Analysis
-
max time kernel
118s -
max time network
151s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
21-09-2021 16:20
Static task
static1
General
-
Target
bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe
-
Size
33KB
-
MD5
49af0abba03a7d559171f378728e9bc7
-
SHA1
7e6e1ccf693bb62f2a36119996583228a9e5c665
-
SHA256
bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b
-
SHA512
d155349a6dae76775b26a96ec00a8dc860749eb46450c6dcc479303afa01325b1fb31b41c8adac3cbabb2b17c7b23a6768949a8bf5221c3edee0a25082e71a8f
Malware Config
Extracted
xpertrat
3.0.10
Test
kapasky-antivirus.firewall-gateway.net:4000
L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0
Signatures
-
XpertRAT Core Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2448-179-0x0000000000401364-mapping.dmp xpertrat behavioral1/memory/2448-178-0x0000000000400000-0x0000000000443000-memory.dmp xpertrat -
NirSoft MailPassView 2 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral1/memory/1204-191-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1204-192-0x0000000000411654-mapping.dmp MailPassView -
NirSoft WebBrowserPassView 2 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral1/memory/3092-195-0x0000000000400000-0x0000000000459000-memory.dmp WebBrowserPassView behavioral1/memory/3092-196-0x0000000000442F04-mapping.dmp WebBrowserPassView -
Nirsoft 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1204-191-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1204-192-0x0000000000411654-mapping.dmp Nirsoft behavioral1/memory/3092-195-0x0000000000400000-0x0000000000459000-memory.dmp Nirsoft behavioral1/memory/3092-196-0x0000000000442F04-mapping.dmp Nirsoft -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe" iexplore.exe -
Processes:
resource yara_rule behavioral1/memory/504-187-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/3704-202-0x0000000000400000-0x0000000000416000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 3632 notepad.exe -
Processes:
bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe" iexplore.exe -
Processes:
bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe -
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2012 1484 WerFault.exe iexplore.exe 3824 3796 WerFault.exe iexplore.exe 3792 1932 WerFault.exe iexplore.exe 1304 3704 WerFault.exe iexplore.exe -
Suspicious use of SetThreadContext 9 IoCs
Processes:
bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exebc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exeiexplore.exedescription pid process target process PID 2352 set thread context of 3672 2352 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe PID 3672 set thread context of 1484 3672 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe iexplore.exe PID 3672 set thread context of 3796 3672 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe iexplore.exe PID 3672 set thread context of 2448 3672 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe iexplore.exe PID 2448 set thread context of 504 2448 iexplore.exe iexplore.exe PID 2448 set thread context of 1204 2448 iexplore.exe iexplore.exe PID 2448 set thread context of 3092 2448 iexplore.exe iexplore.exe PID 2448 set thread context of 1932 2448 iexplore.exe iexplore.exe PID 2448 set thread context of 3704 2448 iexplore.exe iexplore.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 38 IoCs
Processes:
powershell.exepowershell.exebc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exebc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exeiexplore.exeiexplore.exeWerFault.exepid process 3016 powershell.exe 3016 powershell.exe 3016 powershell.exe 680 powershell.exe 680 powershell.exe 680 powershell.exe 2352 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe 2352 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe 2352 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe 2352 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe 2352 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe 2352 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe 3672 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe 3672 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe 3672 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe 3672 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe 3672 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe 3672 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe 504 iexplore.exe 504 iexplore.exe 3672 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe 3672 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe 3092 iexplore.exe 3092 iexplore.exe 1304 WerFault.exe 1304 WerFault.exe 1304 WerFault.exe 1304 WerFault.exe 1304 WerFault.exe 1304 WerFault.exe 1304 WerFault.exe 1304 WerFault.exe 1304 WerFault.exe 1304 WerFault.exe 1304 WerFault.exe 1304 WerFault.exe 1304 WerFault.exe 1304 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
powershell.exepowershell.exebc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exeiexplore.exeiexplore.exeWerFault.exedescription pid process Token: SeDebugPrivilege 3016 powershell.exe Token: SeDebugPrivilege 680 powershell.exe Token: SeDebugPrivilege 2352 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe Token: SeDebugPrivilege 2448 iexplore.exe Token: SeDebugPrivilege 504 iexplore.exe Token: SeRestorePrivilege 1304 WerFault.exe Token: SeBackupPrivilege 1304 WerFault.exe Token: SeDebugPrivilege 1304 WerFault.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exeiexplore.exepid process 3672 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe 2448 iexplore.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exebc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exeiexplore.exedescription pid process target process PID 2352 wrote to memory of 3016 2352 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe powershell.exe PID 2352 wrote to memory of 3016 2352 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe powershell.exe PID 2352 wrote to memory of 3016 2352 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe powershell.exe PID 2352 wrote to memory of 680 2352 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe powershell.exe PID 2352 wrote to memory of 680 2352 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe powershell.exe PID 2352 wrote to memory of 680 2352 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe powershell.exe PID 2352 wrote to memory of 3680 2352 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe PID 2352 wrote to memory of 3680 2352 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe PID 2352 wrote to memory of 3680 2352 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe PID 2352 wrote to memory of 3672 2352 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe PID 2352 wrote to memory of 3672 2352 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe PID 2352 wrote to memory of 3672 2352 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe PID 2352 wrote to memory of 3672 2352 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe PID 2352 wrote to memory of 3672 2352 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe PID 2352 wrote to memory of 3672 2352 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe PID 2352 wrote to memory of 3672 2352 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe PID 3672 wrote to memory of 1484 3672 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe iexplore.exe PID 3672 wrote to memory of 1484 3672 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe iexplore.exe PID 3672 wrote to memory of 1484 3672 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe iexplore.exe PID 3672 wrote to memory of 1484 3672 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe iexplore.exe PID 3672 wrote to memory of 1484 3672 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe iexplore.exe PID 3672 wrote to memory of 1484 3672 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe iexplore.exe PID 3672 wrote to memory of 1484 3672 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe iexplore.exe PID 3672 wrote to memory of 1484 3672 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe iexplore.exe PID 3672 wrote to memory of 3796 3672 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe iexplore.exe PID 3672 wrote to memory of 3796 3672 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe iexplore.exe PID 3672 wrote to memory of 3796 3672 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe iexplore.exe PID 3672 wrote to memory of 3796 3672 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe iexplore.exe PID 3672 wrote to memory of 3796 3672 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe iexplore.exe PID 3672 wrote to memory of 3796 3672 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe iexplore.exe PID 3672 wrote to memory of 3796 3672 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe iexplore.exe PID 3672 wrote to memory of 3796 3672 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe iexplore.exe PID 3672 wrote to memory of 2448 3672 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe iexplore.exe PID 3672 wrote to memory of 2448 3672 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe iexplore.exe PID 3672 wrote to memory of 2448 3672 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe iexplore.exe PID 3672 wrote to memory of 2448 3672 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe iexplore.exe PID 3672 wrote to memory of 2448 3672 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe iexplore.exe PID 3672 wrote to memory of 2448 3672 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe iexplore.exe PID 3672 wrote to memory of 2448 3672 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe iexplore.exe PID 3672 wrote to memory of 2448 3672 bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe iexplore.exe PID 2448 wrote to memory of 3632 2448 iexplore.exe notepad.exe PID 2448 wrote to memory of 3632 2448 iexplore.exe notepad.exe PID 2448 wrote to memory of 3632 2448 iexplore.exe notepad.exe PID 2448 wrote to memory of 3632 2448 iexplore.exe notepad.exe PID 2448 wrote to memory of 504 2448 iexplore.exe iexplore.exe PID 2448 wrote to memory of 504 2448 iexplore.exe iexplore.exe PID 2448 wrote to memory of 504 2448 iexplore.exe iexplore.exe PID 2448 wrote to memory of 504 2448 iexplore.exe iexplore.exe PID 2448 wrote to memory of 504 2448 iexplore.exe iexplore.exe PID 2448 wrote to memory of 504 2448 iexplore.exe iexplore.exe PID 2448 wrote to memory of 504 2448 iexplore.exe iexplore.exe PID 2448 wrote to memory of 504 2448 iexplore.exe iexplore.exe PID 2448 wrote to memory of 1204 2448 iexplore.exe iexplore.exe PID 2448 wrote to memory of 1204 2448 iexplore.exe iexplore.exe PID 2448 wrote to memory of 1204 2448 iexplore.exe iexplore.exe PID 2448 wrote to memory of 1204 2448 iexplore.exe iexplore.exe PID 2448 wrote to memory of 1204 2448 iexplore.exe iexplore.exe PID 2448 wrote to memory of 1204 2448 iexplore.exe iexplore.exe PID 2448 wrote to memory of 1204 2448 iexplore.exe iexplore.exe PID 2448 wrote to memory of 1204 2448 iexplore.exe iexplore.exe PID 2448 wrote to memory of 1204 2448 iexplore.exe iexplore.exe PID 2448 wrote to memory of 3092 2448 iexplore.exe iexplore.exe PID 2448 wrote to memory of 3092 2448 iexplore.exe iexplore.exe PID 2448 wrote to memory of 3092 2448 iexplore.exe iexplore.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe"C:\Users\Admin\AppData\Local\Temp\bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -Seconds 32⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3016 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 152⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:680 -
C:\Users\Admin\AppData\Local\Temp\bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exeC:\Users\Admin\AppData\Local\Temp\bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe2⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exeC:\Users\Admin\AppData\Local\Temp\bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe2⤵
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3672 -
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe3⤵PID:1484
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 964⤵
- Program crash
PID:2012 -
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe3⤵PID:3796
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 924⤵
- Program crash
PID:3824 -
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\bc2a5e452669de43c4f4533c995b515bace2941ea5b45bb537085b204ee5d54b.exe3⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\notepad.exenotepad.exe4⤵
- Deletes itself
PID:3632 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\ktucvqjcs0.txt"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:504 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\ktucvqjcs1.txt"4⤵PID:1204
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\ktucvqjcs2.txt"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:3092 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\ktucvqjcs3.txt"4⤵PID:1932
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 925⤵
- Program crash
PID:3792 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe/stext "C:\Users\Admin\AppData\Roaming\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\ktucvqjcs3.txt"4⤵PID:3704
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 1645⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1304
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
66382a4ca6c4dcf75ce41417d44be93e
SHA18132cbef1c12f8a89a68a6153ade4286bf130812
SHA256a70acce0f4c6ab59b88ce79d84c38d4abffe19b72b033250499b17d788a2db56
SHA5122bf66f2850f4a65220085c55a5b3c8866453104d78fe516e5bd6e3e47df783062ce4ea10de580f2eb0274ac8c3ce71965201c49ef55a78f307731ccc8600aadc
-
MD5
848d460d46a279e4ecb4176f2617761b
SHA1ecc09b6671e6813eca980926b3d204d7a9a7ab0c
SHA256fd01b8faeb6155cee73cefdb4727f4b6a6aa3c092e0d9cbc0758deae945d0b71
SHA5122d26266583ad29c1cc0ef9ef45455bc85e1380a761e0f6f160e06de57b4832655b1707b73f8889de07dc4f98a882e02303801f9936fbae7ec46c48a8bbe23b74
-
MD5
f94dc819ca773f1e3cb27abbc9e7fa27
SHA19a7700efadc5ea09ab288544ef1e3cd876255086
SHA256a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92
SHA51272a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196