Analysis
-
max time kernel
108s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
24-05-2022 03:11
Static task
static1
Behavioral task
behavioral1
Sample
5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe
Resource
win10v2004-20220414-en
General
-
Target
5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe
-
Size
567KB
-
MD5
77919d56ebbb4e411250024bb5932437
-
SHA1
348ed6271efe7195984e277e8e094fd7b9587e3c
-
SHA256
5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993
-
SHA512
5e45496aa83b3a306fd1ccb8505ff9406f4ac3f640762cf90e6a735c7fc223868c653ebd004accd1a63fbed4008038e636731ef6220d0990bb97b4c50959ee96
Malware Config
Signatures
-
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 1 IoCs
Processes:
5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exepid process 4716 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exedescription ioc process File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13157~1.61\MICROS~3.EXE 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13157~1.61\MICROS~1.EXE 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13157~1.61\MICROS~1.EXE 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13157~1.61\MI9C33~1.EXE 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13157~1.61\MIA062~1.EXE 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13157~1.61\MICROS~2.EXE 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe -
Drops file in Windows directory 1 IoCs
Processes:
5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exedescription ioc process File opened for modification C:\Windows\svchost.com 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 5 IoCs
Processes:
5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\uDRM 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe Set value (data) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\uDRM\MK = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d44f7c908017924dbb36ebe98e677ce1000000000400000020000000106600000001000020000000a11cbad3c79183dc9da0954c25d96e3718304d5fb7648186f4acbff969b38f5b000000000e8000000002000020000000591c79b095d7afe34b576224fafc9c4dab178a8658e00036c7c699495d338d98a0040000d53ee9eaa23d2de02654b2e6298dae1cc2bff29f09f09c309531b52f6ec751930f63ba25512fb531baeea10e125476959eba32120d253e74e48e549acc0cc9eb3dd89d8326a37cc62b126d37c2b28995373ecf07fcc0f94699858cb01422a7bb264e063b80daaa917a389caaef615bb969ca29b4adee0aea1e30de8dfc6c682b6857020e539c2d4e595801720087a1963d84124c35226a4086a81094822bcadae1317765c33415e326073b7a6a2636ec163113a9bf6de524be8b3bf0119f86e29494c08fdbad82808c547c42921364c170ef709481477a9d165e055a229a3bbbd763508a0132d1075c459fdd7a58078df3a7aa39a1c4c563bf595c3125de249b70aa40dadaa8fcf5e3931474d8189dfd23e2e4f28cc45f462e1882317c2da09ac41ada9dafb0e7f6d6da01e550cefbcfef75e2a11510e15d9bd30d8235e4daf2994bc7b8399cb688112df143cee4b2a3f62224b1580c6b8411cb137c68d13dbc7944c5de7460d86136d2380b3b56a0f0edeba46a3d7b56d2dd39d1ed2e2150fe604d629916042bce192d576e74498e3e21d0d3003fc62b6e82f6e9d4cb345264206543dbca04f51be84fa6fb05774c074cf5021c3b8e184a32bc1394bf466a6b3408caed2afc0ad53f7f7e608541dbab86e0b4dc6793a3d127d92933c02a251cfa8e8f00c148c405896583aa4246fbe6e25d73beb48b43a9f26ab21fd13052d4d1e0f2143d6085a2693b9f509d8cd8c65dfc4d1d5bca624d3e320392c4f371967fee8be24544980518221ef3a530e892f46aba38ac6c0d76660c5d56a77e03a6480a5f5c106d7d728059d9fd4334f30ca20173caece9fd234617f8cabc4f856dd489ddf612c872f776032b0edd28d449bd20018ec3a55dd90e85b198998f4d614fbf83fa8fb92a328c698889a7e961bc3b12693cdd7cbf108d002e3fd0b0df8c051d24fcd4376f8a2c467c77b07658b413a02bce766c78ebb97d7a3c5a04ca65401181125a87d3b8a9d720650fde386d91a30112e32ff12f921f0942d7248d0cf4170715412c780410d51fd979f72058f06d7c83ac583f3ed64564d8a084f079f2dd12d0d003cc64e1df9753c1c62a80be1304c7ab3ce86999224c406b20c046990cb75256d3ee75c5fabfc5f38c40124571aeb2982c3c7ef7b97d680e67ab470470690e57314483408adfa1e12d6f6dd766bf383f6df8c38d6caf1e069f6cf859ac2b8e98194fe826b103288168fcf0e6691880b517f31b3d8731bfa78398ba50256300a03e702ce2b158766e50caebf762f8234b7ddebc3c7b7f4df48fa21a7f3a36d785f2b0f9549a2da3a98aefd44494b02202ab28e7d610fe4f8d59051d08fb8d20c72d5c8ad8acd87e146acdb430713bf8ad138c7fb48383d8b71113f460645b866a37585952fae7541fa10af928113bf94ff03f0e4a7ef2c8ae9a66ecc1a1e721a674e019dcdbbd0464e7874e1423d7702802de01fe4c855422d99c0510c03d3417dd896818a3f672e1f20a635d7bef78052ca1919d73614a1d3ed6ae03d4fad628e7c063efae939068f077c7ebbd3ce351bf65062624e3d0828619eba69a5719e5481c99e2bf92e09806ab9cab80cb2e8688061653706f1dd50c48b212e32538d8ddc02ad8cac4827e466a6e69a71f39a2c009cc7abbfbb6aa3c1d69400000005b67bb9b95814b953b9c40cc6600f09e8bafc378cfef0cb9762b9392febac5f7c8c51cfc7443f5f014bcb15399447563266bc030103bce5149262915428427e0 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe Set value (data) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings\Software\Microsoft\uDRM\SK = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d44f7c908017924dbb36ebe98e677ce100000000040000002000000010660000000100002000000046f08cb2ac25b7af090ebe8e85382bfdfa181c8cf472159ef9dae2fbbba34b37000000000e8000000002000020000000f7a3c9de20bd67cda69d6cd12a140471b36927a0ec637bbad22a56281e5a67e8900000002433725341cf0f4b8f5a7ae6da60fb5c987c14522f1c58c9fbdb88185e6c1aec290166e1bf1fa358aa2fe428e7cd315fc1e89464a6d4a6dfdf44f60e5bd765c8bfb41f4afe73458e19ff7afa4d21535c9e810737d0f2d7e7a5d85cec4c8131eb1318b99dff1ca56cbf6f2a1af07f6e5a62c276a6464ddacc04fbb88010432529afba1599a2ba4a036148e22e452722f240000000cbc2591f6a9de53733d5e7531a19269be9f0771374b6ed239bbe89f0399b2ba098872a46088e86d07a21f1c648d1ee4d182c99818c674b36648c5388fabfd2ed 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exedescription pid process target process PID 968 wrote to memory of 4716 968 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe PID 968 wrote to memory of 4716 968 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe PID 968 wrote to memory of 4716 968 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe 5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe"C:\Users\Admin\AppData\Local\Temp\5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe"1⤵
- Modifies system executable filetype association
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Users\Admin\AppData\Local\Temp\3582-490\5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exe"2⤵
- Executes dropped EXE
- Modifies registry class
PID:4716
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\3582-490\5145dacb24cf625240c5798b092be13e5a2674b4fc226d4ccab11495d025b993.exeFilesize
527KB
MD5dd720c9ed3800189333311c3dcb04b7f
SHA1e0ecf01c5ee0a17696e76ca773f73a9edb2d8211
SHA256d80c933d2d39efd3e6ed61513d952e7fb64f1a574ede9fb5bf93b33d232ca71a
SHA512f828638b600f6da6ae4c72be8511d7e150b3671f7e7e740140dcb3ee49adae5c84a696a06c79b6b2309298211ca335ae4a7d6e59c6d74663e388539c5cac52d4
-
memory/4716-130-0x0000000000000000-mapping.dmp
-
memory/4716-132-0x00000000011B0000-0x00000000011C0000-memory.dmpFilesize
64KB
-
memory/4716-133-0x00000000011B0000-0x00000000011C0000-memory.dmpFilesize
64KB
-
memory/4716-134-0x00000000011B0000-0x00000000011C0000-memory.dmpFilesize
64KB
-
memory/4716-135-0x00000000011B0000-0x00000000011C0000-memory.dmpFilesize
64KB
-
memory/4716-136-0x00000000011B0000-0x00000000011C0000-memory.dmpFilesize
64KB
-
memory/4716-137-0x00000000011B0000-0x00000000011C0000-memory.dmpFilesize
64KB
-
memory/4716-138-0x00000000011B0000-0x00000000011C0000-memory.dmpFilesize
64KB
-
memory/4716-139-0x00000000011B0000-0x00000000011C0000-memory.dmpFilesize
64KB
-
memory/4716-140-0x00000000011B0000-0x00000000011C0000-memory.dmpFilesize
64KB