Analysis
-
max time kernel
154s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
18-02-2022 11:48
Static task
static1
Behavioral task
behavioral1
Sample
cc1b6971441d2ec84c14247d4f014912.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
cc1b6971441d2ec84c14247d4f014912.exe
Resource
win10v2004-en-20220112
General
-
Target
cc1b6971441d2ec84c14247d4f014912.exe
-
Size
32KB
-
MD5
cc1b6971441d2ec84c14247d4f014912
-
SHA1
a786dcb3bffe527a6954d3c242138d34707e21d3
-
SHA256
af1c3dd3dc0c3a7e1b4d829f79077e41e17ce8f95cbdcfef7cc7bc0e5b18c7d8
-
SHA512
a91cf7ebd024a5431ee8e2202740809fb6dace5d4965be107b6f83bbed34f21bde21d45a79e08401791cd204db8d9c23b00d791f8bc5714a6e33022f8aada77b
Malware Config
Extracted
asyncrat
0.5.7B
1
212.193.30.54:8755
gyQ12!.,=FD7trew
-
anti_vm
false
-
bsod
false
-
delay
3
-
install
false
-
install_folder
%AppData%
-
pastebin_config
null
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3576-135-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cc1b6971441d2ec84c14247d4f014912.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation cc1b6971441d2ec84c14247d4f014912.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
cc1b6971441d2ec84c14247d4f014912.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Zdrqamx = "\"C:\\Users\\Admin\\AppData\\Roaming\\Txdlljii\\Zdrqamx.exe\"" cc1b6971441d2ec84c14247d4f014912.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
cc1b6971441d2ec84c14247d4f014912.exedescription pid process target process PID 3092 set thread context of 3576 3092 cc1b6971441d2ec84c14247d4f014912.exe MSBuild.exe -
Drops file in Windows directory 3 IoCs
Processes:
TiWorker.exesvchost.exedescription ioc process File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MusNotifyIcon.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe -
Modifies data under HKEY_USERS 52 IoCs
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4308" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.039339" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4032" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4144" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "10.000265" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.160901" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.009696" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132898349345517552" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4400" svchost.exe -
Runs ping.exe 1 TTPs 10 IoCs
Processes:
PING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEpid process 880 PING.EXE 3384 PING.EXE 2188 PING.EXE 3052 PING.EXE 968 PING.EXE 3100 PING.EXE 1796 PING.EXE 400 PING.EXE 3472 PING.EXE 576 PING.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
cc1b6971441d2ec84c14247d4f014912.exepid process 3092 cc1b6971441d2ec84c14247d4f014912.exe 3092 cc1b6971441d2ec84c14247d4f014912.exe 3092 cc1b6971441d2ec84c14247d4f014912.exe 3092 cc1b6971441d2ec84c14247d4f014912.exe 3092 cc1b6971441d2ec84c14247d4f014912.exe 3092 cc1b6971441d2ec84c14247d4f014912.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
TiWorker.exedescription pid process Token: SeSecurityPrivilege 1660 TiWorker.exe Token: SeRestorePrivilege 1660 TiWorker.exe Token: SeBackupPrivilege 1660 TiWorker.exe Token: SeBackupPrivilege 1660 TiWorker.exe Token: SeRestorePrivilege 1660 TiWorker.exe Token: SeSecurityPrivilege 1660 TiWorker.exe Token: SeBackupPrivilege 1660 TiWorker.exe Token: SeRestorePrivilege 1660 TiWorker.exe Token: SeSecurityPrivilege 1660 TiWorker.exe Token: SeBackupPrivilege 1660 TiWorker.exe Token: SeRestorePrivilege 1660 TiWorker.exe Token: SeSecurityPrivilege 1660 TiWorker.exe Token: SeBackupPrivilege 1660 TiWorker.exe Token: SeRestorePrivilege 1660 TiWorker.exe Token: SeSecurityPrivilege 1660 TiWorker.exe Token: SeBackupPrivilege 1660 TiWorker.exe Token: SeRestorePrivilege 1660 TiWorker.exe Token: SeSecurityPrivilege 1660 TiWorker.exe Token: SeBackupPrivilege 1660 TiWorker.exe Token: SeRestorePrivilege 1660 TiWorker.exe Token: SeSecurityPrivilege 1660 TiWorker.exe Token: SeBackupPrivilege 1660 TiWorker.exe Token: SeRestorePrivilege 1660 TiWorker.exe Token: SeSecurityPrivilege 1660 TiWorker.exe Token: SeBackupPrivilege 1660 TiWorker.exe Token: SeRestorePrivilege 1660 TiWorker.exe Token: SeSecurityPrivilege 1660 TiWorker.exe Token: SeBackupPrivilege 1660 TiWorker.exe Token: SeRestorePrivilege 1660 TiWorker.exe Token: SeSecurityPrivilege 1660 TiWorker.exe Token: SeBackupPrivilege 1660 TiWorker.exe Token: SeRestorePrivilege 1660 TiWorker.exe Token: SeSecurityPrivilege 1660 TiWorker.exe Token: SeBackupPrivilege 1660 TiWorker.exe Token: SeRestorePrivilege 1660 TiWorker.exe Token: SeSecurityPrivilege 1660 TiWorker.exe Token: SeBackupPrivilege 1660 TiWorker.exe Token: SeRestorePrivilege 1660 TiWorker.exe Token: SeSecurityPrivilege 1660 TiWorker.exe Token: SeBackupPrivilege 1660 TiWorker.exe Token: SeRestorePrivilege 1660 TiWorker.exe Token: SeSecurityPrivilege 1660 TiWorker.exe Token: SeBackupPrivilege 1660 TiWorker.exe Token: SeRestorePrivilege 1660 TiWorker.exe Token: SeSecurityPrivilege 1660 TiWorker.exe Token: SeBackupPrivilege 1660 TiWorker.exe Token: SeRestorePrivilege 1660 TiWorker.exe Token: SeSecurityPrivilege 1660 TiWorker.exe Token: SeBackupPrivilege 1660 TiWorker.exe Token: SeRestorePrivilege 1660 TiWorker.exe Token: SeSecurityPrivilege 1660 TiWorker.exe Token: SeBackupPrivilege 1660 TiWorker.exe Token: SeRestorePrivilege 1660 TiWorker.exe Token: SeSecurityPrivilege 1660 TiWorker.exe Token: SeBackupPrivilege 1660 TiWorker.exe Token: SeRestorePrivilege 1660 TiWorker.exe Token: SeSecurityPrivilege 1660 TiWorker.exe Token: SeBackupPrivilege 1660 TiWorker.exe Token: SeRestorePrivilege 1660 TiWorker.exe Token: SeSecurityPrivilege 1660 TiWorker.exe Token: SeBackupPrivilege 1660 TiWorker.exe Token: SeRestorePrivilege 1660 TiWorker.exe Token: SeSecurityPrivilege 1660 TiWorker.exe Token: SeBackupPrivilege 1660 TiWorker.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cc1b6971441d2ec84c14247d4f014912.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 3092 wrote to memory of 1948 3092 cc1b6971441d2ec84c14247d4f014912.exe cmd.exe PID 3092 wrote to memory of 1948 3092 cc1b6971441d2ec84c14247d4f014912.exe cmd.exe PID 3092 wrote to memory of 1948 3092 cc1b6971441d2ec84c14247d4f014912.exe cmd.exe PID 1948 wrote to memory of 2188 1948 cmd.exe PING.EXE PID 1948 wrote to memory of 2188 1948 cmd.exe PING.EXE PID 1948 wrote to memory of 2188 1948 cmd.exe PING.EXE PID 3092 wrote to memory of 2232 3092 cc1b6971441d2ec84c14247d4f014912.exe cmd.exe PID 3092 wrote to memory of 2232 3092 cc1b6971441d2ec84c14247d4f014912.exe cmd.exe PID 3092 wrote to memory of 2232 3092 cc1b6971441d2ec84c14247d4f014912.exe cmd.exe PID 2232 wrote to memory of 400 2232 cmd.exe PING.EXE PID 2232 wrote to memory of 400 2232 cmd.exe PING.EXE PID 2232 wrote to memory of 400 2232 cmd.exe PING.EXE PID 3092 wrote to memory of 4036 3092 cc1b6971441d2ec84c14247d4f014912.exe cmd.exe PID 3092 wrote to memory of 4036 3092 cc1b6971441d2ec84c14247d4f014912.exe cmd.exe PID 3092 wrote to memory of 4036 3092 cc1b6971441d2ec84c14247d4f014912.exe cmd.exe PID 4036 wrote to memory of 3052 4036 cmd.exe PING.EXE PID 4036 wrote to memory of 3052 4036 cmd.exe PING.EXE PID 4036 wrote to memory of 3052 4036 cmd.exe PING.EXE PID 3092 wrote to memory of 2492 3092 cc1b6971441d2ec84c14247d4f014912.exe cmd.exe PID 3092 wrote to memory of 2492 3092 cc1b6971441d2ec84c14247d4f014912.exe cmd.exe PID 3092 wrote to memory of 2492 3092 cc1b6971441d2ec84c14247d4f014912.exe cmd.exe PID 2492 wrote to memory of 968 2492 cmd.exe PING.EXE PID 2492 wrote to memory of 968 2492 cmd.exe PING.EXE PID 2492 wrote to memory of 968 2492 cmd.exe PING.EXE PID 3092 wrote to memory of 1488 3092 cc1b6971441d2ec84c14247d4f014912.exe cmd.exe PID 3092 wrote to memory of 1488 3092 cc1b6971441d2ec84c14247d4f014912.exe cmd.exe PID 3092 wrote to memory of 1488 3092 cc1b6971441d2ec84c14247d4f014912.exe cmd.exe PID 1488 wrote to memory of 3100 1488 cmd.exe PING.EXE PID 1488 wrote to memory of 3100 1488 cmd.exe PING.EXE PID 1488 wrote to memory of 3100 1488 cmd.exe PING.EXE PID 3092 wrote to memory of 828 3092 cc1b6971441d2ec84c14247d4f014912.exe cmd.exe PID 3092 wrote to memory of 828 3092 cc1b6971441d2ec84c14247d4f014912.exe cmd.exe PID 3092 wrote to memory of 828 3092 cc1b6971441d2ec84c14247d4f014912.exe cmd.exe PID 828 wrote to memory of 3472 828 cmd.exe PING.EXE PID 828 wrote to memory of 3472 828 cmd.exe PING.EXE PID 828 wrote to memory of 3472 828 cmd.exe PING.EXE PID 3092 wrote to memory of 3840 3092 cc1b6971441d2ec84c14247d4f014912.exe cmd.exe PID 3092 wrote to memory of 3840 3092 cc1b6971441d2ec84c14247d4f014912.exe cmd.exe PID 3092 wrote to memory of 3840 3092 cc1b6971441d2ec84c14247d4f014912.exe cmd.exe PID 3840 wrote to memory of 1796 3840 cmd.exe PING.EXE PID 3840 wrote to memory of 1796 3840 cmd.exe PING.EXE PID 3840 wrote to memory of 1796 3840 cmd.exe PING.EXE PID 3092 wrote to memory of 1448 3092 cc1b6971441d2ec84c14247d4f014912.exe cmd.exe PID 3092 wrote to memory of 1448 3092 cc1b6971441d2ec84c14247d4f014912.exe cmd.exe PID 3092 wrote to memory of 1448 3092 cc1b6971441d2ec84c14247d4f014912.exe cmd.exe PID 1448 wrote to memory of 880 1448 cmd.exe PING.EXE PID 1448 wrote to memory of 880 1448 cmd.exe PING.EXE PID 1448 wrote to memory of 880 1448 cmd.exe PING.EXE PID 3092 wrote to memory of 3656 3092 cc1b6971441d2ec84c14247d4f014912.exe cmd.exe PID 3092 wrote to memory of 3656 3092 cc1b6971441d2ec84c14247d4f014912.exe cmd.exe PID 3092 wrote to memory of 3656 3092 cc1b6971441d2ec84c14247d4f014912.exe cmd.exe PID 3656 wrote to memory of 576 3656 cmd.exe PING.EXE PID 3656 wrote to memory of 576 3656 cmd.exe PING.EXE PID 3656 wrote to memory of 576 3656 cmd.exe PING.EXE PID 3092 wrote to memory of 3728 3092 cc1b6971441d2ec84c14247d4f014912.exe cmd.exe PID 3092 wrote to memory of 3728 3092 cc1b6971441d2ec84c14247d4f014912.exe cmd.exe PID 3092 wrote to memory of 3728 3092 cc1b6971441d2ec84c14247d4f014912.exe cmd.exe PID 3728 wrote to memory of 3384 3728 cmd.exe PING.EXE PID 3728 wrote to memory of 3384 3728 cmd.exe PING.EXE PID 3728 wrote to memory of 3384 3728 cmd.exe PING.EXE PID 3092 wrote to memory of 2900 3092 cc1b6971441d2ec84c14247d4f014912.exe MSBuild.exe PID 3092 wrote to memory of 2900 3092 cc1b6971441d2ec84c14247d4f014912.exe MSBuild.exe PID 3092 wrote to memory of 2900 3092 cc1b6971441d2ec84c14247d4f014912.exe MSBuild.exe PID 3092 wrote to memory of 3576 3092 cc1b6971441d2ec84c14247d4f014912.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc1b6971441d2ec84c14247d4f014912.exe"C:\Users\Admin\AppData\Local\Temp\cc1b6971441d2ec84c14247d4f014912.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping yahoo.com2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping yahoo.com3⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping yahoo.com2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping yahoo.com3⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping yahoo.com2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping yahoo.com3⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping yahoo.com2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping yahoo.com3⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping yahoo.com2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping yahoo.com3⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping yahoo.com2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping yahoo.com3⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping yahoo.com2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping yahoo.com3⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping yahoo.com2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping yahoo.com3⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping yahoo.com2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping yahoo.com3⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping yahoo.com2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping yahoo.com3⤵
- Runs ping.exe
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe2⤵
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3092-130-0x000000007491E000-0x000000007491F000-memory.dmpFilesize
4KB
-
memory/3092-131-0x0000000000CE0000-0x0000000000CEE000-memory.dmpFilesize
56KB
-
memory/3092-132-0x00000000017E0000-0x00000000017E1000-memory.dmpFilesize
4KB
-
memory/3092-133-0x000000000CE20000-0x000000000D3C4000-memory.dmpFilesize
5.6MB
-
memory/3092-134-0x0000000005EA0000-0x0000000005F32000-memory.dmpFilesize
584KB
-
memory/3576-135-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3576-136-0x000000007491E000-0x000000007491F000-memory.dmpFilesize
4KB
-
memory/3576-137-0x0000000005670000-0x0000000005671000-memory.dmpFilesize
4KB
-
memory/3576-138-0x0000000005B60000-0x0000000005BFC000-memory.dmpFilesize
624KB
-
memory/3576-139-0x0000000005C70000-0x0000000005CD6000-memory.dmpFilesize
408KB