b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf

General

Target

b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
Size

790KB
MD5

c767466a3e546cf4c3f4c7d06674f649
SHA1

86fd75f689e1cdae1ebe04e75cb8c41007d58f8a
SHA256

b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf
SHA512

455df92cf93a0d78022275230f095c8ff502bfb046b407262c0043159d198294c95c32821b284f72e868983d62077e9a8a99ded02f5c4d18ef40ee2e97c9ea06

Score

8^/10

evasion persistence

Malware Config

Signatures

Sets file to hidden 1 TTPs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

Adds Run key to start application 2 TTPs 50 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

REG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsegdgsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ergsergs\\dev.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsegdgsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ergsergs\\dev.exe"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsegdgsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ergsergs\\dev.exe"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsegdgsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ergsergs\\dev.exe"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsegdgsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ergsergs\\dev.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsegdgsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ergsergs\\dev.exe"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsegdgsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ergsergs\\dev.exe"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsegdgsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ergsergs\\dev.exe"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsegdgsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ergsergs\\dev.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsegdgsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ergsergs\\dev.exe"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsegdgsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ergsergs\\dev.exe"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsegdgsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ergsergs\\dev.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsegdgsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ergsergs\\dev.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsegdgsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ergsergs\\dev.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsegdgsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ergsergs\\dev.exe"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsegdgsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ergsergs\\dev.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsegdgsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ergsergs\\dev.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsegdgsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ergsergs\\dev.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsegdgsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ergsergs\\dev.exe"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsegdgsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ergsergs\\dev.exe"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsegdgsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ergsergs\\dev.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsegdgsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ergsergs\\dev.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsegdgsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ergsergs\\dev.exe"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsegdgsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ergsergs\\dev.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\rsegdgsg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\ergsergs\\dev.exe"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 25 IoCs

Processes:

b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe

pid	process
748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe

description pid process

Token: SeDebugPrivilege 748 b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe

description	pid	process
Token: SeDebugPrivilege	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe

description	pid	process	target process
PID 748 wrote to memory of 1088	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	attrib.exe
PID 748 wrote to memory of 1088	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	attrib.exe
PID 748 wrote to memory of 1088	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	attrib.exe
PID 748 wrote to memory of 1088	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	attrib.exe
PID 748 wrote to memory of 1996	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 1996	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 1996	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 1996	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 1688	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	RegAsm.exe
PID 748 wrote to memory of 1688	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	RegAsm.exe
PID 748 wrote to memory of 1688	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	RegAsm.exe
PID 748 wrote to memory of 1688	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	RegAsm.exe
PID 748 wrote to memory of 1688	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	RegAsm.exe
PID 748 wrote to memory of 1688	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	RegAsm.exe
PID 748 wrote to memory of 1688	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	RegAsm.exe
PID 748 wrote to memory of 1988	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 1988	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 1988	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 1988	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 1172	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 1172	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 1172	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 1172	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 1868	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 1868	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 1868	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 1868	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 1108	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 1108	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 1108	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 1108	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 700	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 700	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 700	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 700	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 1252	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 1252	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 1252	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 1252	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 780	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 780	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 780	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 780	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 1360	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 1360	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 1360	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 1360	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 1972	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 1972	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 1972	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 1972	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 1044	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 1044	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 1044	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 1044	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 1028	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 1028	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 1028	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 1028	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 1148	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 1148	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 1148	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 1148	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe
PID 748 wrote to memory of 692	748	b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe	REG.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

1088 attrib.exe

pid	process
1088	attrib.exe

C:\Users\Admin\AppData\Local\Temp\b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
"C:\Users\Admin\AppData\Local\Temp\b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:748

C:\Windows\SysWOW64\attrib.exe
"C:\Windows\System32\attrib.exe" +s +h C:\Users\Admin\AppData\Local\Temp\b9abb9034a6e25c416c3031b9dbfd566b3d7b39dfb1fc9229095f22ee8c6a9bf.exe
2⤵
- Views/modifies file attributes
PID:1088

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "rsegdgsg" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\\ergsergs\dev.exe
2⤵
- Adds Run key to start application
PID:1996

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
"\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
2⤵
PID:1688

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "rsegdgsg" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\\ergsergs\dev.exe
2⤵
- Adds Run key to start application
PID:1988

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "rsegdgsg" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\\ergsergs\dev.exe
2⤵
- Adds Run key to start application
PID:1172

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "rsegdgsg" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\\ergsergs\dev.exe
2⤵
- Adds Run key to start application
PID:1868

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "rsegdgsg" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\\ergsergs\dev.exe
2⤵
- Adds Run key to start application
PID:1108

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "rsegdgsg" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\\ergsergs\dev.exe
2⤵
- Adds Run key to start application
PID:700

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "rsegdgsg" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\\ergsergs\dev.exe
2⤵
- Adds Run key to start application
PID:1252

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "rsegdgsg" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\\ergsergs\dev.exe
2⤵
- Adds Run key to start application
PID:780

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "rsegdgsg" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\\ergsergs\dev.exe
2⤵
- Adds Run key to start application
PID:1360

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "rsegdgsg" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\\ergsergs\dev.exe
2⤵
- Adds Run key to start application
PID:1972

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "rsegdgsg" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\\ergsergs\dev.exe
2⤵
- Adds Run key to start application
PID:1044

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "rsegdgsg" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\\ergsergs\dev.exe
2⤵
- Adds Run key to start application
PID:1028

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "rsegdgsg" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\\ergsergs\dev.exe
2⤵
- Adds Run key to start application
PID:1148

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "rsegdgsg" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\\ergsergs\dev.exe
2⤵
- Adds Run key to start application
PID:692

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "rsegdgsg" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\\ergsergs\dev.exe
2⤵
- Adds Run key to start application
PID:480

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "rsegdgsg" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\\ergsergs\dev.exe
2⤵
- Adds Run key to start application
PID:888

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "rsegdgsg" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\\ergsergs\dev.exe
2⤵
- Adds Run key to start application
PID:976

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "rsegdgsg" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\\ergsergs\dev.exe
2⤵
- Adds Run key to start application
PID:1668

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "rsegdgsg" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\\ergsergs\dev.exe
2⤵
- Adds Run key to start application
PID:1756

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "rsegdgsg" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\\ergsergs\dev.exe
2⤵
- Adds Run key to start application
PID:2020

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "rsegdgsg" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\\ergsergs\dev.exe
2⤵
- Adds Run key to start application
PID:1944

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "rsegdgsg" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\\ergsergs\dev.exe
2⤵
- Adds Run key to start application
PID:1580

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "rsegdgsg" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\\ergsergs\dev.exe
2⤵
- Adds Run key to start application
PID:1420

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "rsegdgsg" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\\ergsergs\dev.exe
2⤵
- Adds Run key to start application
PID:1628

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "rsegdgsg" /t REG_SZ /F /D "C:\Users\Admin\AppData\Local\Temp\\ergsergs\dev.exe
2⤵
- Adds Run key to start application
PID:1456

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

2

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/480-71-0x0000000000000000-mapping.dmp

Download
memory/692-70-0x0000000000000000-mapping.dmp

Download
memory/700-62-0x0000000000000000-mapping.dmp

Download
memory/748-55-0x0000000074980000-0x0000000074F2B000-memory.dmp

Filesize
5.7MB

Download
memory/748-54-0x00000000763E1000-0x00000000763E3000-memory.dmp

Filesize
8KB

Download
memory/780-64-0x0000000000000000-mapping.dmp

Download
memory/888-72-0x0000000000000000-mapping.dmp

Download
memory/976-73-0x0000000000000000-mapping.dmp

Download
memory/1028-68-0x0000000000000000-mapping.dmp

Download
memory/1044-67-0x0000000000000000-mapping.dmp

Download
memory/1088-56-0x0000000000000000-mapping.dmp

Download
memory/1108-61-0x0000000000000000-mapping.dmp

Download
memory/1148-69-0x0000000000000000-mapping.dmp

Download
memory/1172-59-0x0000000000000000-mapping.dmp

Download
memory/1252-63-0x0000000000000000-mapping.dmp

Download
memory/1360-65-0x0000000000000000-mapping.dmp

Download
memory/1420-79-0x0000000000000000-mapping.dmp

Download
memory/1456-81-0x0000000000000000-mapping.dmp

Download
memory/1580-78-0x0000000000000000-mapping.dmp

Download
memory/1628-80-0x0000000000000000-mapping.dmp

Download
memory/1668-74-0x0000000000000000-mapping.dmp

Download
memory/1756-75-0x0000000000000000-mapping.dmp

Download
memory/1868-60-0x0000000000000000-mapping.dmp

Download
memory/1944-77-0x0000000000000000-mapping.dmp

Download
memory/1972-66-0x0000000000000000-mapping.dmp

Download
memory/1988-58-0x0000000000000000-mapping.dmp

Download
memory/1996-57-0x0000000000000000-mapping.dmp

Download
memory/2020-76-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads