Analysis
-
max time kernel
151s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 22:58
Static task
static1
Behavioral task
behavioral1
Sample
c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe
Resource
win10v2004-20220414-en
General
-
Target
c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe
-
Size
1.3MB
-
MD5
4bdff552f9a5e0f0aec8fed6369d1367
-
SHA1
da58bc2768fee0c648e60327ca9690e5286592b3
-
SHA256
c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e
-
SHA512
1351da894778c29389a26e26836c0defbc205ffad4f3c5c82db5cf204e8f757739a0734f188f9f9dd3cf6a2abec9a170645637c76e90641db68a4b7839d69a66
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe" c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe -
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Sets file execution options in registry 2 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 4 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 1484 taskkill.exe 1604 taskkill.exe 1460 taskkill.exe 432 taskkill.exe -
Processes:
c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DOMStorage c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Set value (int) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\NumberOfSubdomains = "1" c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Set value (int) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0" c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Set value (int) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "115" c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Set value (int) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "6" c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Set value (int) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "0" c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Set value (int) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "115" c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Set value (int) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "6" c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Set value (int) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "6" c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Set value (int) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "0" c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Set value (int) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "115" c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exepid process 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exec570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exeAUDIODG.EXEdescription pid process Token: SeDebugPrivilege 1460 taskkill.exe Token: SeDebugPrivilege 1484 taskkill.exe Token: SeDebugPrivilege 1604 taskkill.exe Token: SeDebugPrivilege 432 taskkill.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: 33 1304 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1304 AUDIODG.EXE Token: 33 1304 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1304 AUDIODG.EXE Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Token: SeDebugPrivilege 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exepid process 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exedescription pid process target process PID 560 wrote to memory of 1484 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe taskkill.exe PID 560 wrote to memory of 1484 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe taskkill.exe PID 560 wrote to memory of 1484 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe taskkill.exe PID 560 wrote to memory of 1484 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe taskkill.exe PID 560 wrote to memory of 1604 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe taskkill.exe PID 560 wrote to memory of 1604 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe taskkill.exe PID 560 wrote to memory of 1604 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe taskkill.exe PID 560 wrote to memory of 1604 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe taskkill.exe PID 560 wrote to memory of 1460 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe taskkill.exe PID 560 wrote to memory of 1460 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe taskkill.exe PID 560 wrote to memory of 1460 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe taskkill.exe PID 560 wrote to memory of 1460 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe taskkill.exe PID 560 wrote to memory of 432 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe taskkill.exe PID 560 wrote to memory of 432 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe taskkill.exe PID 560 wrote to memory of 432 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe taskkill.exe PID 560 wrote to memory of 432 560 c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe taskkill.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewOnDrive = "12" c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe"C:\Users\Admin\AppData\Local\Temp\c570228b8a3ef3fe610b094431dd6f274f9c86ef242c8aba58cd8f4d1f08a83e.exe"1⤵
- Modifies WinLogon for persistence
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Explorer.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im TaskMgr.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Regedit.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Cmd.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5941⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/432-58-0x0000000000000000-mapping.dmp
-
memory/560-54-0x00000000753E1000-0x00000000753E3000-memory.dmpFilesize
8KB
-
memory/1460-57-0x0000000000000000-mapping.dmp
-
memory/1484-55-0x0000000000000000-mapping.dmp
-
memory/1604-56-0x0000000000000000-mapping.dmp