Analysis
-
max time kernel
151s -
max time network
140s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
06-05-2021 02:02
Static task
static1
Behavioral task
behavioral1
Sample
Factura Serfinanza051053709735077235764653194.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Factura Serfinanza051053709735077235764653194.exe
Resource
win10v20210408
General
-
Target
Factura Serfinanza051053709735077235764653194.exe
-
Size
3.3MB
-
MD5
8e3a6cfb86a8c0696133c3526fe9f04b
-
SHA1
0f35083e3cbffe8eabd59f84c5a0e58c3a284c2a
-
SHA256
673500aef66cdad3be016e872ca2cf17bd814857bf53f7ef24a0f534a3a47dcd
-
SHA512
ed74bfc86a85b64ebddbc50a170ed63245f872a72a682c21a3b80776ebba8f54d3042b7750d7d61dcfde9b9b5884b277765cfae51c2ec538df6cffe4ba431b28
Malware Config
Extracted
remcos
databasepropersonombrecomercialideasearchwords.services:3521
Signatures
-
Turns off Windows Defender SpyNet reporting 2 TTPs
-
Nirsoft 6 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\5421debd-63e6-48b7-b7bb-36f239286f9b\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\5421debd-63e6-48b7-b7bb-36f239286f9b\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\5421debd-63e6-48b7-b7bb-36f239286f9b\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\64471e5a-5992-424c-b73e-a4a1c923587b\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\64471e5a-5992-424c-b73e-a4a1c923587b\AdvancedRun.exe Nirsoft C:\Users\Admin\AppData\Local\Temp\64471e5a-5992-424c-b73e-a4a1c923587b\AdvancedRun.exe Nirsoft -
Executes dropped EXE 7 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exePxxoServicesTrialNet1.exeAdvancedRun.exeAdvancedRun.exePxxoServicesTrialNet1.exePxxoServicesTrialNet1.exepid process 3192 AdvancedRun.exe 3036 AdvancedRun.exe 2952 PxxoServicesTrialNet1.exe 1928 AdvancedRun.exe 2180 AdvancedRun.exe 4132 PxxoServicesTrialNet1.exe 4140 PxxoServicesTrialNet1.exe -
Processes:
Factura Serfinanza051053709735077235764653194.exePxxoServicesTrialNet1.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions Factura Serfinanza051053709735077235764653194.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza051053709735077235764653194.exe = "0" Factura Serfinanza051053709735077235764653194.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet Factura Serfinanza051053709735077235764653194.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" Factura Serfinanza051053709735077235764653194.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths Factura Serfinanza051053709735077235764653194.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection Factura Serfinanza051053709735077235764653194.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" Factura Serfinanza051053709735077235764653194.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0" Factura Serfinanza051053709735077235764653194.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0" Factura Serfinanza051053709735077235764653194.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features Factura Serfinanza051053709735077235764653194.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe = "0" PxxoServicesTrialNet1.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
Factura Serfinanza051053709735077235764653194.exePxxoServicesTrialNet1.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ Factura Serfinanza051053709735077235764653194.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\MservicesOrg2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PxxoServicesTrialNet1.exe\"" Factura Serfinanza051053709735077235764653194.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ PxxoServicesTrialNet1.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\MservicesOrg2 = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PxxoServicesTrialNet1.exe\"" PxxoServicesTrialNet1.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 24 IoCs
Processes:
Factura Serfinanza051053709735077235764653194.exePxxoServicesTrialNet1.exepid process 2840 Factura Serfinanza051053709735077235764653194.exe 2840 Factura Serfinanza051053709735077235764653194.exe 2840 Factura Serfinanza051053709735077235764653194.exe 2840 Factura Serfinanza051053709735077235764653194.exe 2840 Factura Serfinanza051053709735077235764653194.exe 2840 Factura Serfinanza051053709735077235764653194.exe 2840 Factura Serfinanza051053709735077235764653194.exe 2840 Factura Serfinanza051053709735077235764653194.exe 2840 Factura Serfinanza051053709735077235764653194.exe 2840 Factura Serfinanza051053709735077235764653194.exe 2840 Factura Serfinanza051053709735077235764653194.exe 2840 Factura Serfinanza051053709735077235764653194.exe 2952 PxxoServicesTrialNet1.exe 2952 PxxoServicesTrialNet1.exe 2952 PxxoServicesTrialNet1.exe 2952 PxxoServicesTrialNet1.exe 2952 PxxoServicesTrialNet1.exe 2952 PxxoServicesTrialNet1.exe 2952 PxxoServicesTrialNet1.exe 2952 PxxoServicesTrialNet1.exe 2952 PxxoServicesTrialNet1.exe 2952 PxxoServicesTrialNet1.exe 2952 PxxoServicesTrialNet1.exe 2952 PxxoServicesTrialNet1.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Factura Serfinanza051053709735077235764653194.exePxxoServicesTrialNet1.exedescription pid process target process PID 2840 set thread context of 3500 2840 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 2952 set thread context of 4140 2952 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe -
Drops file in Windows directory 1 IoCs
Processes:
WerFault.exedescription ioc process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3820 2840 WerFault.exe Factura Serfinanza051053709735077235764653194.exe 4188 2952 WerFault.exe PxxoServicesTrialNet1.exe -
Delays execution with timeout.exe 2 IoCs
Processes:
timeout.exetimeout.exepid process 1284 timeout.exe 2184 timeout.exe -
Modifies registry class 1 IoCs
Processes:
Factura Serfinanza051053709735077235764653194.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings Factura Serfinanza051053709735077235764653194.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exepowershell.exeFactura Serfinanza051053709735077235764653194.exeWerFault.exeAdvancedRun.exeAdvancedRun.exepowershell.exePxxoServicesTrialNet1.exeWerFault.exepid process 3192 AdvancedRun.exe 3192 AdvancedRun.exe 3192 AdvancedRun.exe 3192 AdvancedRun.exe 3036 AdvancedRun.exe 3036 AdvancedRun.exe 3036 AdvancedRun.exe 3036 AdvancedRun.exe 1484 powershell.exe 2840 Factura Serfinanza051053709735077235764653194.exe 2840 Factura Serfinanza051053709735077235764653194.exe 2840 Factura Serfinanza051053709735077235764653194.exe 2840 Factura Serfinanza051053709735077235764653194.exe 2840 Factura Serfinanza051053709735077235764653194.exe 2840 Factura Serfinanza051053709735077235764653194.exe 2840 Factura Serfinanza051053709735077235764653194.exe 1484 powershell.exe 1484 powershell.exe 3820 WerFault.exe 3820 WerFault.exe 3820 WerFault.exe 3820 WerFault.exe 3820 WerFault.exe 3820 WerFault.exe 3820 WerFault.exe 3820 WerFault.exe 3820 WerFault.exe 3820 WerFault.exe 3820 WerFault.exe 3820 WerFault.exe 3820 WerFault.exe 3820 WerFault.exe 3820 WerFault.exe 1928 AdvancedRun.exe 1928 AdvancedRun.exe 1928 AdvancedRun.exe 1928 AdvancedRun.exe 2180 AdvancedRun.exe 2180 AdvancedRun.exe 2180 AdvancedRun.exe 2180 AdvancedRun.exe 1440 powershell.exe 1440 powershell.exe 1440 powershell.exe 2952 PxxoServicesTrialNet1.exe 2952 PxxoServicesTrialNet1.exe 2952 PxxoServicesTrialNet1.exe 2952 PxxoServicesTrialNet1.exe 2952 PxxoServicesTrialNet1.exe 4188 WerFault.exe 4188 WerFault.exe 4188 WerFault.exe 4188 WerFault.exe 4188 WerFault.exe 4188 WerFault.exe 4188 WerFault.exe 4188 WerFault.exe 4188 WerFault.exe 4188 WerFault.exe 4188 WerFault.exe 4188 WerFault.exe 4188 WerFault.exe 4188 WerFault.exe 4188 WerFault.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
PxxoServicesTrialNet1.exepid process 4140 PxxoServicesTrialNet1.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
Processes:
AdvancedRun.exeAdvancedRun.exepowershell.exeFactura Serfinanza051053709735077235764653194.exeWerFault.exeAdvancedRun.exeAdvancedRun.exepowershell.exePxxoServicesTrialNet1.exeWerFault.exedescription pid process Token: SeDebugPrivilege 3192 AdvancedRun.exe Token: SeImpersonatePrivilege 3192 AdvancedRun.exe Token: SeDebugPrivilege 3036 AdvancedRun.exe Token: SeImpersonatePrivilege 3036 AdvancedRun.exe Token: SeDebugPrivilege 1484 powershell.exe Token: SeDebugPrivilege 2840 Factura Serfinanza051053709735077235764653194.exe Token: SeRestorePrivilege 3820 WerFault.exe Token: SeBackupPrivilege 3820 WerFault.exe Token: SeBackupPrivilege 3820 WerFault.exe Token: SeDebugPrivilege 3820 WerFault.exe Token: SeDebugPrivilege 1928 AdvancedRun.exe Token: SeImpersonatePrivilege 1928 AdvancedRun.exe Token: SeDebugPrivilege 2180 AdvancedRun.exe Token: SeImpersonatePrivilege 2180 AdvancedRun.exe Token: SeDebugPrivilege 1440 powershell.exe Token: SeDebugPrivilege 2952 PxxoServicesTrialNet1.exe Token: SeDebugPrivilege 4188 WerFault.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
PxxoServicesTrialNet1.exepid process 4140 PxxoServicesTrialNet1.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Factura Serfinanza051053709735077235764653194.exeAdvancedRun.execmd.exeFactura Serfinanza051053709735077235764653194.exeWScript.execmd.exePxxoServicesTrialNet1.exeAdvancedRun.execmd.exedescription pid process target process PID 2840 wrote to memory of 3192 2840 Factura Serfinanza051053709735077235764653194.exe AdvancedRun.exe PID 2840 wrote to memory of 3192 2840 Factura Serfinanza051053709735077235764653194.exe AdvancedRun.exe PID 2840 wrote to memory of 3192 2840 Factura Serfinanza051053709735077235764653194.exe AdvancedRun.exe PID 3192 wrote to memory of 3036 3192 AdvancedRun.exe AdvancedRun.exe PID 3192 wrote to memory of 3036 3192 AdvancedRun.exe AdvancedRun.exe PID 3192 wrote to memory of 3036 3192 AdvancedRun.exe AdvancedRun.exe PID 2840 wrote to memory of 1484 2840 Factura Serfinanza051053709735077235764653194.exe powershell.exe PID 2840 wrote to memory of 1484 2840 Factura Serfinanza051053709735077235764653194.exe powershell.exe PID 2840 wrote to memory of 1484 2840 Factura Serfinanza051053709735077235764653194.exe powershell.exe PID 2840 wrote to memory of 3004 2840 Factura Serfinanza051053709735077235764653194.exe cmd.exe PID 2840 wrote to memory of 3004 2840 Factura Serfinanza051053709735077235764653194.exe cmd.exe PID 2840 wrote to memory of 3004 2840 Factura Serfinanza051053709735077235764653194.exe cmd.exe PID 3004 wrote to memory of 1284 3004 cmd.exe timeout.exe PID 3004 wrote to memory of 1284 3004 cmd.exe timeout.exe PID 3004 wrote to memory of 1284 3004 cmd.exe timeout.exe PID 2840 wrote to memory of 776 2840 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 2840 wrote to memory of 776 2840 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 2840 wrote to memory of 776 2840 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 2840 wrote to memory of 1384 2840 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 2840 wrote to memory of 1384 2840 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 2840 wrote to memory of 1384 2840 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 2840 wrote to memory of 3500 2840 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 2840 wrote to memory of 3500 2840 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 2840 wrote to memory of 3500 2840 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 2840 wrote to memory of 3500 2840 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 2840 wrote to memory of 3500 2840 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 2840 wrote to memory of 3500 2840 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 2840 wrote to memory of 3500 2840 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 2840 wrote to memory of 3500 2840 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 2840 wrote to memory of 3500 2840 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 2840 wrote to memory of 3500 2840 Factura Serfinanza051053709735077235764653194.exe Factura Serfinanza051053709735077235764653194.exe PID 3500 wrote to memory of 1088 3500 Factura Serfinanza051053709735077235764653194.exe WScript.exe PID 3500 wrote to memory of 1088 3500 Factura Serfinanza051053709735077235764653194.exe WScript.exe PID 3500 wrote to memory of 1088 3500 Factura Serfinanza051053709735077235764653194.exe WScript.exe PID 1088 wrote to memory of 2336 1088 WScript.exe cmd.exe PID 1088 wrote to memory of 2336 1088 WScript.exe cmd.exe PID 1088 wrote to memory of 2336 1088 WScript.exe cmd.exe PID 2336 wrote to memory of 2952 2336 cmd.exe PxxoServicesTrialNet1.exe PID 2336 wrote to memory of 2952 2336 cmd.exe PxxoServicesTrialNet1.exe PID 2336 wrote to memory of 2952 2336 cmd.exe PxxoServicesTrialNet1.exe PID 2952 wrote to memory of 1928 2952 PxxoServicesTrialNet1.exe AdvancedRun.exe PID 2952 wrote to memory of 1928 2952 PxxoServicesTrialNet1.exe AdvancedRun.exe PID 2952 wrote to memory of 1928 2952 PxxoServicesTrialNet1.exe AdvancedRun.exe PID 1928 wrote to memory of 2180 1928 AdvancedRun.exe AdvancedRun.exe PID 1928 wrote to memory of 2180 1928 AdvancedRun.exe AdvancedRun.exe PID 1928 wrote to memory of 2180 1928 AdvancedRun.exe AdvancedRun.exe PID 2952 wrote to memory of 1440 2952 PxxoServicesTrialNet1.exe powershell.exe PID 2952 wrote to memory of 1440 2952 PxxoServicesTrialNet1.exe powershell.exe PID 2952 wrote to memory of 1440 2952 PxxoServicesTrialNet1.exe powershell.exe PID 2952 wrote to memory of 1284 2952 PxxoServicesTrialNet1.exe cmd.exe PID 2952 wrote to memory of 1284 2952 PxxoServicesTrialNet1.exe cmd.exe PID 2952 wrote to memory of 1284 2952 PxxoServicesTrialNet1.exe cmd.exe PID 1284 wrote to memory of 2184 1284 cmd.exe timeout.exe PID 1284 wrote to memory of 2184 1284 cmd.exe timeout.exe PID 1284 wrote to memory of 2184 1284 cmd.exe timeout.exe PID 2952 wrote to memory of 4132 2952 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2952 wrote to memory of 4132 2952 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2952 wrote to memory of 4132 2952 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2952 wrote to memory of 4140 2952 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2952 wrote to memory of 4140 2952 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2952 wrote to memory of 4140 2952 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2952 wrote to memory of 4140 2952 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2952 wrote to memory of 4140 2952 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe PID 2952 wrote to memory of 4140 2952 PxxoServicesTrialNet1.exe PxxoServicesTrialNet1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza051053709735077235764653194.exe"C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza051053709735077235764653194.exe"1⤵
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5421debd-63e6-48b7-b7bb-36f239286f9b\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\5421debd-63e6-48b7-b7bb-36f239286f9b\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\5421debd-63e6-48b7-b7bb-36f239286f9b\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5421debd-63e6-48b7-b7bb-36f239286f9b\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\5421debd-63e6-48b7-b7bb-36f239286f9b\AdvancedRun.exe" /SpecialRun 4101d8 31923⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza051053709735077235764653194.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza051053709735077235764653194.exe"C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza051053709735077235764653194.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza051053709735077235764653194.exe"C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza051053709735077235764653194.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza051053709735077235764653194.exe"C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza051053709735077235764653194.exe"2⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeC:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe5⤵
- Executes dropped EXE
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\64471e5a-5992-424c-b73e-a4a1c923587b\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\64471e5a-5992-424c-b73e-a4a1c923587b\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\64471e5a-5992-424c-b73e-a4a1c923587b\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\64471e5a-5992-424c-b73e-a4a1c923587b\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\64471e5a-5992-424c-b73e-a4a1c923587b\AdvancedRun.exe" /SpecialRun 4101d8 19287⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe" -Force6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 16⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 17⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 15926⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 16002⤵
- Drops file in Windows directory
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logMD5
db01a2c1c7e70b2b038edf8ad5ad9826
SHA1540217c647a73bad8d8a79e3a0f3998b5abd199b
SHA256413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d
SHA512c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
23345c982d57b7c70effcb3887a73194
SHA10633618f61abe5e3784733c2659506afdf86c670
SHA256deec00e18f468fc1998c55afd0d5b1d9e73b7d8897915206ef4e4da72189d5d4
SHA5125a77a55db8e4217e9f5547d492446b9f17849b7d463ce2164f2696971fbc9d20525c7ce8b57e1cf9e4cd5e5aa5ea50430bc95c1764489e44d7c0b28e497b199d
-
C:\Users\Admin\AppData\Local\Temp\5421debd-63e6-48b7-b7bb-36f239286f9b\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\5421debd-63e6-48b7-b7bb-36f239286f9b\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\5421debd-63e6-48b7-b7bb-36f239286f9b\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\64471e5a-5992-424c-b73e-a4a1c923587b\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\64471e5a-5992-424c-b73e-a4a1c923587b\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\64471e5a-5992-424c-b73e-a4a1c923587b\AdvancedRun.exeMD5
17fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
C:\Users\Admin\AppData\Local\Temp\install.vbsMD5
a39af763b1c09ead3c98a6a615f377fe
SHA19bd3d39c89e47fe7072270ecc80b810103235c03
SHA256a3930d7535eb768523ee52bbe69f13f857a0ae0f982d7bfc354d802f21010f8f
SHA5123ed8e33ac95fd2536286b4afb2ed2a082bb5f98843478262b32263a14a5dbe0425de7b8d9662a5e482b207ebf8484ace8009ecd1881a6f6f8b0ccf3b0fdfe5da
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
8e3a6cfb86a8c0696133c3526fe9f04b
SHA10f35083e3cbffe8eabd59f84c5a0e58c3a284c2a
SHA256673500aef66cdad3be016e872ca2cf17bd814857bf53f7ef24a0f534a3a47dcd
SHA512ed74bfc86a85b64ebddbc50a170ed63245f872a72a682c21a3b80776ebba8f54d3042b7750d7d61dcfde9b9b5884b277765cfae51c2ec538df6cffe4ba431b28
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
8e3a6cfb86a8c0696133c3526fe9f04b
SHA10f35083e3cbffe8eabd59f84c5a0e58c3a284c2a
SHA256673500aef66cdad3be016e872ca2cf17bd814857bf53f7ef24a0f534a3a47dcd
SHA512ed74bfc86a85b64ebddbc50a170ed63245f872a72a682c21a3b80776ebba8f54d3042b7750d7d61dcfde9b9b5884b277765cfae51c2ec538df6cffe4ba431b28
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
8e3a6cfb86a8c0696133c3526fe9f04b
SHA10f35083e3cbffe8eabd59f84c5a0e58c3a284c2a
SHA256673500aef66cdad3be016e872ca2cf17bd814857bf53f7ef24a0f534a3a47dcd
SHA512ed74bfc86a85b64ebddbc50a170ed63245f872a72a682c21a3b80776ebba8f54d3042b7750d7d61dcfde9b9b5884b277765cfae51c2ec538df6cffe4ba431b28
-
C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exeMD5
8e3a6cfb86a8c0696133c3526fe9f04b
SHA10f35083e3cbffe8eabd59f84c5a0e58c3a284c2a
SHA256673500aef66cdad3be016e872ca2cf17bd814857bf53f7ef24a0f534a3a47dcd
SHA512ed74bfc86a85b64ebddbc50a170ed63245f872a72a682c21a3b80776ebba8f54d3042b7750d7d61dcfde9b9b5884b277765cfae51c2ec538df6cffe4ba431b28
-
memory/1088-140-0x0000000000000000-mapping.dmp
-
memory/1284-131-0x0000000000000000-mapping.dmp
-
memory/1284-206-0x0000000000000000-mapping.dmp
-
memory/1440-205-0x0000000000000000-mapping.dmp
-
memory/1440-207-0x00000000042E0000-0x00000000042E1000-memory.dmpFilesize
4KB
-
memory/1440-209-0x00000000042E2000-0x00000000042E3000-memory.dmpFilesize
4KB
-
memory/1440-214-0x000000007F9C0000-0x000000007F9C1000-memory.dmpFilesize
4KB
-
memory/1440-215-0x00000000042E3000-0x00000000042E4000-memory.dmpFilesize
4KB
-
memory/1484-181-0x000000007ED20000-0x000000007ED21000-memory.dmpFilesize
4KB
-
memory/1484-125-0x0000000000000000-mapping.dmp
-
memory/1484-139-0x0000000007522000-0x0000000007523000-memory.dmpFilesize
4KB
-
memory/1484-141-0x00000000087C0000-0x00000000087C1000-memory.dmpFilesize
4KB
-
memory/1484-142-0x00000000087E0000-0x00000000087E1000-memory.dmpFilesize
4KB
-
memory/1484-137-0x0000000008370000-0x0000000008371000-memory.dmpFilesize
4KB
-
memory/1484-138-0x0000000007520000-0x0000000007521000-memory.dmpFilesize
4KB
-
memory/1484-145-0x0000000008B80000-0x0000000008B81000-memory.dmpFilesize
4KB
-
memory/1484-129-0x0000000004FD0000-0x0000000004FD1000-memory.dmpFilesize
4KB
-
memory/1484-130-0x0000000007B60000-0x0000000007B61000-memory.dmpFilesize
4KB
-
memory/1484-204-0x0000000007523000-0x0000000007524000-memory.dmpFilesize
4KB
-
memory/1484-182-0x0000000009DE0000-0x0000000009DE1000-memory.dmpFilesize
4KB
-
memory/1484-180-0x0000000009BA0000-0x0000000009BA1000-memory.dmpFilesize
4KB
-
memory/1484-132-0x0000000007B00000-0x0000000007B01000-memory.dmpFilesize
4KB
-
memory/1484-134-0x0000000008290000-0x0000000008291000-memory.dmpFilesize
4KB
-
memory/1484-165-0x0000000009A70000-0x0000000009AA3000-memory.dmpFilesize
204KB
-
memory/1484-133-0x0000000008300000-0x0000000008301000-memory.dmpFilesize
4KB
-
memory/1484-173-0x0000000009A50000-0x0000000009A51000-memory.dmpFilesize
4KB
-
memory/1928-161-0x0000000000000000-mapping.dmp
-
memory/2180-174-0x0000000000000000-mapping.dmp
-
memory/2184-208-0x0000000000000000-mapping.dmp
-
memory/2336-148-0x0000000000000000-mapping.dmp
-
memory/2840-114-0x0000000000A30000-0x0000000000A31000-memory.dmpFilesize
4KB
-
memory/2840-116-0x00000000055C0000-0x00000000055C1000-memory.dmpFilesize
4KB
-
memory/2840-119-0x0000000005DD0000-0x0000000005DD1000-memory.dmpFilesize
4KB
-
memory/2840-117-0x00000000058C0000-0x00000000058C1000-memory.dmpFilesize
4KB
-
memory/2840-118-0x0000000002FE0000-0x0000000003064000-memory.dmpFilesize
528KB
-
memory/2952-149-0x0000000000000000-mapping.dmp
-
memory/2952-157-0x0000000004F70000-0x0000000004F71000-memory.dmpFilesize
4KB
-
memory/3004-126-0x0000000000000000-mapping.dmp
-
memory/3036-123-0x0000000000000000-mapping.dmp
-
memory/3192-120-0x0000000000000000-mapping.dmp
-
memory/3500-135-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/3500-144-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/3500-136-0x0000000000413FA4-mapping.dmp
-
memory/4140-213-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/4140-211-0x0000000000413FA4-mapping.dmp