Analysis
-
max time kernel
152s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
27-01-2022 00:39
Static task
static1
Behavioral task
behavioral1
Sample
d377be4d6a905ccc1ecb50e53bafd15a3b2fe97e9b3ccae7a8af3041542d209b.exe
Resource
win10v2004-en-20220112
General
-
Target
d377be4d6a905ccc1ecb50e53bafd15a3b2fe97e9b3ccae7a8af3041542d209b.exe
-
Size
241KB
-
MD5
22deeb82aae1895de080024dc9d2c06e
-
SHA1
5b8cf555b64b2cc43b4984b162974745e6b71e10
-
SHA256
d377be4d6a905ccc1ecb50e53bafd15a3b2fe97e9b3ccae7a8af3041542d209b
-
SHA512
6eb2edb06ee73b2a78471e738c2fdbc3b788eaa893801600127d6468a3cbc8059683fd9d3b98650551f1d53e9700e05324d72be01bd9be0d17caf009b1844df7
Malware Config
Extracted
smokeloader
2020
http://abpa.at/upload/
http://emaratghajari.com/upload/
http://d7qw.cn/upload/
http://alumik-group.ru/upload/
http://zamkikurgan.ru/upload/
https://oakland-studio.video/search.php
https://seattle-university.video/search.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 7 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription pid process target process PID 32 created 3084 32 WerFault.exe ibsfjwu PID 3008 created 2204 3008 WerFault.exe explorer.exe PID 3532 created 2712 3532 WerFault.exe DllHost.exe PID 1336 created 3104 1336 WerFault.exe DllHost.exe PID 3432 created 2584 3432 WerFault.exe DllHost.exe PID 396 created 224 396 WerFault.exe DllHost.exe PID 532 created 2188 532 WerFault.exe DllHost.exe -
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows dir Microsoft Windows DOS prompt command exit OUTBOUND
-
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
suricata: ET MALWARE Windows route Microsoft Windows DOS prompt command exit OUTBOUND
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
EED.exeibsfjwupid process 632 EED.exe 3084 ibsfjwu -
Modifies Windows Firewall 1 TTPs
-
Sets service image path in registry 2 TTPs
-
Drops file in Windows directory 2 IoCs
Processes:
WerFault.exeTiWorker.exedescription ioc process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe -
Program crash 7 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 848 3084 WerFault.exe ibsfjwu 3876 2204 WerFault.exe explorer.exe 2436 2712 WerFault.exe DllHost.exe 212 3104 WerFault.exe DllHost.exe 4052 2584 WerFault.exe DllHost.exe 3688 224 WerFault.exe DllHost.exe 1044 2188 WerFault.exe DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
d377be4d6a905ccc1ecb50e53bafd15a3b2fe97e9b3ccae7a8af3041542d209b.exeEED.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d377be4d6a905ccc1ecb50e53bafd15a3b2fe97e9b3ccae7a8af3041542d209b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI EED.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI EED.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI EED.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d377be4d6a905ccc1ecb50e53bafd15a3b2fe97e9b3ccae7a8af3041542d209b.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d377be4d6a905ccc1ecb50e53bafd15a3b2fe97e9b3ccae7a8af3041542d209b.exe -
Checks processor information in registry 2 TTPs 21 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Enumerates system info in registry 2 TTPs 14 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe -
Gathers network information 2 TTPs 4 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEipconfig.exeipconfig.exeNETSTAT.EXEpid process 3916 NETSTAT.EXE 3304 ipconfig.exe 676 ipconfig.exe 1808 NETSTAT.EXE -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30937887" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0558a071f13d801 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30937887" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70ecb2071f13d801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30937887" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{2F1159A2-7F12-11EC-82D0-F2F412B024C7} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "63542407" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "63542407" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cce5a29beacafa47833fc2d72883fdda000000000200000000001066000000010000200000001a1bdc2b6f4dda6e286eef71b40c55cc413653d32ac4c2e1a8db31182299a79f000000000e8000000002000020000000c3d299f7e39946c60f776d6522aca786dc9898c94179181331f431a8a771110120000000d2faa9df9c41459ef4fb3f5f5e8f8ca426c244b982cb51d48b02dfa7eb40a9d940000000926a109f1116db62afbe3981a09c52c2bf3bab27fd0e0fdf1c51d496a2084a9d76daa7a62e6e75e6aec7dba2d28caa038dbd2ef3c8f4631b6388983b8d23109b iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "79167642" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cce5a29beacafa47833fc2d72883fdda000000000200000000001066000000010000200000008a674a400648236418434c87d23cca08815b565304ea31f9f65becac0579e288000000000e8000000002000020000000c1e6b584c1aad12e12e6e69b038166282162a988e563e4bdae3e44f4640461a220000000bae4b7930d7803d6ab5749a32d327742bf4d68a2f2d3d0359d823cdb629483d04000000001515fdcb138c6ceea03cdcba0e51fbe84accff8774f612def4e468e5b1382147dc2810277a381ade1866c6cff4f1b2037469f9f9c86b830d0acfa700cd0e93a iexplore.exe -
Modifies data under HKEY_USERS 41 IoCs
Processes:
WaaSMedicAgent.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
d377be4d6a905ccc1ecb50e53bafd15a3b2fe97e9b3ccae7a8af3041542d209b.exepid process 2936 d377be4d6a905ccc1ecb50e53bafd15a3b2fe97e9b3ccae7a8af3041542d209b.exe 2936 d377be4d6a905ccc1ecb50e53bafd15a3b2fe97e9b3ccae7a8af3041542d209b.exe 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 2424 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2424 -
Suspicious behavior: MapViewOfSection 62 IoCs
Processes:
d377be4d6a905ccc1ecb50e53bafd15a3b2fe97e9b3ccae7a8af3041542d209b.exeEED.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exepid process 2936 d377be4d6a905ccc1ecb50e53bafd15a3b2fe97e9b3ccae7a8af3041542d209b.exe 632 EED.exe 2424 2424 2424 2424 2424 2424 2916 explorer.exe 2916 explorer.exe 2424 2424 2544 explorer.exe 2544 explorer.exe 2424 2424 3112 explorer.exe 3112 explorer.exe 2424 2424 3052 explorer.exe 3052 explorer.exe 2424 2424 1480 explorer.exe 1480 explorer.exe 1480 explorer.exe 1480 explorer.exe 2424 2424 680 explorer.exe 680 explorer.exe 680 explorer.exe 680 explorer.exe 680 explorer.exe 680 explorer.exe 680 explorer.exe 680 explorer.exe 680 explorer.exe 680 explorer.exe 680 explorer.exe 680 explorer.exe 680 explorer.exe 680 explorer.exe 680 explorer.exe 680 explorer.exe 680 explorer.exe 680 explorer.exe 680 explorer.exe 680 explorer.exe 680 explorer.exe 680 explorer.exe 680 explorer.exe 680 explorer.exe 680 explorer.exe 680 explorer.exe 680 explorer.exe 680 explorer.exe 680 explorer.exe 680 explorer.exe 680 explorer.exe 680 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WerFault.exeWMIC.exeWMIC.exedescription pid process Token: SeRestorePrivilege 848 WerFault.exe Token: SeBackupPrivilege 848 WerFault.exe Token: SeBackupPrivilege 848 WerFault.exe Token: SeShutdownPrivilege 2424 Token: SeCreatePagefilePrivilege 2424 Token: SeIncreaseQuotaPrivilege 3652 WMIC.exe Token: SeSecurityPrivilege 3652 WMIC.exe Token: SeTakeOwnershipPrivilege 3652 WMIC.exe Token: SeLoadDriverPrivilege 3652 WMIC.exe Token: SeSystemProfilePrivilege 3652 WMIC.exe Token: SeSystemtimePrivilege 3652 WMIC.exe Token: SeProfSingleProcessPrivilege 3652 WMIC.exe Token: SeIncBasePriorityPrivilege 3652 WMIC.exe Token: SeCreatePagefilePrivilege 3652 WMIC.exe Token: SeBackupPrivilege 3652 WMIC.exe Token: SeRestorePrivilege 3652 WMIC.exe Token: SeShutdownPrivilege 3652 WMIC.exe Token: SeDebugPrivilege 3652 WMIC.exe Token: SeSystemEnvironmentPrivilege 3652 WMIC.exe Token: SeRemoteShutdownPrivilege 3652 WMIC.exe Token: SeUndockPrivilege 3652 WMIC.exe Token: SeManageVolumePrivilege 3652 WMIC.exe Token: 33 3652 WMIC.exe Token: 34 3652 WMIC.exe Token: 35 3652 WMIC.exe Token: 36 3652 WMIC.exe Token: SeIncreaseQuotaPrivilege 3652 WMIC.exe Token: SeSecurityPrivilege 3652 WMIC.exe Token: SeTakeOwnershipPrivilege 3652 WMIC.exe Token: SeLoadDriverPrivilege 3652 WMIC.exe Token: SeSystemProfilePrivilege 3652 WMIC.exe Token: SeSystemtimePrivilege 3652 WMIC.exe Token: SeProfSingleProcessPrivilege 3652 WMIC.exe Token: SeIncBasePriorityPrivilege 3652 WMIC.exe Token: SeCreatePagefilePrivilege 3652 WMIC.exe Token: SeBackupPrivilege 3652 WMIC.exe Token: SeRestorePrivilege 3652 WMIC.exe Token: SeShutdownPrivilege 3652 WMIC.exe Token: SeDebugPrivilege 3652 WMIC.exe Token: SeSystemEnvironmentPrivilege 3652 WMIC.exe Token: SeRemoteShutdownPrivilege 3652 WMIC.exe Token: SeUndockPrivilege 3652 WMIC.exe Token: SeManageVolumePrivilege 3652 WMIC.exe Token: 33 3652 WMIC.exe Token: 34 3652 WMIC.exe Token: 35 3652 WMIC.exe Token: 36 3652 WMIC.exe Token: SeIncreaseQuotaPrivilege 2892 WMIC.exe Token: SeSecurityPrivilege 2892 WMIC.exe Token: SeTakeOwnershipPrivilege 2892 WMIC.exe Token: SeLoadDriverPrivilege 2892 WMIC.exe Token: SeSystemProfilePrivilege 2892 WMIC.exe Token: SeSystemtimePrivilege 2892 WMIC.exe Token: SeProfSingleProcessPrivilege 2892 WMIC.exe Token: SeIncBasePriorityPrivilege 2892 WMIC.exe Token: SeCreatePagefilePrivilege 2892 WMIC.exe Token: SeBackupPrivilege 2892 WMIC.exe Token: SeRestorePrivilege 2892 WMIC.exe Token: SeShutdownPrivilege 2892 WMIC.exe Token: SeDebugPrivilege 2892 WMIC.exe Token: SeSystemEnvironmentPrivilege 2892 WMIC.exe Token: SeRemoteShutdownPrivilege 2892 WMIC.exe Token: SeUndockPrivilege 2892 WMIC.exe Token: SeManageVolumePrivilege 2892 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 3952 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 3952 iexplore.exe 3952 iexplore.exe 204 IEXPLORE.EXE 204 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
WerFault.execmd.exenet.exenet.exenet.exenet.exedescription pid process target process PID 2424 wrote to memory of 632 2424 EED.exe PID 2424 wrote to memory of 632 2424 EED.exe PID 2424 wrote to memory of 632 2424 EED.exe PID 32 wrote to memory of 3084 32 WerFault.exe ibsfjwu PID 32 wrote to memory of 3084 32 WerFault.exe ibsfjwu PID 2424 wrote to memory of 3544 2424 cmd.exe PID 2424 wrote to memory of 3544 2424 cmd.exe PID 3544 wrote to memory of 3652 3544 cmd.exe WMIC.exe PID 3544 wrote to memory of 3652 3544 cmd.exe WMIC.exe PID 3544 wrote to memory of 2892 3544 cmd.exe WMIC.exe PID 3544 wrote to memory of 2892 3544 cmd.exe WMIC.exe PID 3544 wrote to memory of 4028 3544 cmd.exe WMIC.exe PID 3544 wrote to memory of 4028 3544 cmd.exe WMIC.exe PID 3544 wrote to memory of 4040 3544 cmd.exe WMIC.exe PID 3544 wrote to memory of 4040 3544 cmd.exe WMIC.exe PID 3544 wrote to memory of 2764 3544 cmd.exe WMIC.exe PID 3544 wrote to memory of 2764 3544 cmd.exe WMIC.exe PID 3544 wrote to memory of 984 3544 cmd.exe WMIC.exe PID 3544 wrote to memory of 984 3544 cmd.exe WMIC.exe PID 3544 wrote to memory of 3764 3544 cmd.exe WMIC.exe PID 3544 wrote to memory of 3764 3544 cmd.exe WMIC.exe PID 3544 wrote to memory of 3164 3544 cmd.exe WMIC.exe PID 3544 wrote to memory of 3164 3544 cmd.exe WMIC.exe PID 3544 wrote to memory of 2116 3544 cmd.exe WMIC.exe PID 3544 wrote to memory of 2116 3544 cmd.exe WMIC.exe PID 3544 wrote to memory of 3396 3544 cmd.exe WMIC.exe PID 3544 wrote to memory of 3396 3544 cmd.exe WMIC.exe PID 3544 wrote to memory of 848 3544 cmd.exe WMIC.exe PID 3544 wrote to memory of 848 3544 cmd.exe WMIC.exe PID 3544 wrote to memory of 2640 3544 cmd.exe WMIC.exe PID 3544 wrote to memory of 2640 3544 cmd.exe WMIC.exe PID 3544 wrote to memory of 3472 3544 cmd.exe WMIC.exe PID 3544 wrote to memory of 3472 3544 cmd.exe WMIC.exe PID 3544 wrote to memory of 3520 3544 cmd.exe WMIC.exe PID 3544 wrote to memory of 3520 3544 cmd.exe WMIC.exe PID 3544 wrote to memory of 676 3544 cmd.exe ipconfig.exe PID 3544 wrote to memory of 676 3544 cmd.exe ipconfig.exe PID 3544 wrote to memory of 3172 3544 cmd.exe ROUTE.EXE PID 3544 wrote to memory of 3172 3544 cmd.exe ROUTE.EXE PID 3544 wrote to memory of 3420 3544 cmd.exe netsh.exe PID 3544 wrote to memory of 3420 3544 cmd.exe netsh.exe PID 3544 wrote to memory of 3672 3544 cmd.exe systeminfo.exe PID 3544 wrote to memory of 3672 3544 cmd.exe systeminfo.exe PID 3544 wrote to memory of 4040 3544 cmd.exe tasklist.exe PID 3544 wrote to memory of 4040 3544 cmd.exe tasklist.exe PID 3544 wrote to memory of 2188 3544 cmd.exe net.exe PID 3544 wrote to memory of 2188 3544 cmd.exe net.exe PID 2188 wrote to memory of 532 2188 net.exe net1.exe PID 2188 wrote to memory of 532 2188 net.exe net1.exe PID 3544 wrote to memory of 644 3544 cmd.exe net.exe PID 3544 wrote to memory of 644 3544 cmd.exe net.exe PID 644 wrote to memory of 1436 644 net.exe net1.exe PID 644 wrote to memory of 1436 644 net.exe net1.exe PID 3544 wrote to memory of 1832 3544 cmd.exe net.exe PID 3544 wrote to memory of 1832 3544 cmd.exe net.exe PID 1832 wrote to memory of 3184 1832 net.exe net1.exe PID 1832 wrote to memory of 3184 1832 net.exe net1.exe PID 3544 wrote to memory of 2900 3544 cmd.exe net.exe PID 3544 wrote to memory of 2900 3544 cmd.exe net.exe PID 2900 wrote to memory of 2412 2900 net.exe net1.exe PID 2900 wrote to memory of 2412 2900 net.exe net1.exe PID 3544 wrote to memory of 2212 3544 cmd.exe net.exe PID 3544 wrote to memory of 2212 3544 cmd.exe net.exe PID 3544 wrote to memory of 3532 3544 cmd.exe net.exe
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2712 -s 10162⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\d377be4d6a905ccc1ecb50e53bafd15a3b2fe97e9b3ccae7a8af3041542d209b.exe"C:\Users\Admin\AppData\Local\Temp\d377be4d6a905ccc1ecb50e53bafd15a3b2fe97e9b3ccae7a8af3041542d209b.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 275da61b2f8f23b53a31f7f74fdd7d21 YgVdqpoXwUiqHaJ9UTdVaQ.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Local\Temp\EED.exeC:\Users\Admin\AppData\Local\Temp\EED.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\ibsfjwuC:\Users\Admin\AppData\Roaming\ibsfjwu1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 3402⤵
- Drops file in Windows directory
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3084 -ip 30841⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /displaydns2⤵
- Gathers network information
-
C:\Windows\system32\ROUTE.EXEroute print2⤵
-
C:\Windows\system32\netsh.exenetsh firewall show state2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo2⤵
- Gathers system information
-
C:\Windows\system32\tasklist.exetasklist /v2⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\net.exenet accounts /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 accounts /domain3⤵
-
C:\Windows\system32\net.exenet share2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 share3⤵
-
C:\Windows\system32\net.exenet user2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user3⤵
-
C:\Windows\system32\net.exenet user /domain2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user /domain3⤵
-
C:\Windows\system32\net.exenet use2⤵
-
C:\Windows\system32\net.exenet group2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group3⤵
-
C:\Windows\system32\net.exenet localgroup2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup3⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -r2⤵
- Gathers network information
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print3⤵
-
C:\Windows\system32\ROUTE.EXEC:\Windows\system32\route.exe print4⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -nao2⤵
- Gathers network information
-
C:\Windows\system32\schtasks.exeschtasks /query2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /all2⤵
- Gathers network information
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3952 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 8802⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2204 -ip 22041⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 492 -p 2712 -ip 27121⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3104 -s 8282⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 396 -p 3104 -ip 31041⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2584 -s 8042⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 520 -p 2584 -ip 25841⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 224 -s 4922⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 216 -p 224 -ip 2241⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2188 -s 7842⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 532 -p 2188 -ip 21881⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\EED.exeMD5
bda013087a8132ffc38bf59af9362f50
SHA15217d721e45a3bb2a7606ce81fcf17d33aa806a6
SHA25620bce27320334129950e98b7e60d3b55ba86e94174ff8316fc48fe03b8c43585
SHA512a6557e218b99b8576d9601d99d1c3844eef14f624b488e90ae5bbf5491f596af758c70590df4c8dc2a54abe8073001efc54235c39309d65c12bed152ff5b629e
-
C:\Users\Admin\AppData\Local\Temp\EED.exeMD5
bda013087a8132ffc38bf59af9362f50
SHA15217d721e45a3bb2a7606ce81fcf17d33aa806a6
SHA25620bce27320334129950e98b7e60d3b55ba86e94174ff8316fc48fe03b8c43585
SHA512a6557e218b99b8576d9601d99d1c3844eef14f624b488e90ae5bbf5491f596af758c70590df4c8dc2a54abe8073001efc54235c39309d65c12bed152ff5b629e
-
C:\Users\Admin\AppData\Roaming\ibsfjwuMD5
22deeb82aae1895de080024dc9d2c06e
SHA15b8cf555b64b2cc43b4984b162974745e6b71e10
SHA256d377be4d6a905ccc1ecb50e53bafd15a3b2fe97e9b3ccae7a8af3041542d209b
SHA5126eb2edb06ee73b2a78471e738c2fdbc3b788eaa893801600127d6468a3cbc8059683fd9d3b98650551f1d53e9700e05324d72be01bd9be0d17caf009b1844df7
-
C:\Users\Admin\AppData\Roaming\ibsfjwuMD5
22deeb82aae1895de080024dc9d2c06e
SHA15b8cf555b64b2cc43b4984b162974745e6b71e10
SHA256d377be4d6a905ccc1ecb50e53bafd15a3b2fe97e9b3ccae7a8af3041542d209b
SHA5126eb2edb06ee73b2a78471e738c2fdbc3b788eaa893801600127d6468a3cbc8059683fd9d3b98650551f1d53e9700e05324d72be01bd9be0d17caf009b1844df7
-
memory/224-199-0x000001F9D6270000-0x000001F9D6280000-memory.dmpFilesize
64KB
-
memory/404-196-0x00000144ED920000-0x00000144ED921000-memory.dmpFilesize
4KB
-
memory/632-136-0x00000000005E0000-0x0000000000606000-memory.dmpFilesize
152KB
-
memory/632-137-0x00000000005A0000-0x00000000005A9000-memory.dmpFilesize
36KB
-
memory/632-138-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/680-188-0x0000000000510000-0x0000000000517000-memory.dmpFilesize
28KB
-
memory/680-189-0x0000000000500000-0x000000000050D000-memory.dmpFilesize
52KB
-
memory/1452-212-0x00000240385E0000-0x00000240385E1000-memory.dmpFilesize
4KB
-
memory/1452-198-0x00000240385E0000-0x00000240385E1000-memory.dmpFilesize
4KB
-
memory/1480-184-0x0000000002C60000-0x0000000002C66000-memory.dmpFilesize
24KB
-
memory/1480-185-0x0000000002C50000-0x0000000002C5B000-memory.dmpFilesize
44KB
-
memory/2204-173-0x0000000000490000-0x0000000000505000-memory.dmpFilesize
468KB
-
memory/2204-174-0x0000000000420000-0x000000000048B000-memory.dmpFilesize
428KB
-
memory/2216-190-0x0000017C09D80000-0x0000017C09D81000-memory.dmpFilesize
4KB
-
memory/2248-191-0x000001A3E4F10000-0x000001A3E4F11000-memory.dmpFilesize
4KB
-
memory/2284-192-0x0000011A0C040000-0x0000011A0C041000-memory.dmpFilesize
4KB
-
memory/2296-175-0x0000000000B40000-0x0000000000B4C000-memory.dmpFilesize
48KB
-
memory/2424-144-0x0000000007C50000-0x0000000007C5F000-memory.dmpFilesize
60KB
-
memory/2424-143-0x0000000002B20000-0x0000000002B36000-memory.dmpFilesize
88KB
-
memory/2424-133-0x0000000000B60000-0x0000000000B76000-memory.dmpFilesize
88KB
-
memory/2460-187-0x0000000004CE0000-0x0000000004CEB000-memory.dmpFilesize
44KB
-
memory/2460-186-0x0000000004CF0000-0x0000000004CF1000-memory.dmpFilesize
4KB
-
memory/2512-193-0x00000165E3AD0000-0x00000165E3AD1000-memory.dmpFilesize
4KB
-
memory/2544-179-0x00000000009B0000-0x00000000009BE000-memory.dmpFilesize
56KB
-
memory/2544-178-0x00000000009C0000-0x00000000009C9000-memory.dmpFilesize
36KB
-
memory/2816-194-0x000001D585490000-0x000001D585491000-memory.dmpFilesize
4KB
-
memory/2884-195-0x0000022A2FDE0000-0x0000022A2FDE1000-memory.dmpFilesize
4KB
-
memory/2916-176-0x0000000002D10000-0x0000000002D17000-memory.dmpFilesize
28KB
-
memory/2916-177-0x0000000002D00000-0x0000000002D0B000-memory.dmpFilesize
44KB
-
memory/2936-130-0x0000000000810000-0x0000000000838000-memory.dmpFilesize
160KB
-
memory/2936-132-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/2936-131-0x00000000007F0000-0x00000000007F9000-memory.dmpFilesize
36KB
-
memory/3052-183-0x00000000006B0000-0x00000000006BC000-memory.dmpFilesize
48KB
-
memory/3052-182-0x00000000006C0000-0x00000000006C6000-memory.dmpFilesize
24KB
-
memory/3084-142-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/3084-141-0x0000000000520000-0x0000000000547000-memory.dmpFilesize
156KB
-
memory/3112-180-0x0000000002C60000-0x0000000002C65000-memory.dmpFilesize
20KB
-
memory/3112-181-0x0000000002C50000-0x0000000002C59000-memory.dmpFilesize
36KB
-
memory/3848-197-0x0000027186460000-0x0000027186461000-memory.dmpFilesize
4KB