Analysis
-
max time kernel
1214s -
max time network
1208s -
platform
windows11_x64 -
resource
win11 -
submitted
21-10-2021 12:38
Static task
static1
Behavioral task
behavioral1
Sample
Tornado.exe
Resource
win7-ja-20211014
Behavioral task
behavioral2
Sample
Tornado.exe
Resource
win7-en-20210920
Behavioral task
behavioral3
Sample
Tornado.exe
Resource
win7-de-20211014
Behavioral task
behavioral4
Sample
Tornado.exe
Resource
win11
Behavioral task
behavioral5
Sample
Tornado.exe
Resource
win10-ja-20210920
Behavioral task
behavioral6
Sample
Tornado.exe
Resource
win10-en-20211014
Behavioral task
behavioral7
Sample
Tornado.exe
Resource
win10-de-20210920
General
-
Target
Tornado.exe
-
Size
331.0MB
-
MD5
2acf755a8825894b837989ce1ae3db1d
-
SHA1
17d5590e64a1df1470e83f79eb935d78bc218c2d
-
SHA256
876dbe0fdf3f4ec70bd1985bf7c6f661b1105efd591407a6dd7ca7506bc61adf
-
SHA512
f5ca9da28f33097e92714f1e329d62fa8b98afe35bdaaf9e4941ad8f46c9350df74117b4712abc83c7bf44d6a1cb357b44bfb426d7ab0eeb88b3c813e99eef4b
Malware Config
Signatures
-
Executes dropped EXE 8 IoCs
Processes:
tmp9ADE.tmp.exeNascondere.exe.comNascondere.exe.comRegAsm.exetmp9ADE.tmp.exeNascondere.exe.comNascondere.exe.comRegAsm.exepid process 2412 tmp9ADE.tmp.exe 3880 Nascondere.exe.com 448 Nascondere.exe.com 2276 RegAsm.exe 3004 tmp9ADE.tmp.exe 432 Nascondere.exe.com 4660 Nascondere.exe.com 3884 RegAsm.exe -
Drops startup file 1 IoCs
Processes:
Nascondere.exe.comdescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LMDUbsNmfa.url Nascondere.exe.com -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
tmp9ADE.tmp.exetmp9ADE.tmp.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" tmp9ADE.tmp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce tmp9ADE.tmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" tmp9ADE.tmp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce tmp9ADE.tmp.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Nascondere.exe.comNascondere.exe.comdescription pid process target process PID 448 set thread context of 2276 448 Nascondere.exe.com RegAsm.exe PID 4660 set thread context of 3884 4660 Nascondere.exe.com RegAsm.exe -
Drops file in Windows directory 6 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
WaaSMedicAgent.exesvchost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe -
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exeRegAsm.exepid process 3164 powershell.exe 3164 powershell.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe 2276 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
svchost.exesvchost.exeTornado.exepowershell.exeRegAsm.exeRegAsm.exedescription pid process Token: SeShutdownPrivilege 2988 svchost.exe Token: SeCreatePagefilePrivilege 2988 svchost.exe Token: SeShutdownPrivilege 2988 svchost.exe Token: SeCreatePagefilePrivilege 2988 svchost.exe Token: SeShutdownPrivilege 2988 svchost.exe Token: SeCreatePagefilePrivilege 2988 svchost.exe Token: SeShutdownPrivilege 1616 svchost.exe Token: SeCreatePagefilePrivilege 1616 svchost.exe Token: SeDebugPrivilege 4852 Tornado.exe Token: SeDebugPrivilege 3164 powershell.exe Token: SeIncreaseQuotaPrivilege 3164 powershell.exe Token: SeSecurityPrivilege 3164 powershell.exe Token: SeTakeOwnershipPrivilege 3164 powershell.exe Token: SeLoadDriverPrivilege 3164 powershell.exe Token: SeSystemProfilePrivilege 3164 powershell.exe Token: SeSystemtimePrivilege 3164 powershell.exe Token: SeProfSingleProcessPrivilege 3164 powershell.exe Token: SeIncBasePriorityPrivilege 3164 powershell.exe Token: SeCreatePagefilePrivilege 3164 powershell.exe Token: SeBackupPrivilege 3164 powershell.exe Token: SeRestorePrivilege 3164 powershell.exe Token: SeShutdownPrivilege 3164 powershell.exe Token: SeDebugPrivilege 3164 powershell.exe Token: SeSystemEnvironmentPrivilege 3164 powershell.exe Token: SeRemoteShutdownPrivilege 3164 powershell.exe Token: SeUndockPrivilege 3164 powershell.exe Token: SeManageVolumePrivilege 3164 powershell.exe Token: 33 3164 powershell.exe Token: 34 3164 powershell.exe Token: 35 3164 powershell.exe Token: 36 3164 powershell.exe Token: SeShutdownPrivilege 2988 svchost.exe Token: SeCreatePagefilePrivilege 2988 svchost.exe Token: SeDebugPrivilege 2276 RegAsm.exe Token: SeDebugPrivilege 3884 RegAsm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
svchost.exeTornado.exetmp9ADE.tmp.execmd.execmd.exeNascondere.exe.comNascondere.exe.comtmp9ADE.tmp.execmd.execmd.exeNascondere.exe.comNascondere.exe.comdescription pid process target process PID 1616 wrote to memory of 1196 1616 svchost.exe MoUsoCoreWorker.exe PID 1616 wrote to memory of 1196 1616 svchost.exe MoUsoCoreWorker.exe PID 4852 wrote to memory of 3164 4852 Tornado.exe powershell.exe PID 4852 wrote to memory of 3164 4852 Tornado.exe powershell.exe PID 4852 wrote to memory of 3164 4852 Tornado.exe powershell.exe PID 4852 wrote to memory of 2412 4852 Tornado.exe tmp9ADE.tmp.exe PID 4852 wrote to memory of 2412 4852 Tornado.exe tmp9ADE.tmp.exe PID 4852 wrote to memory of 2412 4852 Tornado.exe tmp9ADE.tmp.exe PID 2412 wrote to memory of 4704 2412 tmp9ADE.tmp.exe dllhost.exe PID 2412 wrote to memory of 4704 2412 tmp9ADE.tmp.exe dllhost.exe PID 2412 wrote to memory of 4704 2412 tmp9ADE.tmp.exe dllhost.exe PID 2412 wrote to memory of 1180 2412 tmp9ADE.tmp.exe cmd.exe PID 2412 wrote to memory of 1180 2412 tmp9ADE.tmp.exe cmd.exe PID 2412 wrote to memory of 1180 2412 tmp9ADE.tmp.exe cmd.exe PID 1180 wrote to memory of 2540 1180 cmd.exe cmd.exe PID 1180 wrote to memory of 2540 1180 cmd.exe cmd.exe PID 1180 wrote to memory of 2540 1180 cmd.exe cmd.exe PID 2540 wrote to memory of 2912 2540 cmd.exe findstr.exe PID 2540 wrote to memory of 2912 2540 cmd.exe findstr.exe PID 2540 wrote to memory of 2912 2540 cmd.exe findstr.exe PID 2540 wrote to memory of 3880 2540 cmd.exe Nascondere.exe.com PID 2540 wrote to memory of 3880 2540 cmd.exe Nascondere.exe.com PID 2540 wrote to memory of 3880 2540 cmd.exe Nascondere.exe.com PID 2540 wrote to memory of 2268 2540 cmd.exe PING.EXE PID 2540 wrote to memory of 2268 2540 cmd.exe PING.EXE PID 2540 wrote to memory of 2268 2540 cmd.exe PING.EXE PID 3880 wrote to memory of 448 3880 Nascondere.exe.com Nascondere.exe.com PID 3880 wrote to memory of 448 3880 Nascondere.exe.com Nascondere.exe.com PID 3880 wrote to memory of 448 3880 Nascondere.exe.com Nascondere.exe.com PID 448 wrote to memory of 2276 448 Nascondere.exe.com RegAsm.exe PID 448 wrote to memory of 2276 448 Nascondere.exe.com RegAsm.exe PID 448 wrote to memory of 2276 448 Nascondere.exe.com RegAsm.exe PID 448 wrote to memory of 2276 448 Nascondere.exe.com RegAsm.exe PID 448 wrote to memory of 2276 448 Nascondere.exe.com RegAsm.exe PID 4852 wrote to memory of 3004 4852 Tornado.exe tmp9ADE.tmp.exe PID 4852 wrote to memory of 3004 4852 Tornado.exe tmp9ADE.tmp.exe PID 4852 wrote to memory of 3004 4852 Tornado.exe tmp9ADE.tmp.exe PID 3004 wrote to memory of 2492 3004 tmp9ADE.tmp.exe dllhost.exe PID 3004 wrote to memory of 2492 3004 tmp9ADE.tmp.exe dllhost.exe PID 3004 wrote to memory of 2492 3004 tmp9ADE.tmp.exe dllhost.exe PID 3004 wrote to memory of 2496 3004 tmp9ADE.tmp.exe cmd.exe PID 3004 wrote to memory of 2496 3004 tmp9ADE.tmp.exe cmd.exe PID 3004 wrote to memory of 2496 3004 tmp9ADE.tmp.exe cmd.exe PID 2496 wrote to memory of 3860 2496 cmd.exe cmd.exe PID 2496 wrote to memory of 3860 2496 cmd.exe cmd.exe PID 2496 wrote to memory of 3860 2496 cmd.exe cmd.exe PID 3860 wrote to memory of 4284 3860 cmd.exe findstr.exe PID 3860 wrote to memory of 4284 3860 cmd.exe findstr.exe PID 3860 wrote to memory of 4284 3860 cmd.exe findstr.exe PID 3860 wrote to memory of 432 3860 cmd.exe Nascondere.exe.com PID 3860 wrote to memory of 432 3860 cmd.exe Nascondere.exe.com PID 3860 wrote to memory of 432 3860 cmd.exe Nascondere.exe.com PID 3860 wrote to memory of 676 3860 cmd.exe PING.EXE PID 3860 wrote to memory of 676 3860 cmd.exe PING.EXE PID 3860 wrote to memory of 676 3860 cmd.exe PING.EXE PID 432 wrote to memory of 4660 432 Nascondere.exe.com Nascondere.exe.com PID 432 wrote to memory of 4660 432 Nascondere.exe.com Nascondere.exe.com PID 432 wrote to memory of 4660 432 Nascondere.exe.com Nascondere.exe.com PID 4660 wrote to memory of 3884 4660 Nascondere.exe.com RegAsm.exe PID 4660 wrote to memory of 3884 4660 Nascondere.exe.com RegAsm.exe PID 4660 wrote to memory of 3884 4660 Nascondere.exe.com RegAsm.exe PID 4660 wrote to memory of 3884 4660 Nascondere.exe.com RegAsm.exe PID 4660 wrote to memory of 3884 4660 Nascondere.exe.com RegAsm.exe PID 1616 wrote to memory of 3296 1616 svchost.exe MoUsoCoreWorker.exe
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Tornado.exe"C:\Users\Admin\AppData\Local\Temp\Tornado.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QAAoAGUAYwBoAG8AIABvAGYAZgAlACkAWwAxAF0ADQAKAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAiAEMAOgBcACIA2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\tmp9ADE.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp9ADE.tmp.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dllhost.exedllhost.exe3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Starne.mid3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^kXhUbWhdyiSzQwKWBBZJjppRDRvuTjJfOgrsoBnWshULiZzcvfBNflRwOcsFmuvSnDFCYzOqeeaZfbKDnwKEL$" Sorte.mid5⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Nascondere.exe.comNascondere.exe.com W5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Nascondere.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Nascondere.exe.com W6⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RegAsm.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping localhost5⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\tmp9ADE.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp9ADE.tmp.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dllhost.exedllhost.exe3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Starne.mid3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^kXhUbWhdyiSzQwKWBBZJjppRDRvuTjJfOgrsoBnWshULiZzcvfBNflRwOcsFmuvSnDFCYzOqeeaZfbKDnwKEL$" Sorte.mid5⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Nascondere.exe.comNascondere.exe.com W5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Nascondere.exe.comC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Nascondere.exe.com W6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\RegAsm.exe7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping localhost5⤵
- Runs ping.exe
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\uus\AMD64\MoUsoCoreWorker.exeC:\Windows\uus\AMD64\MoUsoCoreWorker.exe2⤵
-
C:\Windows\uus\AMD64\MoUsoCoreWorker.exeC:\Windows\uus\AMD64\MoUsoCoreWorker.exe2⤵
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe bb04cbbdbb33d4982281866c874da777 PQdDQoRXJEaKfU2Mx3DZyw.0.1.0.3.01⤵
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ambo.midMD5
e44fd575c6528190adc21c41297c7f0f
SHA14a834789bb3ddeea37cd30861a4c0bb639eeafed
SHA2569ae0b37e4b26a6684eed731f3c3958e3661a3da9a89759825b97efebfe183547
SHA512443f8aff20c51f236b16eba5dbe3890d157f85909ab36b1d084142836a343e6acb97e752d18819bec62e1458a038d9b24c609602dc3cbef87d959e597e0af19f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ami.midMD5
c2a501f010bf7b1c7a9777c3b93e19ef
SHA1d00adfeb88b435786f32cf7f45c1aae141690600
SHA256312d9b0380e5d8fd0bbee92b5d7f22a09b9278cbd7457777a08e2df5a859aff9
SHA5122850ad61312adc4d059e62c7dfaebabaa74ac280773e24920b746a56884d8c490b1d5c6637d56c966ca284a9cd515330d38faff55cfe77a1bd11f54f2c82f6fd
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Nascondere.exe.comMD5
c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Nascondere.exe.comMD5
c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Nascondere.exe.comMD5
c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RegAsm.exeMD5
42ab6e035df99a43dbb879c86b620b91
SHA1c6e116569d17d8142dbb217b1f8bfa95bc148c38
SHA25653195987d396986ebcb20425ac130e78ad308fdbd918f33f3fd92b99abda314b
SHA5122e79de2d394ad33023d71611bb728b254aa4680b5a3a1ef5282b1155ddfaa2f3585c840a6700dfe0d1a276dac801298431f0187086d2e8f96b22f6c808fb97e5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RegAsm.exeMD5
42ab6e035df99a43dbb879c86b620b91
SHA1c6e116569d17d8142dbb217b1f8bfa95bc148c38
SHA25653195987d396986ebcb20425ac130e78ad308fdbd918f33f3fd92b99abda314b
SHA5122e79de2d394ad33023d71611bb728b254aa4680b5a3a1ef5282b1155ddfaa2f3585c840a6700dfe0d1a276dac801298431f0187086d2e8f96b22f6c808fb97e5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Sorte.midMD5
ca6c6b8893411108280a0daf1a4d7d61
SHA1b791c3cdec5711baafa7be643d2d9a0a10ae0835
SHA25661b5e21e9798a8bf59a1c2e284d78d86706b4dc9bd6bef46bce54af95886bb46
SHA512c0f8c6e6c08a96d6bc9b77af1f300d45b011faa606c85b6220b89d890692d200230c16a206fa6c94a5f9e1568eb10181199a0d6b80b94f80706a5cd00f4fdbcf
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Starne.midMD5
603011f56db8309b2d5c4ea0a1c57a47
SHA191ffdd8dbc6c5935c954f2764bec480ae32a1432
SHA2565e4c34d70260f9bc2ce9f44b8fdef503667493f8d7c9d13b659da3b270a053f0
SHA512b1d53112fb89fc755e3933e88bcabd1ce2a2aa0032c948530769d96d06ca066d106fcdf2127348e618c7aac8b24b21ddbbdbdfd5113a641dbcd2da217d9ebdbe
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WMD5
e44fd575c6528190adc21c41297c7f0f
SHA14a834789bb3ddeea37cd30861a4c0bb639eeafed
SHA2569ae0b37e4b26a6684eed731f3c3958e3661a3da9a89759825b97efebfe183547
SHA512443f8aff20c51f236b16eba5dbe3890d157f85909ab36b1d084142836a343e6acb97e752d18819bec62e1458a038d9b24c609602dc3cbef87d959e597e0af19f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ambo.midMD5
e44fd575c6528190adc21c41297c7f0f
SHA14a834789bb3ddeea37cd30861a4c0bb639eeafed
SHA2569ae0b37e4b26a6684eed731f3c3958e3661a3da9a89759825b97efebfe183547
SHA512443f8aff20c51f236b16eba5dbe3890d157f85909ab36b1d084142836a343e6acb97e752d18819bec62e1458a038d9b24c609602dc3cbef87d959e597e0af19f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ami.midMD5
c2a501f010bf7b1c7a9777c3b93e19ef
SHA1d00adfeb88b435786f32cf7f45c1aae141690600
SHA256312d9b0380e5d8fd0bbee92b5d7f22a09b9278cbd7457777a08e2df5a859aff9
SHA5122850ad61312adc4d059e62c7dfaebabaa74ac280773e24920b746a56884d8c490b1d5c6637d56c966ca284a9cd515330d38faff55cfe77a1bd11f54f2c82f6fd
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Nascondere.exe.comMD5
c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Nascondere.exe.comMD5
c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Nascondere.exe.comMD5
c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\RegAsm.exeMD5
42ab6e035df99a43dbb879c86b620b91
SHA1c6e116569d17d8142dbb217b1f8bfa95bc148c38
SHA25653195987d396986ebcb20425ac130e78ad308fdbd918f33f3fd92b99abda314b
SHA5122e79de2d394ad33023d71611bb728b254aa4680b5a3a1ef5282b1155ddfaa2f3585c840a6700dfe0d1a276dac801298431f0187086d2e8f96b22f6c808fb97e5
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\RegAsm.exeMD5
42ab6e035df99a43dbb879c86b620b91
SHA1c6e116569d17d8142dbb217b1f8bfa95bc148c38
SHA25653195987d396986ebcb20425ac130e78ad308fdbd918f33f3fd92b99abda314b
SHA5122e79de2d394ad33023d71611bb728b254aa4680b5a3a1ef5282b1155ddfaa2f3585c840a6700dfe0d1a276dac801298431f0187086d2e8f96b22f6c808fb97e5
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Sorte.midMD5
ca6c6b8893411108280a0daf1a4d7d61
SHA1b791c3cdec5711baafa7be643d2d9a0a10ae0835
SHA25661b5e21e9798a8bf59a1c2e284d78d86706b4dc9bd6bef46bce54af95886bb46
SHA512c0f8c6e6c08a96d6bc9b77af1f300d45b011faa606c85b6220b89d890692d200230c16a206fa6c94a5f9e1568eb10181199a0d6b80b94f80706a5cd00f4fdbcf
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Starne.midMD5
603011f56db8309b2d5c4ea0a1c57a47
SHA191ffdd8dbc6c5935c954f2764bec480ae32a1432
SHA2565e4c34d70260f9bc2ce9f44b8fdef503667493f8d7c9d13b659da3b270a053f0
SHA512b1d53112fb89fc755e3933e88bcabd1ce2a2aa0032c948530769d96d06ca066d106fcdf2127348e618c7aac8b24b21ddbbdbdfd5113a641dbcd2da217d9ebdbe
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\WMD5
e44fd575c6528190adc21c41297c7f0f
SHA14a834789bb3ddeea37cd30861a4c0bb639eeafed
SHA2569ae0b37e4b26a6684eed731f3c3958e3661a3da9a89759825b97efebfe183547
SHA512443f8aff20c51f236b16eba5dbe3890d157f85909ab36b1d084142836a343e6acb97e752d18819bec62e1458a038d9b24c609602dc3cbef87d959e597e0af19f
-
C:\Users\Admin\AppData\Local\Temp\tmp9ADE.tmp.exeMD5
44150395748c027ef5f8eed812f620b0
SHA10d26c44e5e93a08da7504344498d3275ca11653e
SHA256144525451ace8e714f95f6235f310b6959871e559e11f33f3164006a02832a7f
SHA5125ba96935ebacd7c4e377c3171d411e7383132eed1c087ef66c3fe1a54987f826ac9221a1f43f4cc6627d184f7621dca6858b84ae692bde127bdf9d3a7bc04a4c
-
C:\Users\Admin\AppData\Local\Temp\tmp9ADE.tmp.exeMD5
44150395748c027ef5f8eed812f620b0
SHA10d26c44e5e93a08da7504344498d3275ca11653e
SHA256144525451ace8e714f95f6235f310b6959871e559e11f33f3164006a02832a7f
SHA5125ba96935ebacd7c4e377c3171d411e7383132eed1c087ef66c3fe1a54987f826ac9221a1f43f4cc6627d184f7621dca6858b84ae692bde127bdf9d3a7bc04a4c
-
C:\Users\Admin\AppData\Local\Temp\tmp9ADE.tmp.exeMD5
44150395748c027ef5f8eed812f620b0
SHA10d26c44e5e93a08da7504344498d3275ca11653e
SHA256144525451ace8e714f95f6235f310b6959871e559e11f33f3164006a02832a7f
SHA5125ba96935ebacd7c4e377c3171d411e7383132eed1c087ef66c3fe1a54987f826ac9221a1f43f4cc6627d184f7621dca6858b84ae692bde127bdf9d3a7bc04a4c
-
memory/432-240-0x0000000000000000-mapping.dmp
-
memory/448-208-0x0000000000000000-mapping.dmp
-
memory/448-212-0x0000000003920000-0x0000000003921000-memory.dmpFilesize
4KB
-
memory/676-242-0x0000000000000000-mapping.dmp
-
memory/1180-198-0x0000000000000000-mapping.dmp
-
memory/1196-149-0x0000000000000000-mapping.dmp
-
memory/2268-206-0x0000000000000000-mapping.dmp
-
memory/2276-213-0x0000000000000000-mapping.dmp
-
memory/2276-214-0x0000000000900000-0x00000000009B2000-memory.dmpFilesize
712KB
-
memory/2276-222-0x0000000004F70000-0x0000000004F71000-memory.dmpFilesize
4KB
-
memory/2276-224-0x0000000005F40000-0x0000000005F41000-memory.dmpFilesize
4KB
-
memory/2276-225-0x0000000005E50000-0x0000000005E51000-memory.dmpFilesize
4KB
-
memory/2276-228-0x0000000006240000-0x0000000006241000-memory.dmpFilesize
4KB
-
memory/2276-229-0x0000000006350000-0x0000000006351000-memory.dmpFilesize
4KB
-
memory/2276-230-0x0000000004DD0000-0x0000000005376000-memory.dmpFilesize
5.6MB
-
memory/2412-194-0x0000000000000000-mapping.dmp
-
memory/2492-233-0x0000000000000000-mapping.dmp
-
memory/2496-234-0x0000000000000000-mapping.dmp
-
memory/2540-200-0x0000000000000000-mapping.dmp
-
memory/2912-201-0x0000000000000000-mapping.dmp
-
memory/2988-147-0x000002DF44120000-0x000002DF44130000-memory.dmpFilesize
64KB
-
memory/2988-148-0x000002DF46800000-0x000002DF46804000-memory.dmpFilesize
16KB
-
memory/2988-146-0x000002DF43B60000-0x000002DF43B70000-memory.dmpFilesize
64KB
-
memory/3004-231-0x0000000000000000-mapping.dmp
-
memory/3164-162-0x0000000005220000-0x0000000005221000-memory.dmpFilesize
4KB
-
memory/3164-191-0x0000000009E50000-0x0000000009E51000-memory.dmpFilesize
4KB
-
memory/3164-188-0x000000007FC90000-0x000000007FC91000-memory.dmpFilesize
4KB
-
memory/3164-180-0x0000000009CE0000-0x0000000009D14000-memory.dmpFilesize
208KB
-
memory/3164-177-0x0000000008FD0000-0x0000000008FD1000-memory.dmpFilesize
4KB
-
memory/3164-176-0x000000000A3C0000-0x000000000A3C1000-memory.dmpFilesize
4KB
-
memory/3164-175-0x0000000005325000-0x0000000005327000-memory.dmpFilesize
8KB
-
memory/3164-174-0x0000000008B00000-0x0000000008B01000-memory.dmpFilesize
4KB
-
memory/3164-173-0x0000000008AB0000-0x0000000008AB1000-memory.dmpFilesize
4KB
-
memory/3164-171-0x0000000008610000-0x0000000008611000-memory.dmpFilesize
4KB
-
memory/3164-170-0x00000000081F0000-0x00000000081F1000-memory.dmpFilesize
4KB
-
memory/3164-169-0x0000000008180000-0x0000000008181000-memory.dmpFilesize
4KB
-
memory/3164-167-0x0000000007980000-0x0000000007981000-memory.dmpFilesize
4KB
-
memory/3164-166-0x0000000007920000-0x0000000007921000-memory.dmpFilesize
4KB
-
memory/3164-165-0x0000000005322000-0x0000000005323000-memory.dmpFilesize
4KB
-
memory/3164-164-0x0000000005320000-0x0000000005321000-memory.dmpFilesize
4KB
-
memory/3164-163-0x00000000079C0000-0x00000000079C1000-memory.dmpFilesize
4KB
-
memory/3164-193-0x0000000005100000-0x0000000005101000-memory.dmpFilesize
4KB
-
memory/3164-190-0x0000000009D40000-0x0000000009D41000-memory.dmpFilesize
4KB
-
memory/3164-161-0x0000000005100000-0x0000000005101000-memory.dmpFilesize
4KB
-
memory/3164-192-0x000000000A1A0000-0x000000000A1A1000-memory.dmpFilesize
4KB
-
memory/3164-189-0x0000000009CC0000-0x0000000009CC1000-memory.dmpFilesize
4KB
-
memory/3164-160-0x0000000005100000-0x0000000005101000-memory.dmpFilesize
4KB
-
memory/3164-159-0x0000000000000000-mapping.dmp
-
memory/3296-266-0x0000000000000000-mapping.dmp
-
memory/3860-236-0x0000000000000000-mapping.dmp
-
memory/3880-204-0x0000000000000000-mapping.dmp
-
memory/3884-265-0x0000000005760000-0x0000000005D06000-memory.dmpFilesize
5.6MB
-
memory/3884-249-0x0000000001180000-0x0000000001232000-memory.dmpFilesize
712KB
-
memory/3884-248-0x0000000000000000-mapping.dmp
-
memory/4284-237-0x0000000000000000-mapping.dmp
-
memory/4660-244-0x0000000000000000-mapping.dmp
-
memory/4704-197-0x0000000000000000-mapping.dmp
-
memory/4852-153-0x0000000005A20000-0x0000000005A21000-memory.dmpFilesize
4KB
-
memory/4852-152-0x0000000006100000-0x0000000006101000-memory.dmpFilesize
4KB
-
memory/4852-150-0x0000000000F10000-0x0000000000F11000-memory.dmpFilesize
4KB
-
memory/4852-154-0x0000000005AC0000-0x0000000005AC1000-memory.dmpFilesize
4KB
-
memory/4852-155-0x0000000005DE0000-0x0000000005DE1000-memory.dmpFilesize
4KB
-
memory/4852-156-0x0000000005B50000-0x00000000060F6000-memory.dmpFilesize
5.6MB
-
memory/4852-157-0x0000000005B90000-0x0000000005B91000-memory.dmpFilesize
4KB
-
memory/4852-158-0x0000000005B50000-0x00000000060F6000-memory.dmpFilesize
5.6MB