Analysis
-
max time kernel
196s -
max time network
183s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
01-02-2022 01:25
Static task
static1
Behavioral task
behavioral1
Sample
aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
-
Target
aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe
-
Size
65KB
-
MD5
5326329820103eddbd231b1898816204
-
SHA1
77557dd9115aa0be7b509b301a526a4234496e37
-
SHA256
aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5
-
SHA512
534de02ead299dcdec9cc1aac244a4afe6f1c1b891948aae62e1419c0242ddea9999d0885eb166c6b76a1a068a54ca9ebe3bb6ec239fa4c7348c6ac28b2b1af9
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\CroppedImage.xbf aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\LICENSE aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-white_targetsize-40.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\locimages\offsyml.ttf aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-100.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-64.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-32.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookWideTile.scale-100.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe.manifest aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-black_targetsize-36.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-72_altform-unplated.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Advanced-Light.scale-250.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\TimerSmallTile.contrast-white_scale-100.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-72.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalAppList.scale-100_contrast-white.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-16_altform-unplated.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorLargeTile.contrast-white_scale-200.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\AppPowerPoint32x32.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\PhotosAppList.contrast-white_scale-100.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\LiveTiles\avatar150x150.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarSplashLogo.scale-125.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Images\remixCTA_welcome.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\FA000000008 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\CourierStd-Oblique.otf aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Google.scale-100.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubSplashScreen.scale-100_contrast-high.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\CalculatorLargeTile.contrast-white_scale-125.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\TimerWideTile.contrast-black_scale-125.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\GamesXboxHubAppList.scale-100.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\VoiceRecorderMedTile.contrast-black_scale-125.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailMediumTile.scale-150.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-24.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-100_8wekyb3d8bbwe\images\Square44x44Logo.scale-100.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_2019.729.2301.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleAppAssets\Videos\people_wel_motionAsset.m4v aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoutilstat.etw.man aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\Movie-TVStoreLogo.scale-200_contrast-black.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-40_altform-unplated_contrast-white.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-80_altform-lightunplated.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxWideTile.scale-100.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\Doughboy.scale-250.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.UI\Resources\Images\star_empty.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-96.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-24_altform-unplated.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageLargeTile.scale-100.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailMediumTile.scale-400.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\http.luac aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppPackageLargeTile.scale-100.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-20_altform-lightunplated.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-72_altform-lightunplated.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\plugins.dat aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNewNoteMedTile.scale-150.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\PreviewMailList.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-40.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-40_altform-unplated_contrast-black.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.1.7_1.7.25531.0_x64__8wekyb3d8bbwe\AppxManifest.xml aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\Ratings\YelpLogo.svg aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.scale-400.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-48_altform-unplated.png aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\hr-HR\View3d\3DViewerProductDescription-universal.xml aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe Token: SeImpersonatePrivilege 1368 aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe"C:\Users\Admin\AppData\Local\Temp\aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1368