Analysis
-
max time kernel
151s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
24-07-2022 15:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe
Resource
win7-20220718-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe
Resource
win10v2004-20220721-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe
-
Size
1.1MB
-
MD5
bf19b9d83c35f2a6a03365c3fcf4135d
-
SHA1
e6ae36b4bde0d51215d33a4432a95fc3c2465a70
-
SHA256
9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102
-
SHA512
2cac488eb6359fc050b3a486b1052ed98bfb38d4e0d66e8c842600299e51c6602c2855e9732e7f5948ba6347ab41cd41510b0f84554321eb5db774ec4fe0160f
Score
10/10
Malware Config
Signatures
-
Phoenix Keylogger payload 1 IoCs
resource yara_rule behavioral1/memory/1004-59-0x0000000000370000-0x00000000003AA000-memory.dmp family_phoenix -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 ifconfig.me -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1108 set thread context of 1004 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 27 -
Program crash 1 IoCs
pid pid_target Process procid_target 1224 1004 WerFault.exe 27 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1004 MSBuild.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1108 wrote to memory of 1004 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 27 PID 1108 wrote to memory of 1004 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 27 PID 1108 wrote to memory of 1004 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 27 PID 1108 wrote to memory of 1004 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 27 PID 1108 wrote to memory of 1004 1108 9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe 27 PID 1004 wrote to memory of 1224 1004 MSBuild.exe 29 PID 1004 wrote to memory of 1224 1004 MSBuild.exe 29 PID 1004 wrote to memory of 1224 1004 MSBuild.exe 29 PID 1004 wrote to memory of 1224 1004 MSBuild.exe 29 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe"C:\Users\Admin\AppData\Local\Temp\9cfbfeea1c8769897ea1b35e658efa43e78a79e13828b54523b7e21d7a273102.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1004 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1004 -s 13203⤵
- Program crash
PID:1224
-
-