Analysis
-
max time kernel
61s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
17-07-2021 00:04
Static task
static1
Behavioral task
behavioral1
Sample
c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe
Resource
win7v20210410
General
-
Target
c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe
-
Size
696KB
-
MD5
6ea14e473644f3bea03782f41d7c5246
-
SHA1
3be05d9f18b574c5c4eea2f8ab8160c470553aeb
-
SHA256
c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43
-
SHA512
7fcb2c62bd9d4a569ce0fd788068bfab133595d8ef54957aa5ed4295b1988a92c7d62fdd465e2c34152f02e39a022015ac2868c4b97df1327862d41c60885f59
Malware Config
Extracted
pony
http://fuckoff.av.com/gate.php
http://mrson.dan.al/sddob/gate.php
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 1196 created 3032 1196 WerFault.exe Explorer.EXE -
Executes dropped EXE 3 IoCs
Processes:
lsass.exelsass.exelsass.exepid process 1316 lsass.exe 3924 lsass.exe 2332 lsass.exe -
Processes:
resource yara_rule behavioral2/memory/2376-117-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/2376-129-0x0000000000400000-0x0000000000420000-memory.dmp upx -
Drops startup file 1 IoCs
Processes:
c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 7 IoCs
Processes:
c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exec565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exelsass.exelsass.exedescription pid process target process PID 396 set thread context of 2376 396 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe PID 2376 set thread context of 948 2376 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe PID 396 set thread context of 3728 396 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe PID 1316 set thread context of 3924 1316 lsass.exe lsass.exe PID 3924 set thread context of 2332 3924 lsass.exe lsass.exe PID 1316 set thread context of 644 1316 lsass.exe lsass.exe PID 1316 set thread context of 644 1316 lsass.exe lsass.exe -
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2308 396 WerFault.exe c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe 1196 3032 WerFault.exe Explorer.EXE 3048 3780 WerFault.exe 2740 1316 WerFault.exe lsass.exe -
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
WerFault.exeExplorer.EXEWerFault.exeWerFault.exepid process 2308 WerFault.exe 2308 WerFault.exe 2308 WerFault.exe 2308 WerFault.exe 2308 WerFault.exe 2308 WerFault.exe 2308 WerFault.exe 2308 WerFault.exe 2308 WerFault.exe 2308 WerFault.exe 2308 WerFault.exe 2308 WerFault.exe 2308 WerFault.exe 2308 WerFault.exe 3032 Explorer.EXE 3032 Explorer.EXE 3048 WerFault.exe 3048 WerFault.exe 3048 WerFault.exe 3048 WerFault.exe 3048 WerFault.exe 3048 WerFault.exe 3048 WerFault.exe 3048 WerFault.exe 3048 WerFault.exe 3048 WerFault.exe 3048 WerFault.exe 3048 WerFault.exe 3048 WerFault.exe 3048 WerFault.exe 3048 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe 2740 WerFault.exe -
Suspicious behavior: MapViewOfSection 14 IoCs
Processes:
lsass.exeexplorer.exeExplorer.EXElsass.exepid process 2332 lsass.exe 3424 explorer.exe 3032 Explorer.EXE 3032 Explorer.EXE 3032 Explorer.EXE 3032 Explorer.EXE 3032 Explorer.EXE 3032 Explorer.EXE 3032 Explorer.EXE 3032 Explorer.EXE 3032 Explorer.EXE 3032 Explorer.EXE 3032 Explorer.EXE 1316 lsass.exe -
Suspicious use of AdjustPrivilegeToken 52 IoCs
Processes:
c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exec565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exeWerFault.exelsass.exeExplorer.EXEWerFault.exeWerFault.exedescription pid process Token: SeDebugPrivilege 948 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe Token: SeImpersonatePrivilege 3728 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe Token: SeTcbPrivilege 3728 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe Token: SeChangeNotifyPrivilege 3728 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe Token: SeCreateTokenPrivilege 3728 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe Token: SeBackupPrivilege 3728 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe Token: SeRestorePrivilege 3728 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe Token: SeIncreaseQuotaPrivilege 3728 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe Token: SeAssignPrimaryTokenPrivilege 3728 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe Token: SeRestorePrivilege 2308 WerFault.exe Token: SeBackupPrivilege 2308 WerFault.exe Token: SeImpersonatePrivilege 3728 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe Token: SeTcbPrivilege 3728 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe Token: SeChangeNotifyPrivilege 3728 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe Token: SeCreateTokenPrivilege 3728 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe Token: SeBackupPrivilege 3728 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe Token: SeRestorePrivilege 3728 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe Token: SeIncreaseQuotaPrivilege 3728 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe Token: SeAssignPrimaryTokenPrivilege 3728 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe Token: SeImpersonatePrivilege 3728 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe Token: SeTcbPrivilege 3728 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe Token: SeChangeNotifyPrivilege 3728 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe Token: SeCreateTokenPrivilege 3728 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe Token: SeBackupPrivilege 3728 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe Token: SeRestorePrivilege 3728 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe Token: SeDebugPrivilege 2308 WerFault.exe Token: SeIncreaseQuotaPrivilege 3728 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe Token: SeAssignPrimaryTokenPrivilege 3728 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe Token: SeImpersonatePrivilege 3728 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe Token: SeTcbPrivilege 3728 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe Token: SeChangeNotifyPrivilege 3728 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe Token: SeCreateTokenPrivilege 3728 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe Token: SeBackupPrivilege 3728 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe Token: SeRestorePrivilege 3728 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe Token: SeIncreaseQuotaPrivilege 3728 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe Token: SeAssignPrimaryTokenPrivilege 3728 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe Token: SeImpersonatePrivilege 3728 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe Token: SeTcbPrivilege 3728 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe Token: SeChangeNotifyPrivilege 3728 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe Token: SeCreateTokenPrivilege 3728 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe Token: SeBackupPrivilege 3728 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe Token: SeRestorePrivilege 3728 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe Token: SeIncreaseQuotaPrivilege 3728 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe Token: SeAssignPrimaryTokenPrivilege 3728 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe Token: SeDebugPrivilege 2332 lsass.exe Token: SeShutdownPrivilege 3032 Explorer.EXE Token: SeCreatePagefilePrivilege 3032 Explorer.EXE Token: SeShutdownPrivilege 3032 Explorer.EXE Token: SeCreatePagefilePrivilege 3032 Explorer.EXE Token: SeDebugPrivilege 3032 Explorer.EXE Token: SeDebugPrivilege 3048 WerFault.exe Token: SeDebugPrivilege 2740 WerFault.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exec565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exelsass.exelsass.exepid process 396 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe 2376 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe 1316 lsass.exe 3924 lsass.exe -
Suspicious use of WriteProcessMemory 49 IoCs
Processes:
c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exec565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exec565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exelsass.exelsass.exelsass.exedescription pid process target process PID 396 wrote to memory of 2376 396 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe PID 396 wrote to memory of 2376 396 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe PID 396 wrote to memory of 2376 396 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe PID 396 wrote to memory of 2376 396 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe PID 396 wrote to memory of 2376 396 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe PID 396 wrote to memory of 2376 396 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe PID 396 wrote to memory of 2376 396 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe PID 396 wrote to memory of 2376 396 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe PID 2376 wrote to memory of 948 2376 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe PID 2376 wrote to memory of 948 2376 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe PID 2376 wrote to memory of 948 2376 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe PID 2376 wrote to memory of 948 2376 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe PID 2376 wrote to memory of 948 2376 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe PID 2376 wrote to memory of 948 2376 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe PID 948 wrote to memory of 1316 948 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe lsass.exe PID 948 wrote to memory of 1316 948 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe lsass.exe PID 948 wrote to memory of 1316 948 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe lsass.exe PID 396 wrote to memory of 3728 396 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe PID 396 wrote to memory of 3728 396 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe PID 396 wrote to memory of 3728 396 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe PID 396 wrote to memory of 3728 396 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe PID 396 wrote to memory of 3728 396 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe PID 396 wrote to memory of 3728 396 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe PID 396 wrote to memory of 3728 396 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe PID 396 wrote to memory of 3728 396 c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe PID 1316 wrote to memory of 3924 1316 lsass.exe lsass.exe PID 1316 wrote to memory of 3924 1316 lsass.exe lsass.exe PID 1316 wrote to memory of 3924 1316 lsass.exe lsass.exe PID 1316 wrote to memory of 3924 1316 lsass.exe lsass.exe PID 1316 wrote to memory of 3924 1316 lsass.exe lsass.exe PID 1316 wrote to memory of 3924 1316 lsass.exe lsass.exe PID 1316 wrote to memory of 3924 1316 lsass.exe lsass.exe PID 1316 wrote to memory of 3924 1316 lsass.exe lsass.exe PID 3924 wrote to memory of 2332 3924 lsass.exe lsass.exe PID 3924 wrote to memory of 2332 3924 lsass.exe lsass.exe PID 3924 wrote to memory of 2332 3924 lsass.exe lsass.exe PID 3924 wrote to memory of 2332 3924 lsass.exe lsass.exe PID 3924 wrote to memory of 2332 3924 lsass.exe lsass.exe PID 3924 wrote to memory of 2332 3924 lsass.exe lsass.exe PID 2332 wrote to memory of 3424 2332 lsass.exe explorer.exe PID 2332 wrote to memory of 3424 2332 lsass.exe explorer.exe PID 1316 wrote to memory of 644 1316 lsass.exe lsass.exe PID 1316 wrote to memory of 644 1316 lsass.exe lsass.exe PID 1316 wrote to memory of 644 1316 lsass.exe lsass.exe PID 1316 wrote to memory of 644 1316 lsass.exe lsass.exe PID 1316 wrote to memory of 644 1316 lsass.exe lsass.exe PID 1316 wrote to memory of 644 1316 lsass.exe lsass.exe PID 1316 wrote to memory of 644 1316 lsass.exe lsass.exe PID 1316 wrote to memory of 644 1316 lsass.exe lsass.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe"C:\Users\Admin\AppData\Local\Temp\c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe"C:\Users\Admin\AppData\Local\Temp\c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe"C:\Users\Admin\AppData\Local\Temp\c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe"4⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe"7⤵
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeC:\Windows\explorer.exe8⤵
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 5406⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe"C:\Users\Admin\AppData\Local\Temp\c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 4843⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3032 -s 70282⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3780 -s 9041⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exeMD5
6ea14e473644f3bea03782f41d7c5246
SHA13be05d9f18b574c5c4eea2f8ab8160c470553aeb
SHA256c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43
SHA5127fcb2c62bd9d4a569ce0fd788068bfab133595d8ef54957aa5ed4295b1988a92c7d62fdd465e2c34152f02e39a022015ac2868c4b97df1327862d41c60885f59
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exeMD5
6ea14e473644f3bea03782f41d7c5246
SHA13be05d9f18b574c5c4eea2f8ab8160c470553aeb
SHA256c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43
SHA5127fcb2c62bd9d4a569ce0fd788068bfab133595d8ef54957aa5ed4295b1988a92c7d62fdd465e2c34152f02e39a022015ac2868c4b97df1327862d41c60885f59
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exeMD5
6ea14e473644f3bea03782f41d7c5246
SHA13be05d9f18b574c5c4eea2f8ab8160c470553aeb
SHA256c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43
SHA5127fcb2c62bd9d4a569ce0fd788068bfab133595d8ef54957aa5ed4295b1988a92c7d62fdd465e2c34152f02e39a022015ac2868c4b97df1327862d41c60885f59
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exeMD5
6ea14e473644f3bea03782f41d7c5246
SHA13be05d9f18b574c5c4eea2f8ab8160c470553aeb
SHA256c565ce12f63b1cb897156e0234907a49517439247747cc7df5b69952c1e7ce43
SHA5127fcb2c62bd9d4a569ce0fd788068bfab133595d8ef54957aa5ed4295b1988a92c7d62fdd465e2c34152f02e39a022015ac2868c4b97df1327862d41c60885f59
-
memory/396-114-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/948-121-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/948-122-0x0000000000401000-mapping.dmp
-
memory/1316-152-0x0000000000580000-0x0000000000581000-memory.dmpFilesize
4KB
-
memory/1316-123-0x0000000000000000-mapping.dmp
-
memory/2308-149-0x00000000062E0000-0x00000000062F1000-memory.dmpFilesize
68KB
-
memory/2308-148-0x0000000006240000-0x0000000006258000-memory.dmpFilesize
96KB
-
memory/2332-143-0x0000000000420000-0x000000000056A000-memory.dmpFilesize
1.3MB
-
memory/2332-139-0x0000000000401000-mapping.dmp
-
memory/2332-142-0x0000000000420000-0x000000000056A000-memory.dmpFilesize
1.3MB
-
memory/2336-147-0x0000019B93D00000-0x0000019B93D27000-memory.dmpFilesize
156KB
-
memory/2376-129-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2376-118-0x000000000041DE40-mapping.dmp
-
memory/2376-117-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3032-150-0x0000000002E80000-0x0000000002E81000-memory.dmpFilesize
4KB
-
memory/3032-146-0x0000000000E70000-0x0000000000E82000-memory.dmpFilesize
72KB
-
memory/3032-145-0x0000000000E40000-0x0000000000E67000-memory.dmpFilesize
156KB
-
memory/3424-141-0x0000000000000000-mapping.dmp
-
memory/3424-144-0x0000000000350000-0x0000000000377000-memory.dmpFilesize
156KB
-
memory/3728-131-0x0000000000410028-mapping.dmp
-
memory/3728-130-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/3728-132-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/3924-134-0x000000000041DE40-mapping.dmp