Analysis
-
max time kernel
100s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
02-10-2022 20:25
Static task
static1
Behavioral task
behavioral1
Sample
bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe
Resource
win7-20220812-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe
-
Size
725KB
-
MD5
33909b737637efe050dfc8083630ed66
-
SHA1
21a699845ad17fc3db3608b3c1fd4002ef057145
-
SHA256
bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1
-
SHA512
9d51cd97a6616358fdc8ffe93f249936b1ed9062ca9ecd47abceae1c852bd3334ee2b88536007dfc8b86b947a8dce1171e0f741136a031940953026ffc5d5dd7
-
SSDEEP
6144:a+nglw9ayQv3ahvyn/PU7O0KXgTTSjiZ7ifckWEN4+Ugh+VuSfCpJipyfCpJipb:rjS3Yvyn/0TvhifHW8NUnVuSaXiQaXix
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe smrss.exe" bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe -
Executes dropped EXE 1 IoCs
pid Process 4540 00043.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\freizer = "C:\\WINDOWS\\system32\\freizer.exe" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\WINDOWS\\system32\\svchost.exe" reg.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\smrss.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Windows\SysWOW64\smrss.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File created C:\WINDOWS\SysWOW64\freizer.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\kinit.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\servertool.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec64.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\orbd.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\keytool.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmid.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstatd.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jp2launcher.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\orbd.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmid.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\unpack200.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\7-Zip\7zG.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\kinit.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\pack200.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsgen.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\keytool.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmic.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmiregistry.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\servertool.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jjs.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmiregistry.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\notification_helper.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jinfo.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\ktab.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\policytool.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\orbd.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\policytool.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\klist.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ssvagent.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java-rmi.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\pack200.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\WINDOWS\svchost.exe bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings 00043.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4540 00043.exe 1880 OpenWith.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1284 wrote to memory of 2124 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 85 PID 1284 wrote to memory of 2124 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 85 PID 1284 wrote to memory of 2124 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 85 PID 1284 wrote to memory of 4264 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 86 PID 1284 wrote to memory of 4264 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 86 PID 1284 wrote to memory of 4264 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 86 PID 4264 wrote to memory of 4380 4264 cmd.exe 89 PID 4264 wrote to memory of 4380 4264 cmd.exe 89 PID 4264 wrote to memory of 4380 4264 cmd.exe 89 PID 2124 wrote to memory of 2596 2124 cmd.exe 90 PID 2124 wrote to memory of 2596 2124 cmd.exe 90 PID 2124 wrote to memory of 2596 2124 cmd.exe 90 PID 1284 wrote to memory of 4540 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 91 PID 1284 wrote to memory of 4540 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 91 PID 1284 wrote to memory of 4540 1284 bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe"C:\Users\Admin\AppData\Local\Temp\bc6f984016385610c7f81fb5697724f55f9286b6b86e485a7419114c8906ebf1.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\SysWOW64\cmd.execmd /c reg ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v freizer /t REG_SZ /d C:\WINDOWS\system32\freizer.exe /f2⤵
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\SysWOW64\reg.exereg ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v freizer /t REG_SZ /d C:\WINDOWS\system32\freizer.exe /f3⤵
- Adds Run key to start application
PID:2596
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c reg ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v svchost /t REG_SZ /d C:\WINDOWS\system32\svchost.exe /f2⤵
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\SysWOW64\reg.exereg ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v svchost /t REG_SZ /d C:\WINDOWS\system32\svchost.exe /f3⤵
- Adds Run key to start application
PID:4380
-
-
-
C:\windows\temp\00043.exe"C:\windows\temp\00043.exe"2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4540
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:1880
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD5090d5891041e35e18c77f664581c0bd6
SHA1cf3fdcfe52f5b915c10fd778b5e1dd091f4e847b
SHA2561d5cae50081a57e7b55bef220788d9065483ff1a8d39c3ca8df39f60cdf231af
SHA51228daf522db7774d04f2dde7c5edf20c0fb7b1f58956fa1bacd4b417cb129640418aff98ab009d7c454b77031a54a212ceb12b427c564f4c5b00e5a07d8cabaff
-
Filesize
39KB
MD5090d5891041e35e18c77f664581c0bd6
SHA1cf3fdcfe52f5b915c10fd778b5e1dd091f4e847b
SHA2561d5cae50081a57e7b55bef220788d9065483ff1a8d39c3ca8df39f60cdf231af
SHA51228daf522db7774d04f2dde7c5edf20c0fb7b1f58956fa1bacd4b417cb129640418aff98ab009d7c454b77031a54a212ceb12b427c564f4c5b00e5a07d8cabaff