Analysis
- max time kernel
153s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20220722-en - resource tags
arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system - submitted
24/07/2022, 17:17
Static task
static1
Behavioral task
behavioral1
Sample
57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe
Resource
win7-20220718-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe
Resource
win10v2004-20220722-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe
- Size 577KB
- Sample220724-vt7p4scbf8
- SHA256 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824
- MD5 e1767864fd8a7dc7dd70166edab187d2
- SHA1 8f2e2d6c1e6a754f11027019e36595c300cd6414
- SHA512 0ec330a671619690028f655bfb58ec4cddd78927676bde81a456cbb0de465c866dddc1164f89edb81be8c87ffb5d72f434989d00cacc9a0a1206c9eecbfec822
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
pid Process 1968 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 1672 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 4448 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Control Panel\International\Geo\Nation 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "\\System\\DefenderSecuritySystem.exe" 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe Set value (str) \REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\System\\DefenderSecuritySystem.exe" 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe - Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe File opened for modification C:\Windows\assembly\Desktop.ini 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3608 set thread context of 5008 3608 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 79 PID 1968 set thread context of 4448 1968 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 89 - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\assembly 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe File created C:\Windows\assembly\Desktop.ini 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe File opened for modification C:\Windows\assembly\Desktop.ini 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 2 IoCs
pid pid_target Process procid_target 1104 3608 WerFault.exe 77 3164 1968 WerFault.exe 84 - Runs ping.exe 1 TTPs 1 IoCs
pid Process 872 PING.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3608 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 3608 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 3608 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 3608 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 3608 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 3608 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 3608 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 5008 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 5008 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 5008 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 5008 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 5008 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 5008 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 5008 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 5008 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 5008 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 5008 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 5008 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 5008 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 5008 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 5008 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 5008 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 5008 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 5008 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 5008 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 5008 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 5008 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 5008 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 5008 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 5008 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 5008 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 5008 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 5008 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 5008 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 5008 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 5008 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 5008 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 5008 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 5008 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 5008 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 1968 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 1968 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 1968 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 1968 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 1968 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 1968 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 1968 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 4448 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 4448 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 4448 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 4448 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 4448 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 4448 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 4448 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 4448 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 4448 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 4448 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 4448 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 4448 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 4448 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 4448 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 4448 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 4448 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 4448 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4448 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3608 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe Token: SeDebugPrivilege 5008 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe Token: SeDebugPrivilege 1968 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe Token: SeDebugPrivilege 4448 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe Token: 33 4448 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe Token: SeIncBasePriorityPrivilege 4448 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4448 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe - Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 3608 wrote to memory of 5000 3608 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 78 PID 3608 wrote to memory of 5000 3608 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 78 PID 3608 wrote to memory of 5000 3608 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 78 PID 3608 wrote to memory of 5008 3608 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 79 PID 3608 wrote to memory of 5008 3608 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 79 PID 3608 wrote to memory of 5008 3608 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 79 PID 3608 wrote to memory of 5008 3608 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 79 PID 3608 wrote to memory of 5008 3608 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 79 PID 3608 wrote to memory of 5008 3608 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 79 PID 3608 wrote to memory of 5008 3608 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 79 PID 3608 wrote to memory of 5008 3608 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 79 PID 5008 wrote to memory of 3608 5008 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 77 PID 5008 wrote to memory of 3608 5008 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 77 PID 5008 wrote to memory of 3608 5008 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 77 PID 5008 wrote to memory of 3608 5008 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 77 PID 5008 wrote to memory of 3608 5008 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 77 PID 5008 wrote to memory of 1968 5008 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 84 PID 5008 wrote to memory of 1968 5008 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 84 PID 5008 wrote to memory of 1968 5008 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 84 PID 5008 wrote to memory of 1444 5008 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 85 PID 5008 wrote to memory of 1444 5008 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 85 PID 5008 wrote to memory of 1444 5008 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 85 PID 1444 wrote to memory of 872 1444 cmd.exe 87 PID 1444 wrote to memory of 872 1444 cmd.exe 87 PID 1444 wrote to memory of 872 1444 cmd.exe 87 PID 1968 wrote to memory of 1672 1968 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 88 PID 1968 wrote to memory of 1672 1968 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 88 PID 1968 wrote to memory of 1672 1968 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 88 PID 1968 wrote to memory of 4448 1968 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 89 PID 1968 wrote to memory of 4448 1968 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 89 PID 1968 wrote to memory of 4448 1968 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 89 PID 1968 wrote to memory of 4448 1968 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 89 PID 1968 wrote to memory of 4448 1968 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 89 PID 1968 wrote to memory of 4448 1968 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 89 PID 1968 wrote to memory of 4448 1968 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 89 PID 1968 wrote to memory of 4448 1968 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 89 PID 4448 wrote to memory of 1968 4448 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 84 PID 4448 wrote to memory of 1968 4448 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 84 PID 4448 wrote to memory of 1968 4448 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 84 PID 4448 wrote to memory of 1968 4448 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 84 PID 4448 wrote to memory of 1968 4448 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe"C:\Users\Admin\AppData\Local\Temp\57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe"C:\Users\Admin\AppData\Local\Temp\57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe"2⤵PID:5000
-
-
C:\Users\Admin\AppData\Local\Temp\57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe"C:\Users\Admin\AppData\Local\Temp\57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824\57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe"C:\Users\Admin\AppData\Local\Temp\57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824\57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824\57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe"C:\Users\Admin\AppData\Local\Temp\57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824\57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe"4⤵
- Executes dropped EXE
PID:1672
-
-
C:\Users\Admin\AppData\Local\Temp\57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824\57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe"C:\Users\Admin\AppData\Local\Temp\57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824\57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4448
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 10644⤵
- Program crash
PID:3164
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 10004⤵
- Runs ping.exe
PID:872
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3608 -s 11282⤵
- Program crash
PID:1104
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3608 -ip 36081⤵PID:1664
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1968 -ip 19681⤵PID:4444
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:3560
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe.log
- Size 400B
- SHA256 c7effe9cb81a70d738dee863991afefab040290d4c4b78b4202383bcb9f88fcd
- MD5 0a9b4592cd49c3c21f6767c2dabda92f
- SHA1 f534297527ae5ccc0ecb2221ddeb8e58daeb8b74
- SHA512 6b878df474e5bbfb8e9e265f15a76560c2ef151dcebc6388c82d7f6f86ffaf83f5ade5a09f1842e493cb6c8fd63b0b88d088c728fd725f7139f965a5ee332307
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824\57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe
- Size 577KB
- SHA256 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824
- MD5 e1767864fd8a7dc7dd70166edab187d2
- SHA1 8f2e2d6c1e6a754f11027019e36595c300cd6414
- SHA512 0ec330a671619690028f655bfb58ec4cddd78927676bde81a456cbb0de465c866dddc1164f89edb81be8c87ffb5d72f434989d00cacc9a0a1206c9eecbfec822
- SSDEEP 12288:540NV9gHsLlxwtDKa6t/pz63c9JAA2l3qy8X69Wl08V0bqHXxhzqGZSEJRUZ:yMV92U38gt/gE6q29WlWu3v3rRUZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824\57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe
- Size 577KB
- SHA256 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824
- MD5 e1767864fd8a7dc7dd70166edab187d2
- SHA1 8f2e2d6c1e6a754f11027019e36595c300cd6414
- SHA512 0ec330a671619690028f655bfb58ec4cddd78927676bde81a456cbb0de465c866dddc1164f89edb81be8c87ffb5d72f434989d00cacc9a0a1206c9eecbfec822
- SSDEEP 12288:540NV9gHsLlxwtDKa6t/pz63c9JAA2l3qy8X69Wl08V0bqHXxhzqGZSEJRUZ:yMV92U38gt/gE6q29WlWu3v3rRUZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824\57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe
- Size 577KB
- SHA256 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824
- MD5 e1767864fd8a7dc7dd70166edab187d2
- SHA1 8f2e2d6c1e6a754f11027019e36595c300cd6414
- SHA512 0ec330a671619690028f655bfb58ec4cddd78927676bde81a456cbb0de465c866dddc1164f89edb81be8c87ffb5d72f434989d00cacc9a0a1206c9eecbfec822
- SSDEEP 12288:540NV9gHsLlxwtDKa6t/pz63c9JAA2l3qy8X69Wl08V0bqHXxhzqGZSEJRUZ:yMV92U38gt/gE6q29WlWu3v3rRUZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824\57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824.exe
- Size 577KB
- SHA256 57eeaa53f9f5977a89d50c7435f6f81caf1de0312c8f1e592957f3812a09e824
- MD5 e1767864fd8a7dc7dd70166edab187d2
- SHA1 8f2e2d6c1e6a754f11027019e36595c300cd6414
- SHA512 0ec330a671619690028f655bfb58ec4cddd78927676bde81a456cbb0de465c866dddc1164f89edb81be8c87ffb5d72f434989d00cacc9a0a1206c9eecbfec822
- SSDEEP 12288:540NV9gHsLlxwtDKa6t/pz63c9JAA2l3qy8X69Wl08V0bqHXxhzqGZSEJRUZ:yMV92U38gt/gE6q29WlWu3v3rRUZ
- MD5 SHA1 SHA512 SSDEEP