Analysis
-
max time kernel
54s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
12-05-2022 11:55
Static task
static1
Behavioral task
behavioral1
Sample
8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe
Resource
win10v2004-20220414-en
General
-
Target
8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe
-
Size
749KB
-
MD5
531c89746f1bb6333331ad28cee32f13
-
SHA1
4eb7657831ef51aa2e11b40be9f1ed8933e04f28
-
SHA256
8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48
-
SHA512
f687f7fb4fdce0df9c19e34f65bc89da2a32126882aa584b138aede3e2d4a6dbb6814d47b17a29e469550c3c3aa6d5fc612f78fbe2ad47b1bb3f50b330d4358a
Malware Config
Extracted
oski
nadia.ac.ug
Signatures
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Executes dropped EXE 3 IoCs
Processes:
ooo.exeooo.exeaaa.exepid process 684 ooo.exe 1960 ooo.exe 612 aaa.exe -
Loads dropped DLL 3 IoCs
Processes:
WScript.exeooo.exeWScript.exepid process 1632 WScript.exe 684 ooo.exe 1656 WScript.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ooo.exedescription pid process target process PID 684 set thread context of 1960 684 ooo.exe ooo.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 52 IoCs
Processes:
8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exeooo.exepid process 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 684 ooo.exe 684 ooo.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exeooo.exedescription pid process Token: SeDebugPrivilege 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe Token: SeDebugPrivilege 684 ooo.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exedescription pid process target process PID 1304 wrote to memory of 1632 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe WScript.exe PID 1304 wrote to memory of 1632 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe WScript.exe PID 1304 wrote to memory of 1632 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe WScript.exe PID 1304 wrote to memory of 1632 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe WScript.exe PID 1304 wrote to memory of 1588 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 1588 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 1588 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 1588 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 1332 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 1332 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 1332 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 1332 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 2000 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 2000 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 2000 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 2000 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 1008 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 1008 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 1008 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 1008 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 1484 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 1484 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 1484 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 1484 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 472 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 472 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 472 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 472 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 772 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 772 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 772 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 772 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 580 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 580 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 580 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 580 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 268 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 268 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 268 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 268 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 1188 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 1188 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 1188 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 1188 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 384 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 384 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 384 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 384 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 608 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 608 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 608 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 608 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 1168 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 1168 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 1168 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 1168 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 432 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 432 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 432 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 432 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 1540 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 1540 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 1540 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe PID 1304 wrote to memory of 1540 1304 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe 8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Jwoasxr.vbs"2⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\ooo.exe"C:\Users\Admin\AppData\Local\Temp\ooo.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Gsgxeo.vbs"4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\aaa.exe"C:\Users\Admin\AppData\Local\Temp\aaa.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\ooo.exe"C:\Users\Admin\AppData\Local\Temp\ooo.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"C:\Users\Admin\AppData\Local\Temp\8f91c74180d8c1a5b3ae0cfc6f2b01304d4cf3fa29a78ccee0876f7b417cba48.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Gsgxeo.vbsFilesize
91B
MD59e77c5f012c8e5ac0f5706f2a906ab6e
SHA1900598d4cc26f03b37794e4b1f9de7e49cd94ee5
SHA256d9f14c1c8a8aebed3afdfe07c1243d1b2b1ca4772ef66b902586691327944e38
SHA5125ee472ea553af3c598f87db7ed1c8ebacd03b4b00c442ca50cb9f6e87488be5eb1e85aec0ea55cbe6c0234b21eddeb8a358bfc66e70be6d22603793ea99ee839
-
C:\Users\Admin\AppData\Local\Temp\Jwoasxr.vbsFilesize
91B
MD5c0c64a797ebd363385bb9670d99054fe
SHA1055d06d6d514bb5742f72829e5e1748282715094
SHA256569e18bc2c6d7618e9c7e34e8b6ef116d543ec35b23414d2c2e5a4c84d471409
SHA51239d4785622cdf99161792aa1cee81b42e4079a9d393906a6796854461a77428c016f624e031c1f3a4cf9d2a347bfcd9b70f709bb32a4d0ddb15027dacb084235
-
C:\Users\Admin\AppData\Local\Temp\aaa.exeFilesize
171KB
MD501f2b5f6403530af79e6f321f4879da0
SHA1f09790bdab30fd08c312d3b0d4f8ec309a1431bc
SHA256dc2d40f77af7bd9f6a4d86baee6d1fb3332dc9f8953cfd73f39c914b4990e4e5
SHA51207b1135e4a116b80d89aa69890c00febbb874cf22456366202a19517e359e3a0e69110fd3ea2246469420de03cbf8aaee08caa6a307283b08f7400c2fdb5fc76
-
C:\Users\Admin\AppData\Local\Temp\aaa.exeFilesize
171KB
MD501f2b5f6403530af79e6f321f4879da0
SHA1f09790bdab30fd08c312d3b0d4f8ec309a1431bc
SHA256dc2d40f77af7bd9f6a4d86baee6d1fb3332dc9f8953cfd73f39c914b4990e4e5
SHA51207b1135e4a116b80d89aa69890c00febbb874cf22456366202a19517e359e3a0e69110fd3ea2246469420de03cbf8aaee08caa6a307283b08f7400c2fdb5fc76
-
C:\Users\Admin\AppData\Local\Temp\ooo.exeFilesize
358KB
MD5405a484a6f2777f0e4fc429ca05353a7
SHA1895ae31fab9c5042ddc3f5912c55b81530a20163
SHA256aba9f9d6904d1474f7a0693e80d182eff9cb8a1c185f0090876cf8eb83914cbb
SHA512da5771598dcfa6b8fd82a34f8a1ae581b0bd7aa1a51bba978a9ceefdce8639462f182adf94eec70314b25dd6f0c6c7ba7b08bcde479ab8bb7ce4447e00e8a5c8
-
C:\Users\Admin\AppData\Local\Temp\ooo.exeFilesize
358KB
MD5405a484a6f2777f0e4fc429ca05353a7
SHA1895ae31fab9c5042ddc3f5912c55b81530a20163
SHA256aba9f9d6904d1474f7a0693e80d182eff9cb8a1c185f0090876cf8eb83914cbb
SHA512da5771598dcfa6b8fd82a34f8a1ae581b0bd7aa1a51bba978a9ceefdce8639462f182adf94eec70314b25dd6f0c6c7ba7b08bcde479ab8bb7ce4447e00e8a5c8
-
C:\Users\Admin\AppData\Local\Temp\ooo.exeFilesize
358KB
MD5405a484a6f2777f0e4fc429ca05353a7
SHA1895ae31fab9c5042ddc3f5912c55b81530a20163
SHA256aba9f9d6904d1474f7a0693e80d182eff9cb8a1c185f0090876cf8eb83914cbb
SHA512da5771598dcfa6b8fd82a34f8a1ae581b0bd7aa1a51bba978a9ceefdce8639462f182adf94eec70314b25dd6f0c6c7ba7b08bcde479ab8bb7ce4447e00e8a5c8
-
\Users\Admin\AppData\Local\Temp\aaa.exeFilesize
171KB
MD501f2b5f6403530af79e6f321f4879da0
SHA1f09790bdab30fd08c312d3b0d4f8ec309a1431bc
SHA256dc2d40f77af7bd9f6a4d86baee6d1fb3332dc9f8953cfd73f39c914b4990e4e5
SHA51207b1135e4a116b80d89aa69890c00febbb874cf22456366202a19517e359e3a0e69110fd3ea2246469420de03cbf8aaee08caa6a307283b08f7400c2fdb5fc76
-
\Users\Admin\AppData\Local\Temp\ooo.exeFilesize
358KB
MD5405a484a6f2777f0e4fc429ca05353a7
SHA1895ae31fab9c5042ddc3f5912c55b81530a20163
SHA256aba9f9d6904d1474f7a0693e80d182eff9cb8a1c185f0090876cf8eb83914cbb
SHA512da5771598dcfa6b8fd82a34f8a1ae581b0bd7aa1a51bba978a9ceefdce8639462f182adf94eec70314b25dd6f0c6c7ba7b08bcde479ab8bb7ce4447e00e8a5c8
-
\Users\Admin\AppData\Local\Temp\ooo.exeFilesize
358KB
MD5405a484a6f2777f0e4fc429ca05353a7
SHA1895ae31fab9c5042ddc3f5912c55b81530a20163
SHA256aba9f9d6904d1474f7a0693e80d182eff9cb8a1c185f0090876cf8eb83914cbb
SHA512da5771598dcfa6b8fd82a34f8a1ae581b0bd7aa1a51bba978a9ceefdce8639462f182adf94eec70314b25dd6f0c6c7ba7b08bcde479ab8bb7ce4447e00e8a5c8
-
memory/612-90-0x0000000000000000-mapping.dmp
-
memory/612-92-0x0000000000B70000-0x0000000000BA4000-memory.dmpFilesize
208KB
-
memory/684-71-0x0000000000610000-0x0000000000622000-memory.dmpFilesize
72KB
-
memory/684-68-0x0000000002130000-0x000000000218A000-memory.dmpFilesize
360KB
-
memory/684-67-0x0000000000260000-0x0000000000266000-memory.dmpFilesize
24KB
-
memory/684-66-0x0000000000820000-0x0000000000882000-memory.dmpFilesize
392KB
-
memory/684-64-0x0000000000000000-mapping.dmp
-
memory/1304-54-0x00000000003A0000-0x0000000000464000-memory.dmpFilesize
784KB
-
memory/1304-59-0x00000000007B0000-0x00000000007C2000-memory.dmpFilesize
72KB
-
memory/1304-57-0x0000000076531000-0x0000000076533000-memory.dmpFilesize
8KB
-
memory/1304-56-0x0000000002050000-0x000000000210A000-memory.dmpFilesize
744KB
-
memory/1304-55-0x0000000000380000-0x0000000000386000-memory.dmpFilesize
24KB
-
memory/1632-58-0x0000000000000000-mapping.dmp
-
memory/1656-70-0x0000000000000000-mapping.dmp
-
memory/1960-86-0x0000000000417A8B-mapping.dmp
-
memory/1960-85-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1960-83-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1960-81-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1960-79-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1960-76-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1960-75-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB