Analysis
-
max time kernel
153s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
15-06-2022 11:48
Static task
static1
Behavioral task
behavioral1
Sample
6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe
Resource
win11-20220223-en
General
-
Target
6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe
-
Size
54KB
-
MD5
057d8c68bf4ce08bda3f9bd96c04bd25
-
SHA1
60428ec831ff15fe3e5019e8517af06da1196b96
-
SHA256
6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f
-
SHA512
87a48943600a1d5782edaf76fd422d3d66e571a2f907dc99dddded81e25275b8fb332e04f79078d90d2a7abcdcc95c7dc10244ef91c3f272b9bbbbd180db17a4
Malware Config
Signatures
-
Drops desktop.ini file(s) 2 IoCs
Processes:
6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exedescription ioc process File opened for modification C:\$Recycle.Bin\S-1-5-21-1081944012-3634099177-1681222835-1000\desktop.ini 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\desktop.ini 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe -
Drops file in Program Files directory 64 IoCs
Processes:
6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-options-keymap.xml_hidden 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository.nl_ja_4.4.0.v20140623020002.jar 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-print.xml 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_ja.jar 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_zh_CN.jar 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\feature.xml 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.attach_5.5.0.165303.jar 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\oracle.gif 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\org-openide-modules.jar 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\resources.jar 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ko-kr.dll 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\dnsns.jar 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.zh_CN_5.5.0.165303.jar 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-tools_zh_CN.jar 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome.exe.sig 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\feature.xml 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_zh_CN.jar 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\classlist 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-spi-actions_zh_CN.jar 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-utilities.xml 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup_ja.jar 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\sunmscapi.dll 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt_0.12.100.v20140530-1436.jar 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository_2.3.0.v20131211-1531.jar 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\management.dll 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-openide-dialogs.xml 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\hprof.dll 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\messages.properties 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_zh_4.4.0.v20140623020002.jar 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.help.base.nl_ja_4.4.0.v20140623020002.jar 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-snaptracer_zh_CN.jar 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-options-keymap.xml 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-core.jar 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\policytool.exe 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\artifacts.xml 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\date-span-16.png 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Microsoft Office\AppXManifest.xml 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\ECLIPSE_.SF 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\plugin.xml 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\javax.servlet_3.0.0.v201112011016.jar 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher_1.3.0.v20140911-0143.jar 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_ja.jar 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.nl_ja_4.4.0.v20140623020002.jar 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Common Files\System\wab32res.dll 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\el.pak 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\lv.pak 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\LogoCanary.png 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jfr.dll 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\instrument.dll 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\jvm.hprof.txt 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\ext\updater.jar 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javafx_font.dll 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\plugin.xml 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
Taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName Taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Taskmgr.exepid process 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Taskmgr.exepid process 1484 Taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Taskmgr.exedescription pid process Token: SeDebugPrivilege 1484 Taskmgr.exe Token: SeSystemProfilePrivilege 1484 Taskmgr.exe Token: SeCreateGlobalPrivilege 1484 Taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
Taskmgr.exe6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exepid process 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 3880 6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
Taskmgr.exepid process 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe 1484 Taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
launchtm.exedescription pid process target process PID 1712 wrote to memory of 1484 1712 launchtm.exe Taskmgr.exe PID 1712 wrote to memory of 1484 1712 launchtm.exe Taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe"C:\Users\Admin\AppData\Local\Temp\6c39c5f5d143700d4ad43b0aa7fb6a51e77817060467cf3462ef037176e1f50f.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\launchtm.exelaunchtm.exe /21⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe" /22⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1484-130-0x0000000000000000-mapping.dmp