Analysis
-
max time kernel
175s -
max time network
178s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
12-06-2022 08:30
Static task
static1
Behavioral task
behavioral1
Sample
21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe
-
Size
1.1MB
-
MD5
c3e4da6ab5aeea86e7410d5cf7591dc4
-
SHA1
3050f604b87fa992429c2341e8f0c85f770ec80d
-
SHA256
21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577
-
SHA512
8b318c0f846d55ae9dff5cff7d8d8414fafef1a75594aaa68d378154f54a58b4a70475b9f4bd25c7f669e941ace921ecc09fd6570e8283427215b92915c370ad
Score
10/10
Malware Config
Extracted
Credentials
Protocol: smtp- Host:
silverlinehospital.in - Port:
587 - Username:
[email protected] - Password:
Bukky101@
Signatures
-
Accesses Microsoft Outlook profiles 1 TTPs 9 IoCs
Processes:
MSBuild.exeMSBuild.exeMSBuild.exedescription ioc Process Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 9 ifconfig.me -
Suspicious use of SetThreadContext 3 IoCs
Processes:
21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exedescription pid Process procid_target PID 3268 set thread context of 3824 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 78 PID 3268 set thread context of 1320 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 86 PID 3268 set thread context of 2648 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 93 -
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target Process procid_target 4752 3824 WerFault.exe 78 4496 3824 WerFault.exe 78 3500 1320 WerFault.exe 86 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exepid Process 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
MSBuild.exeMSBuild.exeMSBuild.exedescription pid Process Token: SeDebugPrivilege 3824 MSBuild.exe Token: SeDebugPrivilege 1320 MSBuild.exe Token: SeDebugPrivilege 2648 MSBuild.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exepid Process 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exepid Process 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exeMSBuild.exedescription pid Process procid_target PID 3268 wrote to memory of 3824 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 78 PID 3268 wrote to memory of 3824 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 78 PID 3268 wrote to memory of 3824 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 78 PID 3268 wrote to memory of 3824 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 78 PID 3268 wrote to memory of 3824 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 78 PID 3824 wrote to memory of 4752 3824 MSBuild.exe 82 PID 3824 wrote to memory of 4752 3824 MSBuild.exe 82 PID 3824 wrote to memory of 4752 3824 MSBuild.exe 82 PID 3268 wrote to memory of 1320 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 86 PID 3268 wrote to memory of 1320 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 86 PID 3268 wrote to memory of 1320 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 86 PID 3268 wrote to memory of 1320 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 86 PID 3268 wrote to memory of 1320 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 86 PID 3268 wrote to memory of 2648 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 93 PID 3268 wrote to memory of 2648 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 93 PID 3268 wrote to memory of 2648 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 93 PID 3268 wrote to memory of 2648 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 93 PID 3268 wrote to memory of 2648 3268 21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe 93 -
outlook_office_path 1 IoCs
Processes:
MSBuild.exedescription ioc Process Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
outlook_win_path 1 IoCs
Processes:
MSBuild.exedescription ioc Process Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe"C:\Users\Admin\AppData\Local\Temp\21780b952189ccfb91fd35963d08aea3bb970da39052c9615fcdbf173dfaa577.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3824 -s 14923⤵
- Program crash
PID:4752
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3824 -s 14923⤵
- Program crash
PID:4496
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
PID:1320 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1320 -s 14803⤵
- Program crash
PID:3500
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2648
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3824 -ip 38241⤵PID:4256
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1320 -ip 13201⤵PID:3508