Analysis
- max time kernel
175s - max time network
182s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
01/07/2022, 02:40
Static task
static1
Behavioral task
behavioral1
Sample
3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
- Target 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe
- Size 290KB
- Sample220701-c52n5agfap
- SHA256 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8
- MD5 c6111156b395f3e7da625a7022e65510
- SHA1 bbafe2de1510525ca60232df6f0b470d5ca57fa9
- SHA512 2fba768d40f1f67194b794a60e249cc4b335048d37b5e66ac8ab0e0e9773cbc417cf14367716b51fa0c98e75b2b39fc4cab2d44b1fe70c735de8be22adba6dd2
- MD5 SHA1 SHA512
Malware Config
Signatures
- Modifies firewall policy service 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0" explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" explorer.exe - Sets file execution options in registry 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "pzbwr.exe" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\m953em15ec1.exe 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\m953em15ec1.exe\DisableExceptionChainValidation 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe explorer.exe - Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe - Loads dropped DLL 2 IoCs
pid Process 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Google Updater 4.0 = "C:\\ProgramData\\Google Updater 4.0\\m953em15ec1.exe" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Updater 4.0 = "\"C:\\ProgramData\\Google Updater 4.0\\m953em15ec1.exe\"" explorer.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
pid Process 2552 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 3576 explorer.exe 3576 explorer.exe 3576 explorer.exe 3576 explorer.exe 3576 explorer.exe 3576 explorer.exe 3576 explorer.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2296 set thread context of 2552 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 84 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
pid pid_target Process procid_target 4688 3576 WerFault.exe 85 - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer explorer.exe - Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" explorer.exe - Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2552 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 2552 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 2552 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe - Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeDebugPrivilege 2552 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe Token: SeRestorePrivilege 2552 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe Token: SeBackupPrivilege 2552 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe Token: SeLoadDriverPrivilege 2552 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe Token: SeCreatePagefilePrivilege 2552 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe Token: SeShutdownPrivilege 2552 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe Token: SeTakeOwnershipPrivilege 2552 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe Token: SeChangeNotifyPrivilege 2552 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe Token: SeCreateTokenPrivilege 2552 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe Token: SeMachineAccountPrivilege 2552 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe Token: SeSecurityPrivilege 2552 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe Token: SeAssignPrimaryTokenPrivilege 2552 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe Token: SeCreateGlobalPrivilege 2552 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe Token: 33 2552 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe Token: SeDebugPrivilege 3576 explorer.exe Token: SeRestorePrivilege 3576 explorer.exe Token: SeBackupPrivilege 3576 explorer.exe Token: SeLoadDriverPrivilege 3576 explorer.exe Token: SeCreatePagefilePrivilege 3576 explorer.exe Token: SeShutdownPrivilege 3576 explorer.exe Token: SeTakeOwnershipPrivilege 3576 explorer.exe Token: SeChangeNotifyPrivilege 3576 explorer.exe Token: SeCreateTokenPrivilege 3576 explorer.exe Token: SeMachineAccountPrivilege 3576 explorer.exe Token: SeSecurityPrivilege 3576 explorer.exe Token: SeAssignPrimaryTokenPrivilege 3576 explorer.exe Token: SeCreateGlobalPrivilege 3576 explorer.exe Token: 33 3576 explorer.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 2296 wrote to memory of 2876 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 83 PID 2296 wrote to memory of 2876 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 83 PID 2296 wrote to memory of 2876 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 83 PID 2296 wrote to memory of 2876 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 83 PID 2296 wrote to memory of 2876 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 83 PID 2296 wrote to memory of 2552 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 84 PID 2296 wrote to memory of 2552 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 84 PID 2296 wrote to memory of 2552 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 84 PID 2296 wrote to memory of 2552 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 84 PID 2296 wrote to memory of 2552 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 84 PID 2296 wrote to memory of 2552 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 84 PID 2296 wrote to memory of 2552 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 84 PID 2296 wrote to memory of 2552 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 84 PID 2296 wrote to memory of 2552 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 84 PID 2296 wrote to memory of 2552 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 84 PID 2296 wrote to memory of 2552 2296 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 84 PID 2552 wrote to memory of 3576 2552 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 85 PID 2552 wrote to memory of 3576 2552 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 85 PID 2552 wrote to memory of 3576 2552 3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe"C:\Users\Admin\AppData\Local\Temp\3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe"C:\Users\Admin\AppData\Local\Temp\3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe"2⤵PID:2876
-
-
C:\Users\Admin\AppData\Local\Temp\3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe"C:\Users\Admin\AppData\Local\Temp\3f1d2e8d5d89e82cf02d96ac0bb2a219a12eac2f3aa6b1ada0ec072c8222dec8.exe"2⤵
- Sets file execution options in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Modifies firewall policy service
- Sets file execution options in registry
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
PID:3576 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3576 -s 11244⤵
- Program crash
PID:4688
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3576 -ip 35761⤵PID:4584
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsbE3DE.tmp\System.dll
- Size 11KB
- SHA256 a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77
- MD5 b0c77267f13b2f87c084fd86ef51ccfc
- SHA1 f7543f9e9b4f04386dfbf33c38cbed1bf205afb3
- SHA512 f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e
- SSDEEP 192:4PtkiQJr7jHYT87RfwXQ6YSYtOuVDi7IsFW14Ll8CO:H78TQIgGCDp14LGC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\perjurers.dll
- Size 50KB
- SHA256 a2631b4404caa7420ebee6273aa9e39228f6fcb28734076c17c805eb9c613b45
- MD5 ed605d7acafc2c9368803578627054db
- SHA1 b7690028e1aa34afad24f9d1eadd9067de9333e1
- SHA512 21fc749f213f3d167d163434558979e08d66f2d58c6cb6881998db0ef67b9b0b87ca9969f4eba46ab7c1797091f5a34721d9bbb71448cc2f1a03547a4bbd9458
- SSDEEP 768:m5fwk+JoTwgq6LQU+cQaVUOWmLPDAdCMTiwP+xExUsN/X0sfxjsHbE+kIHKvN8zs:vlO5UdSJiCMTiwmONRX0yYH4+RHiN8z
- MD5 SHA1 SHA512 SSDEEP