Resubmissions
25-06-2021 19:47
210625-hz8ns8emja 1017-01-2021 17:11
210117-w9egfeq5ps 1015-01-2021 13:57
210115-lga56rptas 10Analysis
-
max time kernel
1798s -
max time network
1812s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
25-06-2021 19:47
Static task
static1
Behavioral task
behavioral1
Sample
Purchase order.exe
Resource
win7v20210408
General
-
Target
Purchase order.exe
-
Size
991KB
-
MD5
dce3742ba75b044a3d033b09bd8f79aa
-
SHA1
44dad4aa8fed90d3a64a320f93fab661581eb814
-
SHA256
e926ec4a14519e184b571d1501e946a7c266e4283af066602c2a1b7c22dcfe19
-
SHA512
fc655c65fad4c9d78e9d66ffffe0f7082f671b356df385092355a1b31c62deaa2b8ca510c215a84606695535e48b2cc33ba7d9ad9365bacf9f32299234771962
Malware Config
Extracted
nanocore
1.2.2.0
kvngnelson007.hopto.org:58931
194.5.98.12:58931
50c8cd66-325e-4bad-929c-caf6d8f1f35b
-
activate_away_mode
false
-
backup_connection_host
194.5.98.12
- backup_dns_server
-
buffer_size
65538
-
build_time
2020-10-19T16:47:10.982906636Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
false
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
58931
-
default_group
070
-
enable_debug_mode
true
-
gc_threshold
1.0485772e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.0485772e+07
-
mutex
50c8cd66-325e-4bad-929c-caf6d8f1f35b
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
kvngnelson007.hopto.org
- primary_dns_server
-
request_elevation
false
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
false
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8009
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Purchase order.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ISS Manager = "C:\\Program Files (x86)\\ISS Manager\\issmgr.exe" Purchase order.exe -
Processes:
Purchase order.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Purchase order.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Purchase order.exedescription pid process target process PID 1852 set thread context of 2608 1852 Purchase order.exe Purchase order.exe -
Drops file in Program Files directory 2 IoCs
Processes:
Purchase order.exedescription ioc process File created C:\Program Files (x86)\ISS Manager\issmgr.exe Purchase order.exe File opened for modification C:\Program Files (x86)\ISS Manager\issmgr.exe Purchase order.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 7 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exefirefox.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 2940 schtasks.exe 2160 schtasks.exe 2660 schtasks.exe -
Modifies registry class 1 IoCs
Processes:
firefox.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings firefox.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
taskmgr.exePurchase order.exePurchase order.exepid process 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1852 Purchase order.exe 1112 taskmgr.exe 2608 Purchase order.exe 2608 Purchase order.exe 2608 Purchase order.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 2608 Purchase order.exe 2608 Purchase order.exe 2608 Purchase order.exe 2608 Purchase order.exe 2608 Purchase order.exe 2608 Purchase order.exe 2608 Purchase order.exe 2608 Purchase order.exe 2608 Purchase order.exe 2608 Purchase order.exe 2608 Purchase order.exe 2608 Purchase order.exe 2608 Purchase order.exe 2608 Purchase order.exe 2608 Purchase order.exe 2608 Purchase order.exe 2608 Purchase order.exe 2608 Purchase order.exe 2608 Purchase order.exe 2608 Purchase order.exe 2608 Purchase order.exe 2608 Purchase order.exe 2608 Purchase order.exe 2608 Purchase order.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Purchase order.exepid process 2608 Purchase order.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
Processes:
taskmgr.exePurchase order.exePurchase order.exefirefox.exeAUDIODG.EXEdescription pid process Token: SeDebugPrivilege 1112 taskmgr.exe Token: SeSystemProfilePrivilege 1112 taskmgr.exe Token: SeCreateGlobalPrivilege 1112 taskmgr.exe Token: SeDebugPrivilege 1852 Purchase order.exe Token: SeDebugPrivilege 2608 Purchase order.exe Token: SeDebugPrivilege 2608 Purchase order.exe Token: 33 1112 taskmgr.exe Token: SeIncBasePriorityPrivilege 1112 taskmgr.exe Token: SeDebugPrivilege 3880 firefox.exe Token: SeDebugPrivilege 3880 firefox.exe Token: 33 4848 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4848 AUDIODG.EXE Token: SeDebugPrivilege 3880 firefox.exe Token: SeDebugPrivilege 3880 firefox.exe Token: SeDebugPrivilege 3880 firefox.exe Token: SeDebugPrivilege 3880 firefox.exe Token: SeDebugPrivilege 3880 firefox.exe Token: SeDebugPrivilege 3880 firefox.exe Token: SeDebugPrivilege 3880 firefox.exe Token: SeDebugPrivilege 3880 firefox.exe Token: SeDebugPrivilege 3880 firefox.exe -
Suspicious use of FindShellTrayWindow 62 IoCs
Processes:
taskmgr.exefirefox.exepid process 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 3880 firefox.exe 3880 firefox.exe 3880 firefox.exe 3880 firefox.exe -
Suspicious use of SendNotifyMessage 61 IoCs
Processes:
taskmgr.exefirefox.exepid process 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 1112 taskmgr.exe 3880 firefox.exe 3880 firefox.exe 3880 firefox.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
firefox.exepid process 3880 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Purchase order.exePurchase order.exefirefox.exefirefox.exedescription pid process target process PID 1852 wrote to memory of 2160 1852 Purchase order.exe schtasks.exe PID 1852 wrote to memory of 2160 1852 Purchase order.exe schtasks.exe PID 1852 wrote to memory of 2160 1852 Purchase order.exe schtasks.exe PID 1852 wrote to memory of 2608 1852 Purchase order.exe Purchase order.exe PID 1852 wrote to memory of 2608 1852 Purchase order.exe Purchase order.exe PID 1852 wrote to memory of 2608 1852 Purchase order.exe Purchase order.exe PID 1852 wrote to memory of 2608 1852 Purchase order.exe Purchase order.exe PID 1852 wrote to memory of 2608 1852 Purchase order.exe Purchase order.exe PID 1852 wrote to memory of 2608 1852 Purchase order.exe Purchase order.exe PID 1852 wrote to memory of 2608 1852 Purchase order.exe Purchase order.exe PID 1852 wrote to memory of 2608 1852 Purchase order.exe Purchase order.exe PID 2608 wrote to memory of 2660 2608 Purchase order.exe schtasks.exe PID 2608 wrote to memory of 2660 2608 Purchase order.exe schtasks.exe PID 2608 wrote to memory of 2660 2608 Purchase order.exe schtasks.exe PID 2608 wrote to memory of 2940 2608 Purchase order.exe schtasks.exe PID 2608 wrote to memory of 2940 2608 Purchase order.exe schtasks.exe PID 2608 wrote to memory of 2940 2608 Purchase order.exe schtasks.exe PID 3484 wrote to memory of 3880 3484 firefox.exe firefox.exe PID 3484 wrote to memory of 3880 3484 firefox.exe firefox.exe PID 3484 wrote to memory of 3880 3484 firefox.exe firefox.exe PID 3484 wrote to memory of 3880 3484 firefox.exe firefox.exe PID 3484 wrote to memory of 3880 3484 firefox.exe firefox.exe PID 3484 wrote to memory of 3880 3484 firefox.exe firefox.exe PID 3484 wrote to memory of 3880 3484 firefox.exe firefox.exe PID 3484 wrote to memory of 3880 3484 firefox.exe firefox.exe PID 3484 wrote to memory of 3880 3484 firefox.exe firefox.exe PID 3880 wrote to memory of 2268 3880 firefox.exe firefox.exe PID 3880 wrote to memory of 2268 3880 firefox.exe firefox.exe PID 3880 wrote to memory of 3512 3880 firefox.exe firefox.exe PID 3880 wrote to memory of 3512 3880 firefox.exe firefox.exe PID 3880 wrote to memory of 3512 3880 firefox.exe firefox.exe PID 3880 wrote to memory of 3512 3880 firefox.exe firefox.exe PID 3880 wrote to memory of 3512 3880 firefox.exe firefox.exe PID 3880 wrote to memory of 3512 3880 firefox.exe firefox.exe PID 3880 wrote to memory of 3512 3880 firefox.exe firefox.exe PID 3880 wrote to memory of 3512 3880 firefox.exe firefox.exe PID 3880 wrote to memory of 3512 3880 firefox.exe firefox.exe PID 3880 wrote to memory of 3512 3880 firefox.exe firefox.exe PID 3880 wrote to memory of 3512 3880 firefox.exe firefox.exe PID 3880 wrote to memory of 3512 3880 firefox.exe firefox.exe PID 3880 wrote to memory of 3512 3880 firefox.exe firefox.exe PID 3880 wrote to memory of 3512 3880 firefox.exe firefox.exe PID 3880 wrote to memory of 3512 3880 firefox.exe firefox.exe PID 3880 wrote to memory of 3512 3880 firefox.exe firefox.exe PID 3880 wrote to memory of 3512 3880 firefox.exe firefox.exe PID 3880 wrote to memory of 3512 3880 firefox.exe firefox.exe PID 3880 wrote to memory of 3512 3880 firefox.exe firefox.exe PID 3880 wrote to memory of 3512 3880 firefox.exe firefox.exe PID 3880 wrote to memory of 3512 3880 firefox.exe firefox.exe PID 3880 wrote to memory of 3512 3880 firefox.exe firefox.exe PID 3880 wrote to memory of 3512 3880 firefox.exe firefox.exe PID 3880 wrote to memory of 3512 3880 firefox.exe firefox.exe PID 3880 wrote to memory of 3512 3880 firefox.exe firefox.exe PID 3880 wrote to memory of 3512 3880 firefox.exe firefox.exe PID 3880 wrote to memory of 3512 3880 firefox.exe firefox.exe PID 3880 wrote to memory of 3512 3880 firefox.exe firefox.exe PID 3880 wrote to memory of 3512 3880 firefox.exe firefox.exe PID 3880 wrote to memory of 3512 3880 firefox.exe firefox.exe PID 3880 wrote to memory of 3512 3880 firefox.exe firefox.exe PID 3880 wrote to memory of 3512 3880 firefox.exe firefox.exe PID 3880 wrote to memory of 3512 3880 firefox.exe firefox.exe PID 3880 wrote to memory of 3512 3880 firefox.exe firefox.exe PID 3880 wrote to memory of 3512 3880 firefox.exe firefox.exe PID 3880 wrote to memory of 3512 3880 firefox.exe firefox.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchase order.exe"C:\Users\Admin\AppData\Local\Temp\Purchase order.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FNcoguahShvrL" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDEBD.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Purchase order.exe"{path}"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "ISS Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmpE312.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "ISS Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpE381.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3880.0.825272848\483654197" -parentBuildID 20200403170909 -prefsHandle 1552 -prefMapHandle 1528 -prefsLen 1 -prefMapSize 219680 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3880 "\\.\pipe\gecko-crash-server-pipe.3880" 1636 gpu3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3880.3.449194873\1630097743" -childID 1 -isForBrowser -prefsHandle 2228 -prefMapHandle 2224 -prefsLen 156 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3880 "\\.\pipe\gecko-crash-server-pipe.3880" 2240 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3880.13.1180122065\656539840" -childID 2 -isForBrowser -prefsHandle 3476 -prefMapHandle 3472 -prefsLen 7013 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3880 "\\.\pipe\gecko-crash-server-pipe.3880" 3484 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3880.20.1546506549\931465705" -childID 3 -isForBrowser -prefsHandle 4704 -prefMapHandle 4724 -prefsLen 7784 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3880 "\\.\pipe\gecko-crash-server-pipe.3880" 4204 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3880.27.1795466185\1281786426" -parentBuildID 20200403170909 -prefsHandle 4224 -prefMapHandle 6752 -prefsLen 8453 -prefMapSize 219680 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3880 "\\.\pipe\gecko-crash-server-pipe.3880" 6740 rdd3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3880.31.384976733\1786070498" -childID 4 -isForBrowser -prefsHandle 8716 -prefMapHandle 8708 -prefsLen 10874 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3880 "\\.\pipe\gecko-crash-server-pipe.3880" 4328 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3880.38.1594110719\685558138" -childID 5 -isForBrowser -prefsHandle 8504 -prefMapHandle 8508 -prefsLen 10874 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3880 "\\.\pipe\gecko-crash-server-pipe.3880" 8532 tab3⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4281⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\ISS Manager\issmgr.exeMD5
dce3742ba75b044a3d033b09bd8f79aa
SHA144dad4aa8fed90d3a64a320f93fab661581eb814
SHA256e926ec4a14519e184b571d1501e946a7c266e4283af066602c2a1b7c22dcfe19
SHA512fc655c65fad4c9d78e9d66ffffe0f7082f671b356df385092355a1b31c62deaa2b8ca510c215a84606695535e48b2cc33ba7d9ad9365bacf9f32299234771962
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Purchase order.exe.logMD5
0c2899d7c6746f42d5bbe088c777f94c
SHA1622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1
SHA2565b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458
SHA512ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078
-
C:\Users\Admin\AppData\Local\Temp\tmpDEBD.tmpMD5
271a5db295515616b681ccd7aeb3d429
SHA1f110a8cdf8de4de0fc041f4c67f1e91417e663c1
SHA2564b7a8efbcc69daeb2b961a78fc31a77c7ef6bc7011f6d5c7f07b480e6fa79b5a
SHA5128e9c324c9b8b8cb3fc3f2620d847e8cf75ab52be34f7a99a490d70f5972fb3122ff369f24c9e42e77658a6d755cc0ec52697920a95e3a69f0384b908c4aff6f5
-
C:\Users\Admin\AppData\Local\Temp\tmpE312.tmpMD5
f177f21e35c921dc1d144924c4aef639
SHA1fdf2ecd0f2e84e98c60c0d76681abbdff3a65ae3
SHA2565eff744c6d467554392eb432cbb7bd27f3cdf51e397625d5dfa1d2904304dc30
SHA5121a956769784fe68c14331329866cf4a8819e5b47bbed249905720449294d71168d27d0b5f88483674ae0ce44ca21fc16ac563950a8da726b72d296fc3d692e94
-
C:\Users\Admin\AppData\Local\Temp\tmpE381.tmpMD5
ea7095fa975a5ac043c9de2899ce61d0
SHA1ba4e21d0728fb1b4b87006c2e8ceb6109c9046a3
SHA2565a1ba7b1b91e0bb7aedcfa82dc687972abb31f72ae1613ac586938ef0843f30f
SHA512b52c8f1b58f263a3d1ad1ef9939167853a5f55033d9ad8976130174c7118407711a0703266c7d2d542bc2ca8119f875e35cc791b9dd70ef83b5310ac1e7cd1cb
-
memory/1852-118-0x00000000017A0000-0x00000000017A1000-memory.dmpFilesize
4KB
-
memory/1852-121-0x0000000006150000-0x00000000061A3000-memory.dmpFilesize
332KB
-
memory/1852-122-0x0000000006250000-0x0000000006251000-memory.dmpFilesize
4KB
-
memory/1852-120-0x0000000003090000-0x0000000003122000-memory.dmpFilesize
584KB
-
memory/1852-114-0x0000000000B80000-0x0000000000B81000-memory.dmpFilesize
4KB
-
memory/1852-119-0x00000000017B0000-0x00000000017BE000-memory.dmpFilesize
56KB
-
memory/1852-117-0x00000000055B0000-0x00000000055B1000-memory.dmpFilesize
4KB
-
memory/1852-116-0x0000000005AB0000-0x0000000005AB1000-memory.dmpFilesize
4KB
-
memory/2160-123-0x0000000000000000-mapping.dmp
-
memory/2268-146-0x0000000000000000-mapping.dmp
-
memory/2608-126-0x000000000041E792-mapping.dmp
-
memory/2608-140-0x0000000005780000-0x0000000005785000-memory.dmpFilesize
20KB
-
memory/2608-139-0x00000000054A0000-0x000000000599E000-memory.dmpFilesize
5.0MB
-
memory/2608-141-0x00000000063D0000-0x00000000063D6000-memory.dmpFilesize
24KB
-
memory/2608-142-0x00000000063E0000-0x00000000063F9000-memory.dmpFilesize
100KB
-
memory/2608-143-0x0000000006510000-0x0000000006513000-memory.dmpFilesize
12KB
-
memory/2608-125-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/2660-134-0x0000000000000000-mapping.dmp
-
memory/2940-136-0x0000000000000000-mapping.dmp
-
memory/3512-151-0x0000000000000000-mapping.dmp
-
memory/3744-154-0x0000000000000000-mapping.dmp
-
memory/3880-144-0x0000000000000000-mapping.dmp
-
memory/4164-165-0x0000000000000000-mapping.dmp
-
memory/4404-156-0x0000000000000000-mapping.dmp
-
memory/4556-167-0x0000000000000000-mapping.dmp
-
memory/4760-158-0x0000000000000000-mapping.dmp
-
memory/4760-159-0x00007FF9E1350000-0x00007FF9E1351000-memory.dmpFilesize
4KB
-
memory/4760-160-0x00007FF9DEF80000-0x00007FF9DEF81000-memory.dmpFilesize
4KB