Analysis
-
max time kernel
83s -
max time network
83s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 07:40
Static task
static1
Behavioral task
behavioral1
Sample
8422ac9d56c8fc3c44779138cfc8232eccd095b0ad1ed7845b4086048567ecef.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
8422ac9d56c8fc3c44779138cfc8232eccd095b0ad1ed7845b4086048567ecef.exe
Resource
win10v2004-20220414-en
General
-
Target
8422ac9d56c8fc3c44779138cfc8232eccd095b0ad1ed7845b4086048567ecef.exe
-
Size
6.9MB
-
MD5
beb22f15ac607a40121ad82cf5316408
-
SHA1
2a2150c16b50c51f4009ba71b64f03aadc6ac936
-
SHA256
8422ac9d56c8fc3c44779138cfc8232eccd095b0ad1ed7845b4086048567ecef
-
SHA512
96d4c5e1053d28e6656ca1431f09b9676b8fad1acd635fbacc14347a26df3ab4b408ab1ed1a503616cd8ce5e7b024de41c85bb0a9391eb5e1df99f4f22cf663b
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
Processes:
uvwxyzFiddlerSetup_5.0.20194.41348.exetuvwxyz1.exelmnopqrstuvwxyz_RJ-Fiddler.exeFiddlerSetup.exeRJ-Fiddler.exe~RJ-Fiddler.exepid process 1120 uvwxyzFiddlerSetup_5.0.20194.41348.exe 1488 tuvwxyz1.exe 1420 lmnopqrstuvwxyz_RJ-Fiddler.exe 1168 FiddlerSetup.exe 1484 RJ-Fiddler.exe 1600 ~RJ-Fiddler.exe -
Loads dropped DLL 6 IoCs
Processes:
8422ac9d56c8fc3c44779138cfc8232eccd095b0ad1ed7845b4086048567ecef.exeuvwxyzFiddlerSetup_5.0.20194.41348.exeRJ-Fiddler.exepid process 1948 8422ac9d56c8fc3c44779138cfc8232eccd095b0ad1ed7845b4086048567ecef.exe 1948 8422ac9d56c8fc3c44779138cfc8232eccd095b0ad1ed7845b4086048567ecef.exe 1948 8422ac9d56c8fc3c44779138cfc8232eccd095b0ad1ed7845b4086048567ecef.exe 1948 8422ac9d56c8fc3c44779138cfc8232eccd095b0ad1ed7845b4086048567ecef.exe 1120 uvwxyzFiddlerSetup_5.0.20194.41348.exe 1484 RJ-Fiddler.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
RJ-Fiddler.exedescription ioc process File opened for modification \??\PhysicalDrive0 RJ-Fiddler.exe -
Drops file in System32 directory 7 IoCs
Processes:
RJ-Fiddler.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat RJ-Fiddler.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A269719AA1471E96C RJ-Fiddler.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A269719AA1471E96C RJ-Fiddler.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A053CFB63FC8E6507871752236B5CCD5_CEC273363E767B922208DE98D79F0556 RJ-Fiddler.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A053CFB63FC8E6507871752236B5CCD5_CEC273363E767B922208DE98D79F0556 RJ-Fiddler.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\AJL4BF8Z.txt RJ-Fiddler.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\AJL4BF8Z.txt RJ-Fiddler.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 12 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\uvwxyzFiddlerSetup_5.0.20194.41348.exe nsis_installer_1 \Users\Admin\AppData\Local\Temp\uvwxyzFiddlerSetup_5.0.20194.41348.exe nsis_installer_2 C:\Users\Admin\AppData\Local\Temp\uvwxyzFiddlerSetup_5.0.20194.41348.exe nsis_installer_1 C:\Users\Admin\AppData\Local\Temp\uvwxyzFiddlerSetup_5.0.20194.41348.exe nsis_installer_2 C:\Users\Admin\AppData\Local\Temp\uvwxyzFiddlerSetup_5.0.20194.41348.exe nsis_installer_1 C:\Users\Admin\AppData\Local\Temp\uvwxyzFiddlerSetup_5.0.20194.41348.exe nsis_installer_2 \Users\Admin\AppData\Local\Temp\nsdA20.tmp\FiddlerSetup.exe nsis_installer_1 \Users\Admin\AppData\Local\Temp\nsdA20.tmp\FiddlerSetup.exe nsis_installer_2 C:\Users\Admin\AppData\Local\Temp\nsdA20.tmp\FiddlerSetup.exe nsis_installer_1 C:\Users\Admin\AppData\Local\Temp\nsdA20.tmp\FiddlerSetup.exe nsis_installer_2 C:\Users\Admin\AppData\Local\Temp\nsdA20.tmp\FiddlerSetup.exe nsis_installer_1 C:\Users\Admin\AppData\Local\Temp\nsdA20.tmp\FiddlerSetup.exe nsis_installer_2 -
Modifies data under HKEY_USERS 64 IoCs
Processes:
RJ-Fiddler.exe~RJ-Fiddler.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings RJ-Fiddler.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" RJ-Fiddler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root RJ-Fiddler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot RJ-Fiddler.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 RJ-Fiddler.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 RJ-Fiddler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs RJ-Fiddler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs RJ-Fiddler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates RJ-Fiddler.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DA42F7BA-6B9D-4EE0-B28E-411580568837}\WpadDecisionTime = 8004e836346cd801 RJ-Fiddler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA RJ-Fiddler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs RJ-Fiddler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates RJ-Fiddler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed RJ-Fiddler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs RJ-Fiddler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates RJ-Fiddler.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" ~RJ-Fiddler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs RJ-Fiddler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs RJ-Fiddler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople RJ-Fiddler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs RJ-Fiddler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad RJ-Fiddler.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00a5000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 RJ-Fiddler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DA42F7BA-6B9D-4EE0-B28E-411580568837} RJ-Fiddler.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DA42F7BA-6B9D-4EE0-B28E-411580568837}\WpadDecisionReason = "1" RJ-Fiddler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My RJ-Fiddler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ~RJ-Fiddler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections RJ-Fiddler.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ba-8d-59-b1-e9-77\WpadDecisionTime = 8004e836346cd801 RJ-Fiddler.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" RJ-Fiddler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs RJ-Fiddler.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 RJ-Fiddler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA RJ-Fiddler.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" ~RJ-Fiddler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings RJ-Fiddler.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DA42F7BA-6B9D-4EE0-B28E-411580568837}\WpadDecision = "0" RJ-Fiddler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs RJ-Fiddler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs RJ-Fiddler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs RJ-Fiddler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates RJ-Fiddler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust RJ-Fiddler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs RJ-Fiddler.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" RJ-Fiddler.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" RJ-Fiddler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing RJ-Fiddler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates RJ-Fiddler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed RJ-Fiddler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates RJ-Fiddler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs RJ-Fiddler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates RJ-Fiddler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs RJ-Fiddler.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix RJ-Fiddler.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DA42F7BA-6B9D-4EE0-B28E-411580568837}\WpadNetworkName = "Network 3" RJ-Fiddler.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" RJ-Fiddler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates RJ-Fiddler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs RJ-Fiddler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust RJ-Fiddler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ba-8d-59-b1-e9-77 RJ-Fiddler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DA42F7BA-6B9D-4EE0-B28E-411580568837}\ba-8d-59-b1-e9-77 RJ-Fiddler.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ba-8d-59-b1-e9-77\WpadDecisionReason = "1" RJ-Fiddler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs RJ-Fiddler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs RJ-Fiddler.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople RJ-Fiddler.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ba-8d-59-b1-e9-77\WpadDecision = "0" RJ-Fiddler.exe -
Runs ping.exe 1 TTPs 3 IoCs
Processes:
PING.EXEPING.EXEPING.EXEpid process 1892 PING.EXE 1368 PING.EXE 1648 PING.EXE -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
wmic.exedescription pid process Token: SeAssignPrimaryTokenPrivilege 1016 wmic.exe Token: SeIncreaseQuotaPrivilege 1016 wmic.exe Token: SeSecurityPrivilege 1016 wmic.exe Token: SeTakeOwnershipPrivilege 1016 wmic.exe Token: SeLoadDriverPrivilege 1016 wmic.exe Token: SeSystemtimePrivilege 1016 wmic.exe Token: SeBackupPrivilege 1016 wmic.exe Token: SeRestorePrivilege 1016 wmic.exe Token: SeShutdownPrivilege 1016 wmic.exe Token: SeSystemEnvironmentPrivilege 1016 wmic.exe Token: SeUndockPrivilege 1016 wmic.exe Token: SeManageVolumePrivilege 1016 wmic.exe Token: SeAssignPrimaryTokenPrivilege 1016 wmic.exe Token: SeIncreaseQuotaPrivilege 1016 wmic.exe Token: SeSecurityPrivilege 1016 wmic.exe Token: SeTakeOwnershipPrivilege 1016 wmic.exe Token: SeLoadDriverPrivilege 1016 wmic.exe Token: SeSystemtimePrivilege 1016 wmic.exe Token: SeBackupPrivilege 1016 wmic.exe Token: SeRestorePrivilege 1016 wmic.exe Token: SeShutdownPrivilege 1016 wmic.exe Token: SeSystemEnvironmentPrivilege 1016 wmic.exe Token: SeUndockPrivilege 1016 wmic.exe Token: SeManageVolumePrivilege 1016 wmic.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
8422ac9d56c8fc3c44779138cfc8232eccd095b0ad1ed7845b4086048567ecef.exeuvwxyzFiddlerSetup_5.0.20194.41348.exelmnopqrstuvwxyz_RJ-Fiddler.execmd.exeRJ-Fiddler.execmd.exe~RJ-Fiddler.execmd.exedescription pid process target process PID 1948 wrote to memory of 1120 1948 8422ac9d56c8fc3c44779138cfc8232eccd095b0ad1ed7845b4086048567ecef.exe uvwxyzFiddlerSetup_5.0.20194.41348.exe PID 1948 wrote to memory of 1120 1948 8422ac9d56c8fc3c44779138cfc8232eccd095b0ad1ed7845b4086048567ecef.exe uvwxyzFiddlerSetup_5.0.20194.41348.exe PID 1948 wrote to memory of 1120 1948 8422ac9d56c8fc3c44779138cfc8232eccd095b0ad1ed7845b4086048567ecef.exe uvwxyzFiddlerSetup_5.0.20194.41348.exe PID 1948 wrote to memory of 1120 1948 8422ac9d56c8fc3c44779138cfc8232eccd095b0ad1ed7845b4086048567ecef.exe uvwxyzFiddlerSetup_5.0.20194.41348.exe PID 1948 wrote to memory of 1120 1948 8422ac9d56c8fc3c44779138cfc8232eccd095b0ad1ed7845b4086048567ecef.exe uvwxyzFiddlerSetup_5.0.20194.41348.exe PID 1948 wrote to memory of 1120 1948 8422ac9d56c8fc3c44779138cfc8232eccd095b0ad1ed7845b4086048567ecef.exe uvwxyzFiddlerSetup_5.0.20194.41348.exe PID 1948 wrote to memory of 1120 1948 8422ac9d56c8fc3c44779138cfc8232eccd095b0ad1ed7845b4086048567ecef.exe uvwxyzFiddlerSetup_5.0.20194.41348.exe PID 1948 wrote to memory of 1488 1948 8422ac9d56c8fc3c44779138cfc8232eccd095b0ad1ed7845b4086048567ecef.exe tuvwxyz1.exe PID 1948 wrote to memory of 1488 1948 8422ac9d56c8fc3c44779138cfc8232eccd095b0ad1ed7845b4086048567ecef.exe tuvwxyz1.exe PID 1948 wrote to memory of 1488 1948 8422ac9d56c8fc3c44779138cfc8232eccd095b0ad1ed7845b4086048567ecef.exe tuvwxyz1.exe PID 1948 wrote to memory of 1488 1948 8422ac9d56c8fc3c44779138cfc8232eccd095b0ad1ed7845b4086048567ecef.exe tuvwxyz1.exe PID 1948 wrote to memory of 1420 1948 8422ac9d56c8fc3c44779138cfc8232eccd095b0ad1ed7845b4086048567ecef.exe lmnopqrstuvwxyz_RJ-Fiddler.exe PID 1948 wrote to memory of 1420 1948 8422ac9d56c8fc3c44779138cfc8232eccd095b0ad1ed7845b4086048567ecef.exe lmnopqrstuvwxyz_RJ-Fiddler.exe PID 1948 wrote to memory of 1420 1948 8422ac9d56c8fc3c44779138cfc8232eccd095b0ad1ed7845b4086048567ecef.exe lmnopqrstuvwxyz_RJ-Fiddler.exe PID 1948 wrote to memory of 1420 1948 8422ac9d56c8fc3c44779138cfc8232eccd095b0ad1ed7845b4086048567ecef.exe lmnopqrstuvwxyz_RJ-Fiddler.exe PID 1120 wrote to memory of 1168 1120 uvwxyzFiddlerSetup_5.0.20194.41348.exe FiddlerSetup.exe PID 1120 wrote to memory of 1168 1120 uvwxyzFiddlerSetup_5.0.20194.41348.exe FiddlerSetup.exe PID 1120 wrote to memory of 1168 1120 uvwxyzFiddlerSetup_5.0.20194.41348.exe FiddlerSetup.exe PID 1120 wrote to memory of 1168 1120 uvwxyzFiddlerSetup_5.0.20194.41348.exe FiddlerSetup.exe PID 1120 wrote to memory of 1168 1120 uvwxyzFiddlerSetup_5.0.20194.41348.exe FiddlerSetup.exe PID 1120 wrote to memory of 1168 1120 uvwxyzFiddlerSetup_5.0.20194.41348.exe FiddlerSetup.exe PID 1120 wrote to memory of 1168 1120 uvwxyzFiddlerSetup_5.0.20194.41348.exe FiddlerSetup.exe PID 1420 wrote to memory of 1036 1420 lmnopqrstuvwxyz_RJ-Fiddler.exe cmd.exe PID 1420 wrote to memory of 1036 1420 lmnopqrstuvwxyz_RJ-Fiddler.exe cmd.exe PID 1420 wrote to memory of 1036 1420 lmnopqrstuvwxyz_RJ-Fiddler.exe cmd.exe PID 1420 wrote to memory of 1036 1420 lmnopqrstuvwxyz_RJ-Fiddler.exe cmd.exe PID 1036 wrote to memory of 1892 1036 cmd.exe PING.EXE PID 1036 wrote to memory of 1892 1036 cmd.exe PING.EXE PID 1036 wrote to memory of 1892 1036 cmd.exe PING.EXE PID 1036 wrote to memory of 1892 1036 cmd.exe PING.EXE PID 1484 wrote to memory of 1016 1484 RJ-Fiddler.exe wmic.exe PID 1484 wrote to memory of 1016 1484 RJ-Fiddler.exe wmic.exe PID 1484 wrote to memory of 1016 1484 RJ-Fiddler.exe wmic.exe PID 1484 wrote to memory of 1016 1484 RJ-Fiddler.exe wmic.exe PID 1484 wrote to memory of 1600 1484 RJ-Fiddler.exe ~RJ-Fiddler.exe PID 1484 wrote to memory of 1600 1484 RJ-Fiddler.exe ~RJ-Fiddler.exe PID 1484 wrote to memory of 1600 1484 RJ-Fiddler.exe ~RJ-Fiddler.exe PID 1484 wrote to memory of 1600 1484 RJ-Fiddler.exe ~RJ-Fiddler.exe PID 1484 wrote to memory of 1288 1484 RJ-Fiddler.exe cmd.exe PID 1484 wrote to memory of 1288 1484 RJ-Fiddler.exe cmd.exe PID 1484 wrote to memory of 1288 1484 RJ-Fiddler.exe cmd.exe PID 1484 wrote to memory of 1288 1484 RJ-Fiddler.exe cmd.exe PID 1288 wrote to memory of 1368 1288 cmd.exe PING.EXE PID 1288 wrote to memory of 1368 1288 cmd.exe PING.EXE PID 1288 wrote to memory of 1368 1288 cmd.exe PING.EXE PID 1288 wrote to memory of 1368 1288 cmd.exe PING.EXE PID 1600 wrote to memory of 1980 1600 ~RJ-Fiddler.exe cmd.exe PID 1600 wrote to memory of 1980 1600 ~RJ-Fiddler.exe cmd.exe PID 1600 wrote to memory of 1980 1600 ~RJ-Fiddler.exe cmd.exe PID 1600 wrote to memory of 1980 1600 ~RJ-Fiddler.exe cmd.exe PID 1980 wrote to memory of 1648 1980 cmd.exe PING.EXE PID 1980 wrote to memory of 1648 1980 cmd.exe PING.EXE PID 1980 wrote to memory of 1648 1980 cmd.exe PING.EXE PID 1980 wrote to memory of 1648 1980 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\8422ac9d56c8fc3c44779138cfc8232eccd095b0ad1ed7845b4086048567ecef.exe"C:\Users\Admin\AppData\Local\Temp\8422ac9d56c8fc3c44779138cfc8232eccd095b0ad1ed7845b4086048567ecef.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\uvwxyzFiddlerSetup_5.0.20194.41348.exe"C:\Users\Admin\AppData\Local\Temp\uvwxyzFiddlerSetup_5.0.20194.41348.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nsdA20.tmp\FiddlerSetup.exe"C:\Users\Admin\AppData\Local\Temp\nsdA20.tmp\FiddlerSetup.exe" /D=3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\tuvwxyz1.exe"C:\Users\Admin\AppData\Local\Temp\tuvwxyz1.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\lmnopqrstuvwxyz_RJ-Fiddler.exe"C:\Users\Admin\AppData\Local\Temp\lmnopqrstuvwxyz_RJ-Fiddler.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping -n 3 127.1 >nul & del /q C:\Users\Admin\AppData\Local\Temp\lmnopqrstuvwxyz_RJ-Fiddler.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 3 127.14⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\RJ-Fiddler.exeC:\Users\Admin\AppData\Local\Temp\RJ-Fiddler.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic BaseBoard get SerialNumber2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\~RJ-Fiddler.exe"C:\Users\Admin\AppData\Local\Temp\~RJ-Fiddler.exe"2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping -n 3 127.1 >nul & del /q C:\Users\Admin\AppData\Local\Temp\~RJ-Fiddler.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 3 127.14⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping -n 3 127.1 >nul & del /q C:\Users\Admin\AppData\Local\Temp\RJ-Fiddler.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 3 127.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RJ-Fiddler.exeFilesize
306KB
MD56d0e581f0ea82c4b097563c9dcb4f133
SHA119bf6dab6a1c0e2122dd16fe6d72e12083cb0d2b
SHA2563e6c4e569c9254a2d8e3d8ceccba13dc8b0e65b2172c2e9e1d3bf1a1b18e56f0
SHA51290f53a0838ca3a1f32d79ecc765f7866b6683bc0407920f67596779b8f423098d0b03926e190ad42bd51c101f898ccd8dfcafafe71b723796363e105c54de610
-
C:\Users\Admin\AppData\Local\Temp\RJ-Fiddler.exeFilesize
306KB
MD56d0e581f0ea82c4b097563c9dcb4f133
SHA119bf6dab6a1c0e2122dd16fe6d72e12083cb0d2b
SHA2563e6c4e569c9254a2d8e3d8ceccba13dc8b0e65b2172c2e9e1d3bf1a1b18e56f0
SHA51290f53a0838ca3a1f32d79ecc765f7866b6683bc0407920f67596779b8f423098d0b03926e190ad42bd51c101f898ccd8dfcafafe71b723796363e105c54de610
-
C:\Users\Admin\AppData\Local\Temp\lmnopqrstuvwxyz_RJ-Fiddler.exeFilesize
306KB
MD56d0e581f0ea82c4b097563c9dcb4f133
SHA119bf6dab6a1c0e2122dd16fe6d72e12083cb0d2b
SHA2563e6c4e569c9254a2d8e3d8ceccba13dc8b0e65b2172c2e9e1d3bf1a1b18e56f0
SHA51290f53a0838ca3a1f32d79ecc765f7866b6683bc0407920f67596779b8f423098d0b03926e190ad42bd51c101f898ccd8dfcafafe71b723796363e105c54de610
-
C:\Users\Admin\AppData\Local\Temp\lmnopqrstuvwxyz_RJ-Fiddler.exeFilesize
306KB
MD56d0e581f0ea82c4b097563c9dcb4f133
SHA119bf6dab6a1c0e2122dd16fe6d72e12083cb0d2b
SHA2563e6c4e569c9254a2d8e3d8ceccba13dc8b0e65b2172c2e9e1d3bf1a1b18e56f0
SHA51290f53a0838ca3a1f32d79ecc765f7866b6683bc0407920f67596779b8f423098d0b03926e190ad42bd51c101f898ccd8dfcafafe71b723796363e105c54de610
-
C:\Users\Admin\AppData\Local\Temp\nsdA20.tmp\FiddlerSetup.exeFilesize
3.1MB
MD5155b1deb7ed05cfe46d415abc04daeb6
SHA1c6218cfc31c96a01c016d69dcb310a05b58e7af7
SHA256e80053a204a56c1cd3f7d91bd84a1b5aacf8681591dcaa621c77a07e71b4a34c
SHA5129214a0e132e7dfba99df0297dbc274f43507cf7bf00a4033cf71253be91f3039f485c29da6c429fb338afa3eb76fdcb1939637ecccbe9ffab7a2d5799b8a398b
-
C:\Users\Admin\AppData\Local\Temp\nsdA20.tmp\FiddlerSetup.exeFilesize
3.1MB
MD5155b1deb7ed05cfe46d415abc04daeb6
SHA1c6218cfc31c96a01c016d69dcb310a05b58e7af7
SHA256e80053a204a56c1cd3f7d91bd84a1b5aacf8681591dcaa621c77a07e71b4a34c
SHA5129214a0e132e7dfba99df0297dbc274f43507cf7bf00a4033cf71253be91f3039f485c29da6c429fb338afa3eb76fdcb1939637ecccbe9ffab7a2d5799b8a398b
-
C:\Users\Admin\AppData\Local\Temp\tuvwxyz1.exeFilesize
88KB
MD507425b50abc3dd6e236984b2e725b8e0
SHA1cd87a8c3fb38196fb55d6b6e6477dfc4f8915ba5
SHA2567be986cd9f9ab980d596a68ead4dcc8f6d592c7d33f9d1caacb9e175e25702a1
SHA51240e3d754748eee6a567e60ae86a0ea5da8d05fe06a16e2757d93556a09a58adbb9602aa9bbf751a9e4a1faf2b79ed4569f971691f55b94c03d8d19e7d13f05f7
-
C:\Users\Admin\AppData\Local\Temp\uvwxyzFiddlerSetup_5.0.20194.41348.exeFilesize
6.3MB
MD553782906aa3c7de6b164349a5cad123f
SHA18bb213d8d34a944b2103a5bba387da52c8c1d926
SHA2562afe37ab5cdb7df4a80fcbe85b9298f509df064173e6a4ee7008e5d409bc6172
SHA5123e736093ddca8fe283bc4dce95d6383e8f25248664f4815b2b3bf1916f6531bdb508303014e1ceea109a93ae08275d8c4c1ff5dbb4e9771d63cd3a1640eab741
-
C:\Users\Admin\AppData\Local\Temp\uvwxyzFiddlerSetup_5.0.20194.41348.exeFilesize
6.3MB
MD553782906aa3c7de6b164349a5cad123f
SHA18bb213d8d34a944b2103a5bba387da52c8c1d926
SHA2562afe37ab5cdb7df4a80fcbe85b9298f509df064173e6a4ee7008e5d409bc6172
SHA5123e736093ddca8fe283bc4dce95d6383e8f25248664f4815b2b3bf1916f6531bdb508303014e1ceea109a93ae08275d8c4c1ff5dbb4e9771d63cd3a1640eab741
-
C:\Users\Admin\AppData\Local\Temp\~RJ-Fiddler.exeFilesize
306KB
MD56d0e581f0ea82c4b097563c9dcb4f133
SHA119bf6dab6a1c0e2122dd16fe6d72e12083cb0d2b
SHA2563e6c4e569c9254a2d8e3d8ceccba13dc8b0e65b2172c2e9e1d3bf1a1b18e56f0
SHA51290f53a0838ca3a1f32d79ecc765f7866b6683bc0407920f67596779b8f423098d0b03926e190ad42bd51c101f898ccd8dfcafafe71b723796363e105c54de610
-
C:\Users\Admin\AppData\Local\Temp\~RJ-Fiddler.exeFilesize
306KB
MD56d0e581f0ea82c4b097563c9dcb4f133
SHA119bf6dab6a1c0e2122dd16fe6d72e12083cb0d2b
SHA2563e6c4e569c9254a2d8e3d8ceccba13dc8b0e65b2172c2e9e1d3bf1a1b18e56f0
SHA51290f53a0838ca3a1f32d79ecc765f7866b6683bc0407920f67596779b8f423098d0b03926e190ad42bd51c101f898ccd8dfcafafe71b723796363e105c54de610
-
\Users\Admin\AppData\Local\Temp\lmnopqrstuvwxyz_RJ-Fiddler.exeFilesize
306KB
MD56d0e581f0ea82c4b097563c9dcb4f133
SHA119bf6dab6a1c0e2122dd16fe6d72e12083cb0d2b
SHA2563e6c4e569c9254a2d8e3d8ceccba13dc8b0e65b2172c2e9e1d3bf1a1b18e56f0
SHA51290f53a0838ca3a1f32d79ecc765f7866b6683bc0407920f67596779b8f423098d0b03926e190ad42bd51c101f898ccd8dfcafafe71b723796363e105c54de610
-
\Users\Admin\AppData\Local\Temp\nsdA20.tmp\FiddlerSetup.exeFilesize
3.1MB
MD5155b1deb7ed05cfe46d415abc04daeb6
SHA1c6218cfc31c96a01c016d69dcb310a05b58e7af7
SHA256e80053a204a56c1cd3f7d91bd84a1b5aacf8681591dcaa621c77a07e71b4a34c
SHA5129214a0e132e7dfba99df0297dbc274f43507cf7bf00a4033cf71253be91f3039f485c29da6c429fb338afa3eb76fdcb1939637ecccbe9ffab7a2d5799b8a398b
-
\Users\Admin\AppData\Local\Temp\tuvwxyz1.exeFilesize
88KB
MD507425b50abc3dd6e236984b2e725b8e0
SHA1cd87a8c3fb38196fb55d6b6e6477dfc4f8915ba5
SHA2567be986cd9f9ab980d596a68ead4dcc8f6d592c7d33f9d1caacb9e175e25702a1
SHA51240e3d754748eee6a567e60ae86a0ea5da8d05fe06a16e2757d93556a09a58adbb9602aa9bbf751a9e4a1faf2b79ed4569f971691f55b94c03d8d19e7d13f05f7
-
\Users\Admin\AppData\Local\Temp\tuvwxyz1.exeFilesize
88KB
MD507425b50abc3dd6e236984b2e725b8e0
SHA1cd87a8c3fb38196fb55d6b6e6477dfc4f8915ba5
SHA2567be986cd9f9ab980d596a68ead4dcc8f6d592c7d33f9d1caacb9e175e25702a1
SHA51240e3d754748eee6a567e60ae86a0ea5da8d05fe06a16e2757d93556a09a58adbb9602aa9bbf751a9e4a1faf2b79ed4569f971691f55b94c03d8d19e7d13f05f7
-
\Users\Admin\AppData\Local\Temp\uvwxyzFiddlerSetup_5.0.20194.41348.exeFilesize
6.3MB
MD553782906aa3c7de6b164349a5cad123f
SHA18bb213d8d34a944b2103a5bba387da52c8c1d926
SHA2562afe37ab5cdb7df4a80fcbe85b9298f509df064173e6a4ee7008e5d409bc6172
SHA5123e736093ddca8fe283bc4dce95d6383e8f25248664f4815b2b3bf1916f6531bdb508303014e1ceea109a93ae08275d8c4c1ff5dbb4e9771d63cd3a1640eab741
-
\Users\Admin\AppData\Local\Temp\~RJ-Fiddler.exeFilesize
306KB
MD56d0e581f0ea82c4b097563c9dcb4f133
SHA119bf6dab6a1c0e2122dd16fe6d72e12083cb0d2b
SHA2563e6c4e569c9254a2d8e3d8ceccba13dc8b0e65b2172c2e9e1d3bf1a1b18e56f0
SHA51290f53a0838ca3a1f32d79ecc765f7866b6683bc0407920f67596779b8f423098d0b03926e190ad42bd51c101f898ccd8dfcafafe71b723796363e105c54de610
-
memory/1016-79-0x0000000000000000-mapping.dmp
-
memory/1036-77-0x0000000000000000-mapping.dmp
-
memory/1120-56-0x0000000000000000-mapping.dmp
-
memory/1168-71-0x0000000000000000-mapping.dmp
-
memory/1288-85-0x0000000000000000-mapping.dmp
-
memory/1368-86-0x0000000000000000-mapping.dmp
-
memory/1420-66-0x0000000000000000-mapping.dmp
-
memory/1488-61-0x0000000000000000-mapping.dmp
-
memory/1600-82-0x0000000000000000-mapping.dmp
-
memory/1648-88-0x0000000000000000-mapping.dmp
-
memory/1892-78-0x0000000000000000-mapping.dmp
-
memory/1948-54-0x0000000076721000-0x0000000076723000-memory.dmpFilesize
8KB
-
memory/1980-87-0x0000000000000000-mapping.dmp