Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
06-05-2021 02:02
Static task
static1
Behavioral task
behavioral1
Sample
Factura Serfinanza051053709735077235764653194.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Factura Serfinanza051053709735077235764653194.exe
Resource
win10v20210408
General
-
Target
Factura Serfinanza051053709735077235764653194.exe
-
Size
3.3MB
-
MD5
8e3a6cfb86a8c0696133c3526fe9f04b
-
SHA1
0f35083e3cbffe8eabd59f84c5a0e58c3a284c2a
-
SHA256
673500aef66cdad3be016e872ca2cf17bd814857bf53f7ef24a0f534a3a47dcd
-
SHA512
ed74bfc86a85b64ebddbc50a170ed63245f872a72a682c21a3b80776ebba8f54d3042b7750d7d61dcfde9b9b5884b277765cfae51c2ec538df6cffe4ba431b28
Malware Config
Extracted
remcos
databasepropersonombrecomercialideasearchwords.services:3521
Signatures
-
Nirsoft 14 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\016c7916-6082-4521-922f-08d18c951c07\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\016c7916-6082-4521-922f-08d18c951c07\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\016c7916-6082-4521-922f-08d18c951c07\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\016c7916-6082-4521-922f-08d18c951c07\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\016c7916-6082-4521-922f-08d18c951c07\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\016c7916-6082-4521-922f-08d18c951c07\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\016c7916-6082-4521-922f-08d18c951c07\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\bac171dc-3e7c-477b-80bf-00c182832941\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\bac171dc-3e7c-477b-80bf-00c182832941\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\bac171dc-3e7c-477b-80bf-00c182832941\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\bac171dc-3e7c-477b-80bf-00c182832941\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\bac171dc-3e7c-477b-80bf-00c182832941\AdvancedRun.exe Nirsoft \Users\Admin\AppData\Local\Temp\bac171dc-3e7c-477b-80bf-00c182832941\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\bac171dc-3e7c-477b-80bf-00c182832941\AdvancedRun.exe Nirsoft -
Executes dropped EXE 6 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exePxxoServicesTrialNet1.exeAdvancedRun.exeAdvancedRun.exePxxoServicesTrialNet1.exepid process 1472 AdvancedRun.exe 1956 AdvancedRun.exe 1260 PxxoServicesTrialNet1.exe 1472 AdvancedRun.exe 756 AdvancedRun.exe 916 PxxoServicesTrialNet1.exe -
Loads dropped DLL 10 IoCs
Processes:
Factura Serfinanza051053709735077235764653194.exeAdvancedRun.execmd.exePxxoServicesTrialNet1.exeAdvancedRun.exepid process 1056 Factura Serfinanza051053709735077235764653194.exe 1056 Factura Serfinanza051053709735077235764653194.exe 1472 AdvancedRun.exe 1472 AdvancedRun.exe 1596 cmd.exe 1596 cmd.exe 1260 PxxoServicesTrialNet1.exe 1260 PxxoServicesTrialNet1.exe 1472 AdvancedRun.exe 1472 AdvancedRun.exe -
Processes:
Factura Serfinanza051053709735077235764653194.exePxxoServicesTrialNet1.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths Factura Serfinanza051053709735077235764653194.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions Factura Serfinanza051053709735077235764653194.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0" Factura Serfinanza051053709735077235764653194.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features Factura Serfinanza051053709735077235764653194.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe = "0" PxxoServicesTrialNet1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza051053709735077235764653194.exe = "0" Factura Serfinanza051053709735077235764653194.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection Factura Serfinanza051053709735077235764653194.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" Factura Serfinanza051053709735077235764653194.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" Factura Serfinanza051053709735077235764653194.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
Factura Serfinanza051053709735077235764653194.exePxxoServicesTrialNet1.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\ Factura Serfinanza051053709735077235764653194.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\MservicesOrg2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PxxoServicesTrialNet1.exe\"" Factura Serfinanza051053709735077235764653194.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\ PxxoServicesTrialNet1.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\MservicesOrg2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PxxoServicesTrialNet1.exe\"" PxxoServicesTrialNet1.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 21 IoCs
Processes:
Factura Serfinanza051053709735077235764653194.exePxxoServicesTrialNet1.exepid process 1056 Factura Serfinanza051053709735077235764653194.exe 1056 Factura Serfinanza051053709735077235764653194.exe 1056 Factura Serfinanza051053709735077235764653194.exe 1056 Factura Serfinanza051053709735077235764653194.exe 1056 Factura Serfinanza051053709735077235764653194.exe 1056 Factura Serfinanza051053709735077235764653194.exe 1056 Factura Serfinanza051053709735077235764653194.exe 1056 Factura Serfinanza051053709735077235764653194.exe 1056 Factura Serfinanza051053709735077235764653194.exe 1056 Factura Serfinanza051053709735077235764653194.exe 1056 Factura Serfinanza051053709735077235764653194.exe 1260 PxxoServicesTrialNet1.exe 1260 PxxoServicesTrialNet1.exe 1260 PxxoServicesTrialNet1.exe 1260 PxxoServicesTrialNet1.exe 1260 PxxoServicesTrialNet1.exe 1260 PxxoServicesTrialNet1.exe 1260 PxxoServicesTrialNet1.exe 1260 PxxoServicesTrialNet1.exe 1260 PxxoServicesTrialNet1.exe 1260 PxxoServicesTrialNet1.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Factura Serfinanza051053709735077235764653194.exePxxoServicesTrialNet1.exedescription pid process target process PID 1056 set thread context of 764 1056 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 1260 set thread context of 916 1260 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 300 1056 WerFault.exe Factura Serfinanza051053709735077235764653194.exe -
Delays execution with timeout.exe 2 IoCs
Processes:
timeout.exetimeout.exepid process 1040 timeout.exe 1772 timeout.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exepowershell.exeFactura Serfinanza051053709735077235764653194.exeWerFault.exeAdvancedRun.exeAdvancedRun.exePxxoServicesTrialNet1.exepid process 1472 AdvancedRun.exe 1472 AdvancedRun.exe 1956 AdvancedRun.exe 1956 AdvancedRun.exe 552 powershell.exe 1056 Factura Serfinanza051053709735077235764653194.exe 1056 Factura Serfinanza051053709735077235764653194.exe 1056 Factura Serfinanza051053709735077235764653194.exe 552 powershell.exe 300 WerFault.exe 300 WerFault.exe 300 WerFault.exe 300 WerFault.exe 300 WerFault.exe 1472 AdvancedRun.exe 1472 AdvancedRun.exe 756 AdvancedRun.exe 756 AdvancedRun.exe 1260 PxxoServicesTrialNet1.exe 1260 PxxoServicesTrialNet1.exe 1260 PxxoServicesTrialNet1.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
WerFault.exepid process 300 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exepowershell.exeFactura Serfinanza051053709735077235764653194.exeWerFault.exeAdvancedRun.exeAdvancedRun.exePxxoServicesTrialNet1.exedescription pid process Token: SeDebugPrivilege 1472 AdvancedRun.exe Token: SeImpersonatePrivilege 1472 AdvancedRun.exe Token: SeDebugPrivilege 1956 AdvancedRun.exe Token: SeImpersonatePrivilege 1956 AdvancedRun.exe Token: SeDebugPrivilege 552 powershell.exe Token: SeDebugPrivilege 1056 Factura Serfinanza051053709735077235764653194.exe Token: SeDebugPrivilege 300 WerFault.exe Token: SeDebugPrivilege 1472 AdvancedRun.exe Token: SeImpersonatePrivilege 1472 AdvancedRun.exe Token: SeDebugPrivilege 756 AdvancedRun.exe Token: SeImpersonatePrivilege 756 AdvancedRun.exe Token: SeDebugPrivilege 1260 PxxoServicesTrialNet1.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
PxxoServicesTrialNet1.exepid process 916 PxxoServicesTrialNet1.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Factura Serfinanza051053709735077235764653194.exeAdvancedRun.execmd.exeFactura Serfinanza051053709735077235764653194.exeWScript.execmd.exePxxoServicesTrialNet1.exeAdvancedRun.execmd.exedescription pid process target process PID 1056 wrote to memory of 1472 1056 Factura Serfinanza051053709735077235764653194.exe AdvancedRun.exe PID 1056 wrote to memory of 1472 1056 Factura Serfinanza051053709735077235764653194.exe AdvancedRun.exe PID 1056 wrote to memory of 1472 1056 Factura Serfinanza051053709735077235764653194.exe AdvancedRun.exe PID 1056 wrote to memory of 1472 1056 Factura Serfinanza051053709735077235764653194.exe AdvancedRun.exe PID 1472 wrote to memory of 1956 1472 AdvancedRun.exe AdvancedRun.exe PID 1472 wrote to memory of 1956 1472 AdvancedRun.exe AdvancedRun.exe PID 1472 wrote to memory of 1956 1472 AdvancedRun.exe AdvancedRun.exe PID 1472 wrote to memory of 1956 1472 AdvancedRun.exe AdvancedRun.exe PID 1056 wrote to memory of 552 1056 Factura Serfinanza051053709735077235764653194.exe powershell.exe PID 1056 wrote to memory of 552 1056 Factura Serfinanza051053709735077235764653194.exe powershell.exe PID 1056 wrote to memory of 552 1056 Factura Serfinanza051053709735077235764653194.exe powershell.exe PID 1056 wrote to memory of 552 1056 Factura Serfinanza051053709735077235764653194.exe powershell.exe PID 1056 wrote to memory of 916 1056 Factura Serfinanza051053709735077235764653194.exe cmd.exe PID 1056 wrote to memory of 916 1056 Factura Serfinanza051053709735077235764653194.exe cmd.exe PID 1056 wrote to memory of 916 1056 Factura Serfinanza051053709735077235764653194.exe cmd.exe PID 1056 wrote to memory of 916 1056 Factura Serfinanza051053709735077235764653194.exe cmd.exe PID 916 wrote to memory of 1040 916 cmd.exe timeout.exe PID 916 wrote to memory of 1040 916 cmd.exe timeout.exe PID 916 wrote to memory of 1040 916 cmd.exe timeout.exe PID 916 wrote to memory of 1040 916 cmd.exe timeout.exe PID 1056 wrote to memory of 764 1056 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 1056 wrote to memory of 764 1056 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 1056 wrote to memory of 764 1056 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 1056 wrote to memory of 764 1056 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 1056 wrote to memory of 764 1056 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 1056 wrote to memory of 764 1056 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 1056 wrote to memory of 764 1056 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 1056 wrote to memory of 764 1056 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 1056 wrote to memory of 764 1056 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 1056 wrote to memory of 764 1056 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 1056 wrote to memory of 764 1056 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 764 wrote to memory of 240 764 Factura Serfinanza051053709735077235764653194.exe WScript.exe PID 764 wrote to memory of 240 764 Factura Serfinanza051053709735077235764653194.exe WScript.exe PID 764 wrote to memory of 240 764 Factura Serfinanza051053709735077235764653194.exe WScript.exe PID 764 wrote to memory of 240 764 Factura Serfinanza051053709735077235764653194.exe WScript.exe PID 1056 wrote to memory of 300 1056 Factura Serfinanza051053709735077235764653194.exe WerFault.exe PID 1056 wrote to memory of 300 1056 Factura Serfinanza051053709735077235764653194.exe WerFault.exe PID 1056 wrote to memory of 300 1056 Factura Serfinanza051053709735077235764653194.exe WerFault.exe PID 1056 wrote to memory of 300 1056 Factura Serfinanza051053709735077235764653194.exe WerFault.exe PID 240 wrote to memory of 1596 240 WScript.exe cmd.exe PID 240 wrote to memory of 1596 240 WScript.exe cmd.exe PID 240 wrote to memory of 1596 240 WScript.exe cmd.exe PID 240 wrote to memory of 1596 240 WScript.exe cmd.exe PID 1596 wrote to memory of 1260 1596 cmd.exe PxxoServicesTrialNet1.exe PID 1596 wrote to memory of 1260 1596 cmd.exe PxxoServicesTrialNet1.exe PID 1596 wrote to memory of 1260 1596 cmd.exe PxxoServicesTrialNet1.exe PID 1596 wrote to memory of 1260 1596 cmd.exe PxxoServicesTrialNet1.exe PID 1260 wrote to memory of 1472 1260 PxxoServicesTrialNet1.exe AdvancedRun.exe PID 1260 wrote to memory of 1472 1260 PxxoServicesTrialNet1.exe AdvancedRun.exe PID 1260 wrote to memory of 1472 1260 PxxoServicesTrialNet1.exe AdvancedRun.exe PID 1260 wrote to memory of 1472 1260 PxxoServicesTrialNet1.exe AdvancedRun.exe PID 1472 wrote to memory of 756 1472 AdvancedRun.exe AdvancedRun.exe PID 1472 wrote to memory of 756 1472 AdvancedRun.exe AdvancedRun.exe PID 1472 wrote to memory of 756 1472 AdvancedRun.exe AdvancedRun.exe PID 1472 wrote to memory of 756 1472 AdvancedRun.exe AdvancedRun.exe PID 1260 wrote to memory of 1956 1260 PxxoServicesTrialNet1.exe powershell.exe PID 1260 wrote to memory of 1956 1260 PxxoServicesTrialNet1.exe powershell.exe PID 1260 wrote to memory of 1956 1260 PxxoServicesTrialNet1.exe powershell.exe PID 1260 wrote to memory of 1956 1260 PxxoServicesTrialNet1.exe powershell.exe PID 1260 wrote to memory of 948 1260 PxxoServicesTrialNet1.exe cmd.exe PID 1260 wrote to memory of 948 1260 PxxoServicesTrialNet1.exe cmd.exe PID 1260 wrote to memory of 948 1260 PxxoServicesTrialNet1.exe cmd.exe PID 1260 wrote to memory of 948 1260 PxxoServicesTrialNet1.exe cmd.exe PID 948 wrote to memory of 1772 948 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza051053709735077235764653194.exe"C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza051053709735077235764653194.exe"1⤵
- Loads dropped DLL
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\016c7916-6082-4521-922f-08d18c951c07\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\016c7916-6082-4521-922f-08d18c951c07\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\016c7916-6082-4521-922f-08d18c951c07\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\016c7916-6082-4521-922f-08d18c951c07\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\016c7916-6082-4521-922f-08d18c951c07\AdvancedRun.exe" /SpecialRun 4101d8 14723⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza051053709735077235764653194.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza051053709735077235764653194.exe"C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza051053709735077235764653194.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeC:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bac171dc-3e7c-477b-80bf-00c182832941\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\bac171dc-3e7c-477b-80bf-00c182832941\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\bac171dc-3e7c-477b-80bf-00c182832941\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bac171dc-3e7c-477b-80bf-00c182832941\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\bac171dc-3e7c-477b-80bf-00c182832941\AdvancedRun.exe" /SpecialRun 4101d8 14727⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe" -Force6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 16⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 17⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 10122⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\016c7916-6082-4521-922f-08d18c951c07\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\016c7916-6082-4521-922f-08d18c951c07\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\016c7916-6082-4521-922f-08d18c951c07\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\bac171dc-3e7c-477b-80bf-00c182832941\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\bac171dc-3e7c-477b-80bf-00c182832941\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\bac171dc-3e7c-477b-80bf-00c182832941\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\install.vbsMD5
a39af763b1c09ead3c98a6a615f377fe
SHA19bd3d39c89e47fe7072270ecc80b810103235c03
SHA256a3930d7535eb768523ee52bbe69f13f857a0ae0f982d7bfc354d802f21010f8f
SHA5123ed8e33ac95fd2536286b4afb2ed2a082bb5f98843478262b32263a14a5dbe0425de7b8d9662a5e482b207ebf8484ace8009ecd1881a6f6f8b0ccf3b0fdfe5da
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
8e3a6cfb86a8c0696133c3526fe9f04b
SHA10f35083e3cbffe8eabd59f84c5a0e58c3a284c2a
SHA256673500aef66cdad3be016e872ca2cf17bd814857bf53f7ef24a0f534a3a47dcd
SHA512ed74bfc86a85b64ebddbc50a170ed63245f872a72a682c21a3b80776ebba8f54d3042b7750d7d61dcfde9b9b5884b277765cfae51c2ec538df6cffe4ba431b28
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
8e3a6cfb86a8c0696133c3526fe9f04b
SHA10f35083e3cbffe8eabd59f84c5a0e58c3a284c2a
SHA256673500aef66cdad3be016e872ca2cf17bd814857bf53f7ef24a0f534a3a47dcd
SHA512ed74bfc86a85b64ebddbc50a170ed63245f872a72a682c21a3b80776ebba8f54d3042b7750d7d61dcfde9b9b5884b277765cfae51c2ec538df6cffe4ba431b28
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
8e3a6cfb86a8c0696133c3526fe9f04b
SHA10f35083e3cbffe8eabd59f84c5a0e58c3a284c2a
SHA256673500aef66cdad3be016e872ca2cf17bd814857bf53f7ef24a0f534a3a47dcd
SHA512ed74bfc86a85b64ebddbc50a170ed63245f872a72a682c21a3b80776ebba8f54d3042b7750d7d61dcfde9b9b5884b277765cfae51c2ec538df6cffe4ba431b28
-
\Users\Admin\AppData\Local\Temp\016c7916-6082-4521-922f-08d18c951c07\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\016c7916-6082-4521-922f-08d18c951c07\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\016c7916-6082-4521-922f-08d18c951c07\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\016c7916-6082-4521-922f-08d18c951c07\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\bac171dc-3e7c-477b-80bf-00c182832941\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\bac171dc-3e7c-477b-80bf-00c182832941\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\bac171dc-3e7c-477b-80bf-00c182832941\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Local\Temp\bac171dc-3e7c-477b-80bf-00c182832941\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
8e3a6cfb86a8c0696133c3526fe9f04b
SHA10f35083e3cbffe8eabd59f84c5a0e58c3a284c2a
SHA256673500aef66cdad3be016e872ca2cf17bd814857bf53f7ef24a0f534a3a47dcd
SHA512ed74bfc86a85b64ebddbc50a170ed63245f872a72a682c21a3b80776ebba8f54d3042b7750d7d61dcfde9b9b5884b277765cfae51c2ec538df6cffe4ba431b28
-
\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
8e3a6cfb86a8c0696133c3526fe9f04b
SHA10f35083e3cbffe8eabd59f84c5a0e58c3a284c2a
SHA256673500aef66cdad3be016e872ca2cf17bd814857bf53f7ef24a0f534a3a47dcd
SHA512ed74bfc86a85b64ebddbc50a170ed63245f872a72a682c21a3b80776ebba8f54d3042b7750d7d61dcfde9b9b5884b277765cfae51c2ec538df6cffe4ba431b28
-
memory/240-86-0x0000000000000000-mapping.dmp
-
memory/300-88-0x0000000000000000-mapping.dmp
-
memory/300-92-0x0000000000950000-0x0000000000951000-memory.dmpFilesize
4KB
-
memory/552-80-0x0000000002490000-0x0000000002491000-memory.dmpFilesize
4KB
-
memory/552-103-0x0000000005610000-0x0000000005611000-memory.dmpFilesize
4KB
-
memory/552-84-0x00000000049D0000-0x00000000049D1000-memory.dmpFilesize
4KB
-
memory/552-146-0x0000000006310000-0x0000000006311000-memory.dmpFilesize
4KB
-
memory/552-91-0x00000000047D0000-0x00000000047D1000-memory.dmpFilesize
4KB
-
memory/552-131-0x00000000055D0000-0x00000000055D1000-memory.dmpFilesize
4KB
-
memory/552-130-0x0000000006280000-0x0000000006281000-memory.dmpFilesize
4KB
-
memory/552-114-0x000000007EF30000-0x000000007EF31000-memory.dmpFilesize
4KB
-
memory/552-74-0x0000000000000000-mapping.dmp
-
memory/552-116-0x00000000060A0000-0x00000000060A1000-memory.dmpFilesize
4KB
-
memory/552-78-0x0000000002250000-0x0000000002251000-memory.dmpFilesize
4KB
-
memory/552-79-0x0000000004A10000-0x0000000004A11000-memory.dmpFilesize
4KB
-
memory/552-145-0x0000000006300000-0x0000000006301000-memory.dmpFilesize
4KB
-
memory/552-85-0x00000000049D2000-0x00000000049D3000-memory.dmpFilesize
4KB
-
memory/552-123-0x00000000060E0000-0x00000000060E1000-memory.dmpFilesize
4KB
-
memory/756-120-0x0000000000000000-mapping.dmp
-
memory/764-81-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/764-87-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/764-82-0x0000000000413FA4-mapping.dmp
-
memory/916-76-0x0000000000000000-mapping.dmp
-
memory/916-152-0x0000000000413FA4-mapping.dmp
-
memory/916-155-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/948-148-0x0000000000000000-mapping.dmp
-
memory/1040-77-0x0000000000000000-mapping.dmp
-
memory/1056-73-0x0000000004F80000-0x0000000004F81000-memory.dmpFilesize
4KB
-
memory/1056-61-0x0000000000830000-0x00000000008B4000-memory.dmpFilesize
528KB
-
memory/1056-59-0x0000000000930000-0x0000000000931000-memory.dmpFilesize
4KB
-
memory/1260-97-0x0000000000000000-mapping.dmp
-
memory/1260-115-0x0000000000450000-0x0000000000451000-memory.dmpFilesize
4KB
-
memory/1260-99-0x00000000008A0000-0x00000000008A1000-memory.dmpFilesize
4KB
-
memory/1472-66-0x00000000766D1000-0x00000000766D3000-memory.dmpFilesize
8KB
-
memory/1472-64-0x0000000000000000-mapping.dmp
-
memory/1472-108-0x0000000000000000-mapping.dmp
-
memory/1596-93-0x0000000000000000-mapping.dmp
-
memory/1772-150-0x0000000000000000-mapping.dmp
-
memory/1956-147-0x0000000000000000-mapping.dmp
-
memory/1956-70-0x0000000000000000-mapping.dmp