.exe 2412 PxxoServicesTrialNet1.exe 2412 PxxoServicesTrialNet1.exe 2412 PxxoServicesTrialNet1.exe 2412 PxxoServicesTrialNet1.exe 2412 PxxoServicesTrialNet1.exe 2412 PxxoServicesTrialNet1.exe 2412 PxxoServicesTrialNet1.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Factura Serfinanza051053709735077235764653194.exePxxoServicesTrialNet1.exedescription pid process target process PID 496 set thread context of 1104 496 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 2412 set thread context of 4536 2412 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe -
Drops file in Windows directory 1 IoCs
Processes:
WerFault.exedescription ioc process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3312 496 WerFault.exe Factura Serfinanza051053709735077235764653194.exe 4584 2412 WerFault.exe PxxoServicesTrialNet1.exe -
Delays execution with timeout.exe 2 IoCs
Processes:
timeout.exetimeout.exepid process 3588 timeout.exe 4448 timeout.exe -
Modifies registry class 1 IoCs
Processes:
Factura Serfinanza051053709735077235764653194.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings Factura Serfinanza051053709735077235764653194.exe -
Suspicious behavior: EnumeratesProcesses 59 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exepowershell.exeFactura Serfinanza051053709735077235764653194.exeWerFault.exeAdvancedRun.exeAdvancedRun.exepowershell.exePxxoServicesTrialNet1.exeWerFault.exepid process 2472 AdvancedRun.exe 2472 AdvancedRun.exe 2472 AdvancedRun.exe 2472 AdvancedRun.exe 3828 AdvancedRun.exe 3828 AdvancedRun.exe 3828 AdvancedRun.exe 3828 AdvancedRun.exe 1500 powershell.exe 496 Factura Serfinanza051053709735077235764653194.exe 496 Factura Serfinanza051053709735077235764653194.exe 496 Factura Serfinanza051053709735077235764653194.exe 1500 powershell.exe 3312 WerFault.exe 3312 WerFault.exe 3312 WerFault.exe 3312 WerFault.exe 3312 WerFault.exe 3312 WerFault.exe 3312 WerFault.exe 3312 WerFault.exe 3312 WerFault.exe 3312 WerFault.exe 3312 WerFault.exe 3312 WerFault.exe 3312 WerFault.exe 3312 WerFault.exe 3312 WerFault.exe 1500 powershell.exe 2816 AdvancedRun.exe 2816 AdvancedRun.exe 2816 AdvancedRun.exe 2816 AdvancedRun.exe 4124 AdvancedRun.exe 4124 AdvancedRun.exe 4124 AdvancedRun.exe 4124 AdvancedRun.exe 4344 powershell.exe 4344 powershell.exe 4344 powershell.exe 2412 PxxoServicesTrialNet1.exe 2412 PxxoServicesTrialNet1.exe 2412 PxxoServicesTrialNet1.exe 4584 WerFault.exe 4584 WerFault.exe 4584 WerFault.exe 4584 WerFault.exe 4584 WerFault.exe 4584 WerFault.exe 4584 WerFault.exe 4584 WerFault.exe 4584 WerFault.exe 4584 WerFault.exe 4584 WerFault.exe 4584 WerFault.exe 4584 WerFault.exe 4584 WerFault.exe 4584 WerFault.exe 4584 WerFault.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
PxxoServicesTrialNet1.exepid process 4536 PxxoServicesTrialNet1.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exepowershell.exeFactura Serfinanza051053709735077235764653194.exeWerFault.exeAdvancedRun.exeAdvancedRun.exepowershell.exePxxoServicesTrialNet1.exeWerFault.exedescription pid process Token: SeDebugPrivilege 2472 AdvancedRun.exe Token: SeImpersonatePrivilege 2472 AdvancedRun.exe Token: SeDebugPrivilege 3828 AdvancedRun.exe Token: SeImpersonatePrivilege 3828 AdvancedRun.exe Token: SeDebugPrivilege 1500 powershell.exe Token: SeDebugPrivilege 496 Factura Serfinanza051053709735077235764653194.exe Token: SeRestorePrivilege 3312 WerFault.exe Token: SeBackupPrivilege 3312 WerFault.exe Token: SeBackupPrivilege 3312 WerFault.exe Token: SeDebugPrivilege 3312 WerFault.exe Token: SeDebugPrivilege 2816 AdvancedRun.exe Token: SeImpersonatePrivilege 2816 AdvancedRun.exe Token: SeDebugPrivilege 4124 AdvancedRun.exe Token: SeImpersonatePrivilege 4124 AdvancedRun.exe Token: SeDebugPrivilege 4344 powershell.exe Token: SeDebugPrivilege 2412 PxxoServicesTrialNet1.exe Token: SeDebugPrivilege 4584 WerFault.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
PxxoServicesTrialNet1.exepid process 4536 PxxoServicesTrialNet1.exe -
Suspicious use of WriteProcessMemory 59 IoCs
Processes:
Factura Serfinanza051053709735077235764653194.exeAdvancedRun.execmd.exeFactura Serfinanza051053709735077235764653194.exeWScript.execmd.exePxxoServicesTrialNet1.exeAdvancedRun.execmd.exedescription pid process target process PID 496 wrote to memory of 2472 496 Factura Serfinanza051053709735077235764653194.exe AdvancedRun.exe PID 496 wrote to memory of 2472 496 Factura Serfinanza051053709735077235764653194.exe AdvancedRun.exe PID 496 wrote to memory of 2472 496 Factura Serfinanza051053709735077235764653194.exe AdvancedRun.exe PID 2472 wrote to memory of 3828 2472 AdvancedRun.exe AdvancedRun.exe PID 2472 wrote to memory of 3828 2472 AdvancedRun.exe AdvancedRun.exe PID 2472 wrote to memory of 3828 2472 AdvancedRun.exe AdvancedRun.exe PID 496 wrote to memory of 1500 496 Factura Serfinanza051053709735077235764653194.exe powershell.exe PID 496 wrote to memory of 1500 496 Factura Serfinanza051053709735077235764653194.exe powershell.exe PID 496 wrote to memory of 1500 496 Factura Serfinanza051053709735077235764653194.exe powershell.exe PID 496 wrote to memory of 3792 496 Factura Serfinanza051053709735077235764653194.exe cmd.exe PID 496 wrote to memory of 3792 496 Factura Serfinanza051053709735077235764653194.exe cmd.exe PID 496 wrote to memory of 3792 496 Factura Serfinanza051053709735077235764653194.exe cmd.exe PID 3792 wrote to memory of 3588 3792 cmd.exe timeout.exe PID 3792 wrote to memory of 3588 3792 cmd.exe timeout.exe PID 3792 wrote to memory of 3588 3792 cmd.exe timeout.exe PID 496 wrote to memory of 1104 496 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 496 wrote to memory of 1104 496 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 496 wrote to memory of 1104 496 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 496 wrote to memory of 1104 496 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 496 wrote to memory of 1104 496 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 496 wrote to memory of 1104 496 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 496 wrote to memory of 1104 496 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 496 wrote to memory of 1104 496 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 496 wrote to memory of 1104 496 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 496 wrote to memory of 1104 496 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 1104 wrote to memory of 3588 1104 Factura Serfinanza051053709735077235764653194.exe WScript.exe PID 1104 wrote to memory of 3588 1104 Factura Serfinanza051053709735077235764653194.exe WScript.exe PID 1104 wrote to memory of 3588 1104 Factura Serfinanza051053709735077235764653194.exe WScript.exe PID 3588 wrote to memory of 2100 3588 WScript.exe cmd.exe PID 3588 wrote to memory of 2100 3588 WScript.exe cmd.exe PID 3588 wrote to memory of 2100 3588 WScript.exe cmd.exe PID 2100 wrote to memory of 2412 2100 cmd.exe PxxoServicesTrialNet1.exe PID 2100 wrote to memory of 2412 2100 cmd.exe PxxoServicesTrialNet1.exe PID 2100 wrote to memory of 2412 2100 cmd.exe PxxoServicesTrialNet1.exe PID 2412 wrote to memory of 2816 2412 PxxoServicesTrialNet1.exe AdvancedRun.exe PID 2412 wrote to memory of 2816 2412 PxxoServicesTrialNet1.exe AdvancedRun.exe PID 2412 wrote to memory of 2816 2412 PxxoServicesTrialNet1.exe AdvancedRun.exe PID 2816 wrote to memory of 4124 2816 AdvancedRun.exe AdvancedRun.exe PID 2816 wrote to memory of 4124 2816 AdvancedRun.exe AdvancedRun.exe PID 2816 wrote to memory of 4124 2816 AdvancedRun.exe AdvancedRun.exe PID 2412 wrote to memory of 4344 2412 PxxoServicesTrialNet1.exe powershell.exe PID 2412 wrote to memory of 4344 2412 PxxoServicesTrialNet1.exe powershell.exe PID 2412 wrote to memory of 4344 2412 PxxoServicesTrialNet1.exe powershell.exe PID 2412 wrote to memory of 4368 2412 PxxoServicesTrialNet1.exe cmd.exe PID 2412 wrote to memory of 4368 2412 PxxoServicesTrialNet1.exe cmd.exe PID 2412 wrote to memory of 4368 2412 PxxoServicesTrialNet1.exe cmd.exe PID 4368 wrote to memory of 4448 4368 cmd.exe timeout.exe PID 4368 wrote to memory of 4448 4368 cmd.exe timeout.exe PID 4368 wrote to memory of 4448 4368 cmd.exe timeout.exe PID 2412 wrote to memory of 4536 2412 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2412 wrote to memory of 4536 2412 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2412 wrote to memory of 4536 2412 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2412 wrote to memory of 4536 2412 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2412 wrote to memory of 4536 2412 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2412 wrote to memory of 4536 2412 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2412 wrote to memory of 4536 2412 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2412 wrote to memory of 4536 2412 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2412 wrote to memory of 4536 2412 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2412 wrote to memory of 4536 2412 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza051053709735077235764653194.exe"C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza051053709735077235764653194.exe"1⤵
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\05dc87f7-0583-4fb6-b23a-e94106bbf318\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\05dc87f7-0583-4fb6-b23a-e94106bbf318\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\05dc87f7-0583-4fb6-b23a-e94106bbf318\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\05dc87f7-0583-4fb6-b23a-e94106bbf318\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\05dc87f7-0583-4fb6-b23a-e94106bbf318\AdvancedRun.exe" /SpecialRun 4101d8 24723⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza051053709735077235764653194.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza051053709735077235764653194.exe"C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza051053709735077235764653194.exe"2⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeC:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe5⤵
- Executes dropped EXE
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\88001b03-ad66-4a75-89ca-ce514dd33353\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\88001b03-ad66-4a75-89ca-ce514dd33353\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\88001b03-ad66-4a75-89ca-ce514dd33353\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\88001b03-ad66-4a75-89ca-ce514dd33353\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\88001b03-ad66-4a75-89ca-ce514dd33353\AdvancedRun.exe" /SpecialRun 4101d8 28167⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe" -Force6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 16⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 17⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 16206⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 496 -s 16282⤵
- Drops file in Windows directory
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logMD5
1c19c16e21c97ed42d5beabc93391fc5
SHA18ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA2561bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA5127d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
4c17713e9d94ef25330b33b129a0aed4
SHA1decd089c56baef6796fa77c407ae4d6c5b26a6d2
SHA2568f1cd05457931933f89da7061162e4fb672c7f7c82d3f079256f5f3be85b192b
SHA5125a1419990ce8624f46371b6eb2266d933cf0728553ca0a5650a0bedf6c0bb59f1f680da28bee4f76147aa961c638439e13009eafad7a3938774468cf5dcc5874
-
C:\Users\Admin\AppData\Local\Temp\05dc87f7-0583-4fb6-b23a-e94106bbf318\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\05dc87f7-0583-4fb6-b23a-e94106bbf318\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\05dc87f7-0583-4fb6-b23a-e94106bbf318\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\88001b03-ad66-4a75-89ca-ce514dd33353\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\88001b03-ad66-4a75-89ca-ce514dd33353\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\88001b03-ad66-4a75-89ca-ce514dd33353\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\install.vbsMD5
a39af763b1c09ead3c98a6a615f377fe
SHA19bd3d39c89e47fe7072270ecc80b810103235c03
SHA256a3930d7535eb768523ee52bbe69f13f857a0ae0f982d7bfc354d802f21010f8f
SHA5123ed8e33ac95fd2536286b4afb2ed2a082bb5f98843478262b32263a14a5dbe0425de7b8d9662a5e482b207ebf8484ace8009ecd1881a6f6f8b0ccf3b0fdfe5da
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
8e3a6cfb86a8c0696133c3526fe9f04b
SHA10f35083e3cbffe8eabd59f84c5a0e58c3a284c2a
SHA256673500aef66cdad3be016e872ca2cf17bd814857bf53f7ef24a0f534a3a47dcd
SHA512ed74bfc86a85b64ebddbc50a170ed63245f872a72a682c21a3b80776ebba8f54d3042b7750d7d61dcfde9b9b5884b277765cfae51c2ec538df6cffe4ba431b28
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
8e3a6cfb86a8c0696133c3526fe9f04b
SHA10f35083e3cbffe8eabd59f84c5a0e58c3a284c2a
SHA256673500aef66cdad3be016e872ca2cf17bd814857bf53f7ef24a0f534a3a47dcd
SHA512ed74bfc86a85b64ebddbc50a170ed63245f872a72a682c21a3b80776ebba8f54d3042b7750d7d61dcfde9b9b5884b277765cfae51c2ec538df6cffe4ba431b28
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
8e3a6cfb86a8c0696133c3526fe9f04b
SHA10f35083e3cbffe8eabd59f84c5a0e58c3a284c2a
SHA256673500aef66cdad3be016e872ca2cf17bd814857bf53f7ef24a0f534a3a47dcd
SHA512ed74bfc86a85b64ebddbc50a170ed63245f872a72a682c21a3b80776ebba8f54d3042b7750d7d61dcfde9b9b5884b277765cfae51c2ec538df6cffe4ba431b28
-
memory/496-121-0x0000000005340000-0x0000000005341000-memory.dmpFilesize
4KB
-
memory/496-118-0x0000000006AF0000-0x0000000006AF1000-memory.dmpFilesize
4KB
-
memory/496-117-0x0000000002B10000-0x0000000002B94000-memory.dmpFilesize
528KB
-
memory/496-114-0x00000000005B0000-0x00000000005B1000-memory.dmpFilesize
4KB
-
memory/496-116-0x00000000050E0000-0x00000000050E1000-memory.dmpFilesize
4KB
-
memory/1104-137-0x0000000000413FA4-mapping.dmp
-
memory/1104-145-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1104-136-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1500-144-0x00000000081E0000-0x00000000081E1000-memory.dmpFilesize
4KB
-
memory/1500-174-0x0000000009030000-0x0000000009031000-memory.dmpFilesize
4KB
-
memory/1500-139-0x0000000006BA2000-0x0000000006BA3000-memory.dmpFilesize
4KB
-
memory/1500-125-0x0000000000000000-mapping.dmp
-
memory/1500-135-0x0000000007CC0000-0x0000000007CC1000-memory.dmpFilesize
4KB
-
memory/1500-142-0x0000000007BC0000-0x0000000007BC1000-memory.dmpFilesize
4KB
-
memory/1500-143-0x00000000083F0000-0x00000000083F1000-memory.dmpFilesize
4KB
-
memory/1500-134-0x0000000007C50000-0x0000000007C51000-memory.dmpFilesize
4KB
-
memory/1500-133-0x00000000078B0000-0x00000000078B1000-memory.dmpFilesize
4KB
-
memory/1500-183-0x0000000009540000-0x0000000009541000-memory.dmpFilesize
4KB
-
memory/1500-132-0x0000000007810000-0x0000000007811000-memory.dmpFilesize
4KB
-
memory/1500-182-0x0000000006BA3000-0x0000000006BA4000-memory.dmpFilesize
4KB
-
memory/1500-131-0x00000000071E0000-0x00000000071E1000-memory.dmpFilesize
4KB
-
memory/1500-181-0x000000007F1A0000-0x000000007F1A1000-memory.dmpFilesize
4KB
-
memory/1500-130-0x0000000006AE0000-0x0000000006AE1000-memory.dmpFilesize
4KB
-
memory/1500-179-0x00000000090B0000-0x00000000090B1000-memory.dmpFilesize
4KB
-
memory/1500-138-0x0000000006BA0000-0x0000000006BA1000-memory.dmpFilesize
4KB
-
memory/1500-167-0x0000000009070000-0x00000000090A3000-memory.dmpFilesize
204KB
-
memory/2100-146-0x0000000000000000-mapping.dmp
-
memory/2412-180-0x0000000005370000-0x0000000005371000-memory.dmpFilesize
4KB
-
memory/2412-147-0x0000000000000000-mapping.dmp
-
memory/2472-119-0x0000000000000000-mapping.dmp
-
memory/2816-157-0x0000000000000000-mapping.dmp
-
memory/3588-129-0x0000000000000000-mapping.dmp
-
memory/3588-140-0x0000000000000000-mapping.dmp
-
memory/3792-126-0x0000000000000000-mapping.dmp
-
memory/3828-123-0x0000000000000000-mapping.dmp
-
memory/4124-160-0x0000000000000000-mapping.dmp
-
memory/4344-210-0x0000000004940000-0x0000000004941000-memory.dmpFilesize
4KB
-
memory/4344-211-0x0000000004942000-0x0000000004943000-memory.dmpFilesize
4KB
-
memory/4344-205-0x0000000000000000-mapping.dmp
-
memory/4344-215-0x000000007E790000-0x000000007E791000-memory.dmpFilesize
4KB
-
memory/4344-216-0x0000000004943000-0x0000000004944000-memory.dmpFilesize
4KB
-
memory/4368-206-0x0000000000000000-mapping.dmp
-
memory/4448-208-0x0000000000000000-mapping.dmp
-
memory/4536-212-0x0000000000413FA4-mapping.dmp
-
memory/4536-214-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB