Analysis
- max time kernel
27s - max time network
136s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
18/10/2021, 13:28
Static task
static1
Behavioral task
behavioral1
Sample
34ff816c9decd4151520a12452cde537.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
34ff816c9decd4151520a12452cde537.exe
Resource
win10-en-20211014
windows10_x64
0 signatures
0 seconds
General
- Target 34ff816c9decd4151520a12452cde537.exe
- Size 164KB
- Sample211018-qqpb5sefar
- SHA256 32016cf36c5e99a6c8fba8fd4ffad8b5f301cac55439ae73fec5db799ac341ab
- MD5 34ff816c9decd4151520a12452cde537
- SHA1 0473d7711dd31d97f89b6df36db00592c9367bbe
- SHA512 becd8859f7a917d63c0110ebabf3dd0a90682f7e365fb097a539682a81cc9f5b2638616b7807725f676701f7c058cc3b708ca3fcda798623760f7cf185f602ec
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Path
-
C:\Boot\bg-BG\Read_Me.txt
Ransom Note
- Attention! All your files, documents, photos, databases and other important files are encrypted The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files. The server with your decryptor is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- 1. Download Tor browser - https://www.torproject.org/ 2. Install Tor browser 3. Open Tor Browser 4. Open link in TOR browser: http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?102YAHJAMOA 5. and open ticket ---------------------------------------------------------------------------------------- Alternate communication channel here: https://yip.su/2QstD5
URLs
-
http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?102YAHJAMOA
-
https://yip.su/2QstD5
Signatures
- Turns off Windows Defender SpyNet reporting 2 TTPs
- Nirsoft 3 IoCs
resource yara_rule behavioral2/files/0x000400000001ab9c-147.dat Nirsoft behavioral2/files/0x000400000001ab9c-148.dat Nirsoft behavioral2/files/0x000400000001ab9c-160.dat Nirsoft - Executes dropped EXE 2 IoCs
pid Process 3196 AdvancedRun.exe 3544 AdvancedRun.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0" 34ff816c9decd4151520a12452cde537.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 34ff816c9decd4151520a12452cde537.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions 34ff816c9decd4151520a12452cde537.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Cursors\㒀㒁㑤㑿㒀㒁㒂㑾㑿㒁㑧㑓㒕㒂㑔\svchost.exe = "0" 34ff816c9decd4151520a12452cde537.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\34ff816c9decd4151520a12452cde537.exe = "0" 34ff816c9decd4151520a12452cde537.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 34ff816c9decd4151520a12452cde537.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet 34ff816c9decd4151520a12452cde537.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths 34ff816c9decd4151520a12452cde537.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection 34ff816c9decd4151520a12452cde537.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0" 34ff816c9decd4151520a12452cde537.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 34ff816c9decd4151520a12452cde537.exe - Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: 34ff816c9decd4151520a12452cde537.exe File opened (read-only) \??\X: 34ff816c9decd4151520a12452cde537.exe File opened (read-only) \??\V: 34ff816c9decd4151520a12452cde537.exe File opened (read-only) \??\B: 34ff816c9decd4151520a12452cde537.exe File opened (read-only) \??\N: 34ff816c9decd4151520a12452cde537.exe File opened (read-only) \??\M: 34ff816c9decd4151520a12452cde537.exe File opened (read-only) \??\W: 34ff816c9decd4151520a12452cde537.exe File opened (read-only) \??\R: 34ff816c9decd4151520a12452cde537.exe File opened (read-only) \??\U: 34ff816c9decd4151520a12452cde537.exe File opened (read-only) \??\O: 34ff816c9decd4151520a12452cde537.exe File opened (read-only) \??\P: 34ff816c9decd4151520a12452cde537.exe File opened (read-only) \??\S: 34ff816c9decd4151520a12452cde537.exe File opened (read-only) \??\H: 34ff816c9decd4151520a12452cde537.exe File opened (read-only) \??\Z: 34ff816c9decd4151520a12452cde537.exe File opened (read-only) \??\E: 34ff816c9decd4151520a12452cde537.exe File opened (read-only) \??\Y: 34ff816c9decd4151520a12452cde537.exe File opened (read-only) \??\A: 34ff816c9decd4151520a12452cde537.exe File opened (read-only) \??\F: 34ff816c9decd4151520a12452cde537.exe File opened (read-only) \??\J: 34ff816c9decd4151520a12452cde537.exe File opened (read-only) \??\L: 34ff816c9decd4151520a12452cde537.exe File opened (read-only) \??\Q: 34ff816c9decd4151520a12452cde537.exe File opened (read-only) \??\T: 34ff816c9decd4151520a12452cde537.exe File opened (read-only) \??\G: 34ff816c9decd4151520a12452cde537.exe File opened (read-only) \??\K: 34ff816c9decd4151520a12452cde537.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
pid Process 1676 34ff816c9decd4151520a12452cde537.exe 1676 34ff816c9decd4151520a12452cde537.exe 1676 34ff816c9decd4151520a12452cde537.exe 1676 34ff816c9decd4151520a12452cde537.exe 1676 34ff816c9decd4151520a12452cde537.exe 1676 34ff816c9decd4151520a12452cde537.exe 1676 34ff816c9decd4151520a12452cde537.exe 1676 34ff816c9decd4151520a12452cde537.exe 1676 34ff816c9decd4151520a12452cde537.exe 1676 34ff816c9decd4151520a12452cde537.exe 1676 34ff816c9decd4151520a12452cde537.exe 1676 34ff816c9decd4151520a12452cde537.exe 1676 34ff816c9decd4151520a12452cde537.exe 1676 34ff816c9decd4151520a12452cde537.exe 1676 34ff816c9decd4151520a12452cde537.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1676 set thread context of 2732 1676 34ff816c9decd4151520a12452cde537.exe 81 - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\Read_Me.txt 34ff816c9decd4151520a12452cde537.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\Read_Me.txt 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll 34ff816c9decd4151520a12452cde537.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\Read_Me.txt 34ff816c9decd4151520a12452cde537.exe File created C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\Read_Me.txt 34ff816c9decd4151520a12452cde537.exe File created C:\Program Files\Common Files\microsoft shared\TextConv\Read_Me.txt 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\join.avi 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\7-Zip\Lang\ps.txt 34ff816c9decd4151520a12452cde537.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\Read_Me.txt 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\7-Zip\Lang\ta.txt 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\7-Zip\7z.dll 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\7-Zip\Lang\ro.txt 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll 34ff816c9decd4151520a12452cde537.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\Read_Me.txt 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt 34ff816c9decd4151520a12452cde537.exe File created C:\Program Files\Common Files\microsoft shared\ink\lv-LV\Read_Me.txt 34ff816c9decd4151520a12452cde537.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\Read_Me.txt 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\7-Zip\Lang\sa.txt 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ko-kr.dll 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\de-DE\ShapeCollector.exe.mui 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt 34ff816c9decd4151520a12452cde537.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\Read_Me.txt 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\split.avi 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml 34ff816c9decd4151520a12452cde537.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\Read_Me.txt 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\7-Zip\Lang\tt.txt 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml 34ff816c9decd4151520a12452cde537.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\Read_Me.txt 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\7-Zip\Lang\th.txt 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InputPersonalization.exe.mui 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll 34ff816c9decd4151520a12452cde537.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\Cursors\㒀㒁㑤㑿㒀㒁㒂㑾㑿㒁㑧㑓㒕㒂㑔\svchost.exe 34ff816c9decd4151520a12452cde537.exe File opened for modification C:\Windows\Cursors\㒀㒁㑤㑿㒀㒁㒂㑾㑿㒁㑧㑓㒕㒂㑔\svchost.exe 34ff816c9decd4151520a12452cde537.exe File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
pid pid_target Process procid_target 3892 1676 WerFault.exe 68 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3196 AdvancedRun.exe 3196 AdvancedRun.exe 3196 AdvancedRun.exe 3196 AdvancedRun.exe 2448 powershell.exe 2224 powershell.exe 632 powershell.exe 3544 AdvancedRun.exe 3544 AdvancedRun.exe 3544 AdvancedRun.exe 3544 AdvancedRun.exe 632 powershell.exe 2224 powershell.exe 2448 powershell.exe 2224 powershell.exe 2448 powershell.exe 632 powershell.exe 1676 34ff816c9decd4151520a12452cde537.exe 1676 34ff816c9decd4151520a12452cde537.exe 1676 34ff816c9decd4151520a12452cde537.exe 2216 powershell.exe 2216 powershell.exe 3892 WerFault.exe 3892 WerFault.exe 3892 WerFault.exe 3892 WerFault.exe 3892 WerFault.exe 3892 WerFault.exe 3892 WerFault.exe 3892 WerFault.exe 3892 WerFault.exe 3892 WerFault.exe 3892 WerFault.exe 3892 WerFault.exe 3892 WerFault.exe 3892 WerFault.exe 2216 powershell.exe 2732 34ff816c9decd4151520a12452cde537.exe 2732 34ff816c9decd4151520a12452cde537.exe 2732 34ff816c9decd4151520a12452cde537.exe 2732 34ff816c9decd4151520a12452cde537.exe 2732 34ff816c9decd4151520a12452cde537.exe 2732 34ff816c9decd4151520a12452cde537.exe 2732 34ff816c9decd4151520a12452cde537.exe 2732 34ff816c9decd4151520a12452cde537.exe 2732 34ff816c9decd4151520a12452cde537.exe 2732 34ff816c9decd4151520a12452cde537.exe 2732 34ff816c9decd4151520a12452cde537.exe 2732 34ff816c9decd4151520a12452cde537.exe 2732 34ff816c9decd4151520a12452cde537.exe 2732 34ff816c9decd4151520a12452cde537.exe 2732 34ff816c9decd4151520a12452cde537.exe 2732 34ff816c9decd4151520a12452cde537.exe 2732 34ff816c9decd4151520a12452cde537.exe 2732 34ff816c9decd4151520a12452cde537.exe 2732 34ff816c9decd4151520a12452cde537.exe 2732 34ff816c9decd4151520a12452cde537.exe 2732 34ff816c9decd4151520a12452cde537.exe 2732 34ff816c9decd4151520a12452cde537.exe 2732 34ff816c9decd4151520a12452cde537.exe 2732 34ff816c9decd4151520a12452cde537.exe 2732 34ff816c9decd4151520a12452cde537.exe 2732 34ff816c9decd4151520a12452cde537.exe 2732 34ff816c9decd4151520a12452cde537.exe - Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 1676 34ff816c9decd4151520a12452cde537.exe Token: SeDebugPrivilege 2448 powershell.exe Token: SeDebugPrivilege 2224 powershell.exe Token: SeDebugPrivilege 632 powershell.exe Token: SeDebugPrivilege 3196 AdvancedRun.exe Token: SeImpersonatePrivilege 3196 AdvancedRun.exe Token: SeDebugPrivilege 3544 AdvancedRun.exe Token: SeImpersonatePrivilege 3544 AdvancedRun.exe Token: SeDebugPrivilege 2216 powershell.exe Token: SeRestorePrivilege 3892 WerFault.exe Token: SeBackupPrivilege 3892 WerFault.exe Token: SeBackupPrivilege 3892 WerFault.exe Token: SeDebugPrivilege 3892 WerFault.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1676 wrote to memory of 2224 1676 34ff816c9decd4151520a12452cde537.exe 70 PID 1676 wrote to memory of 2224 1676 34ff816c9decd4151520a12452cde537.exe 70 PID 1676 wrote to memory of 2224 1676 34ff816c9decd4151520a12452cde537.exe 70 PID 1676 wrote to memory of 632 1676 34ff816c9decd4151520a12452cde537.exe 72 PID 1676 wrote to memory of 632 1676 34ff816c9decd4151520a12452cde537.exe 72 PID 1676 wrote to memory of 632 1676 34ff816c9decd4151520a12452cde537.exe 72 PID 1676 wrote to memory of 2448 1676 34ff816c9decd4151520a12452cde537.exe 74 PID 1676 wrote to memory of 2448 1676 34ff816c9decd4151520a12452cde537.exe 74 PID 1676 wrote to memory of 2448 1676 34ff816c9decd4151520a12452cde537.exe 74 PID 1676 wrote to memory of 3196 1676 34ff816c9decd4151520a12452cde537.exe 76 PID 1676 wrote to memory of 3196 1676 34ff816c9decd4151520a12452cde537.exe 76 PID 1676 wrote to memory of 3196 1676 34ff816c9decd4151520a12452cde537.exe 76 PID 3196 wrote to memory of 3544 3196 AdvancedRun.exe 77 PID 3196 wrote to memory of 3544 3196 AdvancedRun.exe 77 PID 3196 wrote to memory of 3544 3196 AdvancedRun.exe 77 PID 1676 wrote to memory of 2216 1676 34ff816c9decd4151520a12452cde537.exe 79 PID 1676 wrote to memory of 2216 1676 34ff816c9decd4151520a12452cde537.exe 79 PID 1676 wrote to memory of 2216 1676 34ff816c9decd4151520a12452cde537.exe 79 PID 1676 wrote to memory of 2732 1676 34ff816c9decd4151520a12452cde537.exe 81 PID 1676 wrote to memory of 2732 1676 34ff816c9decd4151520a12452cde537.exe 81 PID 1676 wrote to memory of 2732 1676 34ff816c9decd4151520a12452cde537.exe 81 PID 1676 wrote to memory of 2732 1676 34ff816c9decd4151520a12452cde537.exe 81 PID 1676 wrote to memory of 2732 1676 34ff816c9decd4151520a12452cde537.exe 81 PID 1676 wrote to memory of 2732 1676 34ff816c9decd4151520a12452cde537.exe 81 PID 1676 wrote to memory of 2732 1676 34ff816c9decd4151520a12452cde537.exe 81 PID 1676 wrote to memory of 2732 1676 34ff816c9decd4151520a12452cde537.exe 81 PID 1676 wrote to memory of 2732 1676 34ff816c9decd4151520a12452cde537.exe 81 PID 1676 wrote to memory of 2732 1676 34ff816c9decd4151520a12452cde537.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\34ff816c9decd4151520a12452cde537.exe"C:\Users\Admin\AppData\Local\Temp\34ff816c9decd4151520a12452cde537.exe"1⤵
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\㒀㒁㑤㑿㒀㒁㒂㑾㑿㒁㑧㑓㒕㒂㑔\svchost.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2224
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\34ff816c9decd4151520a12452cde537.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:632
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\㒀㒁㑤㑿㒀㒁㒂㑾㑿㒁㑧㑓㒕㒂㑔\svchost.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2448
-
-
C:\Users\Admin\AppData\Local\Temp\b274ce06-0420-439d-a9db-ff78af476053\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\b274ce06-0420-439d-a9db-ff78af476053\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\b274ce06-0420-439d-a9db-ff78af476053\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\b274ce06-0420-439d-a9db-ff78af476053\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\b274ce06-0420-439d-a9db-ff78af476053\AdvancedRun.exe" /SpecialRun 4101d8 31963⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3544
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\34ff816c9decd4151520a12452cde537.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2216
-
-
C:\Users\Admin\AppData\Local\Temp\34ff816c9decd4151520a12452cde537.exe"C:\Users\Admin\AppData\Local\Temp\34ff816c9decd4151520a12452cde537.exe"2⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:2732
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 24002⤵
- Drops file in Windows directory
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3892
-
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:1276
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1268
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵PID:3164
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵PID:3060
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4292
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc1⤵PID:3428
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵PID:4684
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵PID:4716