Analysis
-
max time kernel
151s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
24-07-2022 15:09
Static task
static1
Behavioral task
behavioral1
Sample
9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe
Resource
win10v2004-20220721-en
General
-
Target
9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe
-
Size
1.1MB
-
MD5
bf19b9d83c35f2a6a03365c3fcf4135d
-
SHA1
e6ae36b4bde0d51215d33a4432a95fc3c2465a70
-
SHA256
9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102
-
SHA512
2cac488eb6359fc050b3a486b1052ed98bfb38d4e0d66e8c842600299e51c6602c2855e9732e7f5948ba6347ab41cd41510b0f84554321eb5db774ec4fe0160f
Malware Config
Signatures
-
Phoenix Keylogger payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1004-59-0x0000000000370000-0x00000000003AA000-memory.dmp family_phoenix -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 ifconfig.me -
Suspicious use of SetThreadContext 1 IoCs
Processes:
9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exedescription pid process target process PID 1108 set thread context of 1004 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe MSBuild.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1224 1004 WerFault.exe MSBuild.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exepid process 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exepid process 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MSBuild.exedescription pid process Token: SeDebugPrivilege 1004 MSBuild.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exepid process 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exepid process 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exeMSBuild.exedescription pid process target process PID 1108 wrote to memory of 1004 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe MSBuild.exe PID 1108 wrote to memory of 1004 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe MSBuild.exe PID 1108 wrote to memory of 1004 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe MSBuild.exe PID 1108 wrote to memory of 1004 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe MSBuild.exe PID 1108 wrote to memory of 1004 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe MSBuild.exe PID 1004 wrote to memory of 1224 1004 MSBuild.exe WerFault.exe PID 1004 wrote to memory of 1224 1004 MSBuild.exe WerFault.exe PID 1004 wrote to memory of 1224 1004 MSBuild.exe WerFault.exe PID 1004 wrote to memory of 1224 1004 MSBuild.exe WerFault.exe -
outlook_office_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
outlook_win_path 1 IoCs
Processes:
MSBuild.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe"C:\Users\Admin\AppData\Local\Temp\9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1004 -s 13203⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1004-57-0x00000000004205FE-mapping.dmp
-
memory/1004-58-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/1004-59-0x0000000000370000-0x00000000003AA000-memory.dmpFilesize
232KB
-
memory/1108-54-0x00000000758B1000-0x00000000758B3000-memory.dmpFilesize
8KB
-
memory/1108-55-0x0000000000760000-0x000000000077F000-memory.dmpFilesize
124KB
-
memory/1108-56-0x00000000000B0000-0x00000000000B3000-memory.dmpFilesize
12KB
-
memory/1108-62-0x00000000000B0000-0x00000000000B3000-memory.dmpFilesize
12KB
-
memory/1224-61-0x0000000000000000-mapping.dmp