Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
15-04-2022 12:56
Static task
static1
Behavioral task
behavioral1
Sample
8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe
Resource
win10v2004-20220414-en
General
-
Target
8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe
-
Size
7.0MB
-
MD5
bf006c9b0da0a6a76cc818fd6c4332b2
-
SHA1
fa71947f41bc5900d793cda9e0edaaa79774750c
-
SHA256
8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2
-
SHA512
e0929448f3d4bd6c1bc0c749ea23eb756f6eaf64fe2e014d16a38c8aeb870077e35691d9cb7dd813f5af38d8d72d8cf8ec02e38906135b8235b91af6793ce05b
Malware Config
Extracted
matiex
Protocol: smtp- Host:
smtp.privateemail.com - Port:
587 - Username:
[email protected] - Password:
MARYolanmauluogwo@ever
Signatures
-
Matiex Main Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3432-145-0x0000000000400000-0x0000000000476000-memory.dmp family_matiex -
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe\"" 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe -
Turns off Windows Defender SpyNet reporting 2 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe -
Drops startup file 2 IoCs
Processes:
8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0" 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0" 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe = "0" 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe = "0" 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\<Unknown> = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe" 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe" 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 checkip.dyndns.org 6 freegeoip.app 7 freegeoip.app -
Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
Processes:
8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exepid process 2912 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe 2912 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe 2912 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe 2912 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe 2912 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe 2912 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe 2912 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe 2912 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe 2912 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe 2912 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe 2912 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe 2912 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe 2912 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe 2912 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe 2912 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exedescription pid process target process PID 2912 set thread context of 3432 2912 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4732 2912 WerFault.exe 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exe8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exepid process 4012 powershell.exe 2916 powershell.exe 3144 powershell.exe 1324 powershell.exe 2916 powershell.exe 4012 powershell.exe 3144 powershell.exe 1324 powershell.exe 2912 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe 2912 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe 2912 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe 2912 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe 2912 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe 3432 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exepid process 3432 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exepowershell.exepowershell.exepowershell.exepowershell.exe8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exedescription pid process Token: SeDebugPrivilege 2912 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe Token: SeDebugPrivilege 2916 powershell.exe Token: SeDebugPrivilege 4012 powershell.exe Token: SeDebugPrivilege 3144 powershell.exe Token: SeDebugPrivilege 1324 powershell.exe Token: SeDebugPrivilege 3432 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exepid process 3432 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exedescription pid process target process PID 2912 wrote to memory of 2916 2912 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe powershell.exe PID 2912 wrote to memory of 2916 2912 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe powershell.exe PID 2912 wrote to memory of 2916 2912 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe powershell.exe PID 2912 wrote to memory of 4012 2912 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe powershell.exe PID 2912 wrote to memory of 4012 2912 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe powershell.exe PID 2912 wrote to memory of 4012 2912 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe powershell.exe PID 2912 wrote to memory of 3144 2912 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe powershell.exe PID 2912 wrote to memory of 3144 2912 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe powershell.exe PID 2912 wrote to memory of 3144 2912 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe powershell.exe PID 2912 wrote to memory of 1324 2912 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe powershell.exe PID 2912 wrote to memory of 1324 2912 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe powershell.exe PID 2912 wrote to memory of 1324 2912 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe powershell.exe PID 2912 wrote to memory of 1364 2912 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe PID 2912 wrote to memory of 1364 2912 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe PID 2912 wrote to memory of 1364 2912 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe PID 2912 wrote to memory of 3432 2912 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe PID 2912 wrote to memory of 3432 2912 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe PID 2912 wrote to memory of 3432 2912 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe PID 2912 wrote to memory of 3432 2912 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe PID 2912 wrote to memory of 3432 2912 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe PID 2912 wrote to memory of 3432 2912 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe PID 2912 wrote to memory of 3432 2912 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe PID 2912 wrote to memory of 3432 2912 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe PID 3432 wrote to memory of 4708 3432 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe netsh.exe PID 3432 wrote to memory of 4708 3432 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe netsh.exe PID 3432 wrote to memory of 4708 3432 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe netsh.exe -
outlook_office_path 1 IoCs
Processes:
8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe -
outlook_win_path 1 IoCs
Processes:
8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe"C:\Users\Admin\AppData\Local\Temp\8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2916 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4012 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3144 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe"C:\Users\Admin\AppData\Local\Temp\8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe"2⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe"C:\Users\Admin\AppData\Local\Temp\8eff817d4a8ab57a51dd2863e8d1323ebac8158f558bceb9da56ebb08da1efc2.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:3432 -
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile3⤵PID:4708
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 22802⤵
- Program crash
PID:4732
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2912 -ip 29121⤵PID:2752
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5c823f38e558ff0e0a4eb1e92646f4d1e
SHA1cdf97cba35010f259f0f46a8b7f88df014031e96
SHA2563956e014345ee954a6a43099a7a12de45e46cc39c24376319939a6c876f437e4
SHA5124fe86fb402cde4880c747d4cb2ab3cbfc051768f691f692e64e658828afa1630180368f295ad7b51278a94a14efb999bfd4108c99b8e48d63006a509f0c4b31c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5c823f38e558ff0e0a4eb1e92646f4d1e
SHA1cdf97cba35010f259f0f46a8b7f88df014031e96
SHA2563956e014345ee954a6a43099a7a12de45e46cc39c24376319939a6c876f437e4
SHA5124fe86fb402cde4880c747d4cb2ab3cbfc051768f691f692e64e658828afa1630180368f295ad7b51278a94a14efb999bfd4108c99b8e48d63006a509f0c4b31c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5daf7be85c114e5aef130cbf7584a52e1
SHA167f708c62a46bdfe0b9b4aa21db99ed9ffa9b470
SHA25617ab418ebdf9c76cb6ea9d232abfc04bf2b8b097ba64a47b43ea9723dfbd94e8
SHA5128bbd9796d3e28cc2099c4728f521315976384860731d77fef9a238f0f45e4054708392bd7a78d9df53614b546d155ec115831a6c203d7eeb632b626db74a9d1d
-
memory/1324-155-0x000000006FF30000-0x000000006FF7C000-memory.dmpFilesize
304KB
-
memory/1324-137-0x0000000000000000-mapping.dmp
-
memory/1324-149-0x00000000048D5000-0x00000000048D7000-memory.dmpFilesize
8KB
-
memory/1364-143-0x0000000000000000-mapping.dmp
-
memory/2912-131-0x00000000150F0000-0x000000001518C000-memory.dmpFilesize
624KB
-
memory/2912-132-0x0000000006230000-0x00000000067D4000-memory.dmpFilesize
5.6MB
-
memory/2912-130-0x0000000000B40000-0x0000000001242000-memory.dmpFilesize
7.0MB
-
memory/2916-154-0x0000000006090000-0x00000000060AE000-memory.dmpFilesize
120KB
-
memory/2916-151-0x000000006FF30000-0x000000006FF7C000-memory.dmpFilesize
304KB
-
memory/2916-164-0x0000000007140000-0x000000000715A000-memory.dmpFilesize
104KB
-
memory/2916-140-0x0000000005440000-0x00000000054A6000-memory.dmpFilesize
408KB
-
memory/2916-158-0x0000000006E70000-0x0000000006E7A000-memory.dmpFilesize
40KB
-
memory/2916-157-0x0000000006E00000-0x0000000006E1A000-memory.dmpFilesize
104KB
-
memory/2916-133-0x0000000000000000-mapping.dmp
-
memory/2916-136-0x00000000021E0000-0x0000000002216000-memory.dmpFilesize
216KB
-
memory/2916-141-0x00000000054B0000-0x0000000005516000-memory.dmpFilesize
408KB
-
memory/2916-148-0x0000000004665000-0x0000000004667000-memory.dmpFilesize
8KB
-
memory/2916-138-0x0000000004CA0000-0x00000000052C8000-memory.dmpFilesize
6.2MB
-
memory/2916-163-0x0000000007030000-0x000000000703E000-memory.dmpFilesize
56KB
-
memory/3144-152-0x000000006FF30000-0x000000006FF7C000-memory.dmpFilesize
304KB
-
memory/3144-150-0x0000000007430000-0x0000000007462000-memory.dmpFilesize
200KB
-
memory/3144-135-0x0000000000000000-mapping.dmp
-
memory/3144-147-0x0000000005135000-0x0000000005137000-memory.dmpFilesize
8KB
-
memory/3144-159-0x0000000007A10000-0x0000000007AA6000-memory.dmpFilesize
600KB
-
memory/3432-168-0x00000000075F0000-0x00000000077B2000-memory.dmpFilesize
1.8MB
-
memory/3432-145-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/3432-144-0x0000000000000000-mapping.dmp
-
memory/3432-160-0x0000000006F90000-0x0000000007022000-memory.dmpFilesize
584KB
-
memory/3432-161-0x0000000005E00000-0x0000000005E0A000-memory.dmpFilesize
40KB
-
memory/3432-170-0x0000000005860000-0x0000000005E04000-memory.dmpFilesize
5.6MB
-
memory/4012-139-0x0000000005180000-0x00000000051A2000-memory.dmpFilesize
136KB
-
memory/4012-165-0x0000000007700000-0x0000000007708000-memory.dmpFilesize
32KB
-
memory/4012-156-0x0000000007BC0000-0x000000000823A000-memory.dmpFilesize
6.5MB
-
memory/4012-134-0x0000000000000000-mapping.dmp
-
memory/4012-153-0x000000006FF30000-0x000000006FF7C000-memory.dmpFilesize
304KB
-
memory/4012-146-0x0000000004C55000-0x0000000004C57000-memory.dmpFilesize
8KB
-
memory/4012-142-0x0000000006160000-0x000000000617E000-memory.dmpFilesize
120KB
-
memory/4708-162-0x0000000000000000-mapping.dmp