Analysis
- max time kernel
187s - max time network
201s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
03/10/2022, 08:46
Static task
static1
Behavioral task
behavioral1
Sample
235920237c07cb8decfa53e9c92d72e6.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
235920237c07cb8decfa53e9c92d72e6.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target 235920237c07cb8decfa53e9c92d72e6.exe
- Size 133KB
- Sample221003-kn98yahbdm
- SHA256 d898c6a965e975401a73dc7068488e0248bc10a0794cb2600fa12bc6d63007d8
- MD5 235920237c07cb8decfa53e9c92d72e6
- SHA1 3ef60cbeeb8aae76724197f488ee02ffd978aea4
- SHA512 75d64f8f19d9fae18700d65c6564259101442621f27c0fe41bd35ba8f039260d3f2d52c94971adba9921fcc827a72ea8334dde4bda3af0a2e3bb9fe6afbd3882
- SSDEEP 1536:JeTDf4tIUJ0YZHORKt7dH9+yWWY0stWIMMfRwfbuudPyTlr62dkl1tsfPuWpD73z:JenSZORM7dH9QWKwTueyeV7U28EtfG
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Smokeloader packer 2 IoCs
resource yara_rule behavioral2/memory/4772-133-0x0000000000630000-0x0000000000639000-memory.dmp family_smokeloader behavioral2/memory/3948-150-0x0000000000D20000-0x0000000000D27000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 4 IoCs
pid Process 4740 15EF.exe 4272 3B99.exe 3092 1.exe 1064 59F0.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 15EF.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 130 checkip.amazonaws.com 132 checkip.amazonaws.com - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 235920237c07cb8decfa53e9c92d72e6.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 235920237c07cb8decfa53e9c92d72e6.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 235920237c07cb8decfa53e9c92d72e6.exe - GoLang User-Agent 5 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 128 Go-http-client/1.1 HTTP User-Agent header 124 Go-http-client/1.1 HTTP User-Agent header 125 Go-http-client/1.1 HTTP User-Agent header 126 Go-http-client/1.1 HTTP User-Agent header 127 Go-http-client/1.1 -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F373B387065A28848AF2F34ACE192BDDC78E9CAC 59F0.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F373B387065A28848AF2F34ACE192BDDC78E9CAC\Blob = 0f0000000100000020000000927824e958a132afbcadd9e12357a0f9788ab99c5669e1ec3825e1eb5f6f54540b000000010000003e00000041006300740061006c00690073002000410075007400680065006e007400690063006100740069006f006e00200052006f006f0074002000430041000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b0601050507030862000000010000002000000055926084ec963a64b96e2abe01ce0ba86a64fbfebcc7aab5afc155b37fd76066530000000100000020000000301e301c06062b811f01110130123010060a2b0601040182373c0101030200c014000000010000001400000052d8883ac89f7866ed89f37b387094c9020236d01d000000010000001000000095b4475fef63caf7452d10faa6f6362b030000000100000014000000f373b387065a28848af2f34ace192bddc78e9cac2000000001000000bf050000308205bb308203a3a0030201020208570a119742c4e3cc300d06092a864886f70d01010b0500306b310b3009060355040613024954310e300c06035504070c054d696c616e31233021060355040a0c1a416374616c697320532e702e412e2f30333335383532303936373127302506035504030c1e416374616c69732041757468656e7469636174696f6e20526f6f74204341301e170d3131303932323131323230325a170d3330303932323131323230325a306b310b3009060355040613024954310e300c06035504070c054d696c616e31233021060355040a0c1a416374616c697320532e702e412e2f30333335383532303936373127302506035504030c1e416374616c69732041757468656e7469636174696f6e20526f6f7420434130820222300d06092a864886f70d01010105000382020f003082020a0282020100a7c6c4a529a42cefe518c5b050a36f513b9f0a5ac9c248380ac21ca0187f91b587b9403fdd1d681f0883d52d1e88a0f88f568f6d9902929016d55f086c89d7e1acbc20c2b1e083518a694d00965a6f2fc0447ea30ee491cd58eedcfbc71e4547dd27b908019fa6211df5412d2f4cfd28ade08aad22b456658e86548f934329de394678a33023bacdf07d1357c05dd2836b484cc4ab9f805a5b3abdc9a7223f8027335b0eb78a0c5d073708cb6cd27a47224435c5cccc2e8edd2aedb77d660d5f615122551be346e3e33dd035629adbaf14c85ba1cc891be13026fca09b1f81a7471f04eba33992069f99d3bfd3ea4f509c19fe96871e3c65f6a31824838610e7543ea83a76244f8121c5e30f02f893944720bbfed40ed368b9ddc47a8482e3535479dddb9cd2f2079b2eb6bc3eed856def2511f2971a4261f74a97e88bb11007fa6581b2a239cff73cff18fbc6f15a8b59e202ac7b92d04e144f5945f60c5e285fb0e83f45cfcfaf9b6ffb84d3775a956fac94849eeebcc04a8f4a93f84421e2314561504e10d8e3357c4c19b4de05bfa3069fc8b5cde41fd717060d7a9574550d681afc101b62649d6de095a0c39407570d14e6bd05fbb89fe6df8be2c6e77e96f653c58034502858f01250711730bae67863bcf4b2ad9b2bb2fee1398c5eba0b2094de7b83b8ffe3568db711e93b8cf2b1c15d9da40b4c2bd9b218f5b59f4b0203010001a3633061301d0603551d0e0416041452d8883ac89f7866ed89f37b387094c9020236d0300f0603551d130101ff040530030101ff301f0603551d2304183016801452d8883ac89f7866ed89f37b387094c9020236d0300e0603551d0f0101ff040403020106300d06092a864886f70d01010b050003820201000b7b7287c060a6494c8858e61d88f7146448a6d8580a0e4f1335df351dd4ed0631c8813e6ad5dd3b1a32ee903d11d22ef48ec3632e2366b067be6fb6c0133960aaa23425937552dea79dad0e878952716a163c191d83f89a2965bef43f9ad9f0f35a872171804dcbe0389b3fbbfae0304dcf86d365101918d19702b12b724268aca0bd4e5ada18bf6b9881d0fd9abe5e1548cd1115b9c0295cb4e888f73e36aeb762fd1e62de7078101c485bdabca438ba67ed553e5e57dfd403404c81a4d24f63a709420914fc00a9c280734f2ec040d9117b48ea7a02c0d3eb2801265874c1c073226d9395fd397dbb2ae3f682e32c975f4e1f9194fafe2ca3d8761ab84db2384f9bfa1d48607926e2f3fda9d09ae8708f497ad6e5bd0a0edb2df38dbfebe3a47dcbc79571e8daa37cc5c2f87492041b86aca4225340b6acfe4c76cffb9432c0359f763f6ee5906ea0a626a2b82cbed12b85fda768c8ba012bb16c741db87395e7eeb7c725f0004c00b27eb60b8b1cf3c0509e25b9e008de3666ff37a5d1bb54642cc927b54b927e65ffd32de1b94ebc7fa44121904177a6391fea9ee39fd0666f05ecaa767ebf6b16a0ebb5c7fc92542f2b11272537784c516ab0f3cc585d14f16a4815ffc207b6b18d0f8e5c5046b33dbf01984fb25954473e347b786d56932e73ea662878cd1d14bfa08f2f2eb82e8ef2148acce9b57cfb6c9d0ca5e196 59F0.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F373B387065A28848AF2F34ACE192BDDC78E9CAC\Blob = 190000000100000010000000147c50fda90d6498a51e241b0e84d362030000000100000014000000f373b387065a28848af2f34ace192bddc78e9cac1d000000010000001000000095b4475fef63caf7452d10faa6f6362b14000000010000001400000052d8883ac89f7866ed89f37b387094c9020236d0530000000100000020000000301e301c06062b811f01110130123010060a2b0601040182373c0101030200c062000000010000002000000055926084ec963a64b96e2abe01ce0ba86a64fbfebcc7aab5afc155b37fd76066090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b000000010000003e00000041006300740061006c00690073002000410075007400680065006e007400690063006100740069006f006e00200052006f006f00740020004300410000000f0000000100000020000000927824e958a132afbcadd9e12357a0f9788ab99c5669e1ec3825e1eb5f6f54542000000001000000bf050000308205bb308203a3a0030201020208570a119742c4e3cc300d06092a864886f70d01010b0500306b310b3009060355040613024954310e300c06035504070c054d696c616e31233021060355040a0c1a416374616c697320532e702e412e2f30333335383532303936373127302506035504030c1e416374616c69732041757468656e7469636174696f6e20526f6f74204341301e170d3131303932323131323230325a170d3330303932323131323230325a306b310b3009060355040613024954310e300c06035504070c054d696c616e31233021060355040a0c1a416374616c697320532e702e412e2f30333335383532303936373127302506035504030c1e416374616c69732041757468656e7469636174696f6e20526f6f7420434130820222300d06092a864886f70d01010105000382020f003082020a0282020100a7c6c4a529a42cefe518c5b050a36f513b9f0a5ac9c248380ac21ca0187f91b587b9403fdd1d681f0883d52d1e88a0f88f568f6d9902929016d55f086c89d7e1acbc20c2b1e083518a694d00965a6f2fc0447ea30ee491cd58eedcfbc71e4547dd27b908019fa6211df5412d2f4cfd28ade08aad22b456658e86548f934329de394678a33023bacdf07d1357c05dd2836b484cc4ab9f805a5b3abdc9a7223f8027335b0eb78a0c5d073708cb6cd27a47224435c5cccc2e8edd2aedb77d660d5f615122551be346e3e33dd035629adbaf14c85ba1cc891be13026fca09b1f81a7471f04eba33992069f99d3bfd3ea4f509c19fe96871e3c65f6a31824838610e7543ea83a76244f8121c5e30f02f893944720bbfed40ed368b9ddc47a8482e3535479dddb9cd2f2079b2eb6bc3eed856def2511f2971a4261f74a97e88bb11007fa6581b2a239cff73cff18fbc6f15a8b59e202ac7b92d04e144f5945f60c5e285fb0e83f45cfcfaf9b6ffb84d3775a956fac94849eeebcc04a8f4a93f84421e2314561504e10d8e3357c4c19b4de05bfa3069fc8b5cde41fd717060d7a9574550d681afc101b62649d6de095a0c39407570d14e6bd05fbb89fe6df8be2c6e77e96f653c58034502858f01250711730bae67863bcf4b2ad9b2bb2fee1398c5eba0b2094de7b83b8ffe3568db711e93b8cf2b1c15d9da40b4c2bd9b218f5b59f4b0203010001a3633061301d0603551d0e0416041452d8883ac89f7866ed89f37b387094c9020236d0300f0603551d130101ff040530030101ff301f0603551d2304183016801452d8883ac89f7866ed89f37b387094c9020236d0300e0603551d0f0101ff040403020106300d06092a864886f70d01010b050003820201000b7b7287c060a6494c8858e61d88f7146448a6d8580a0e4f1335df351dd4ed0631c8813e6ad5dd3b1a32ee903d11d22ef48ec3632e2366b067be6fb6c0133960aaa23425937552dea79dad0e878952716a163c191d83f89a2965bef43f9ad9f0f35a872171804dcbe0389b3fbbfae0304dcf86d365101918d19702b12b724268aca0bd4e5ada18bf6b9881d0fd9abe5e1548cd1115b9c0295cb4e888f73e36aeb762fd1e62de7078101c485bdabca438ba67ed553e5e57dfd403404c81a4d24f63a709420914fc00a9c280734f2ec040d9117b48ea7a02c0d3eb2801265874c1c073226d9395fd397dbb2ae3f682e32c975f4e1f9194fafe2ca3d8761ab84db2384f9bfa1d48607926e2f3fda9d09ae8708f497ad6e5bd0a0edb2df38dbfebe3a47dcbc79571e8daa37cc5c2f87492041b86aca4225340b6acfe4c76cffb9432c0359f763f6ee5906ea0a626a2b82cbed12b85fda768c8ba012bb16c741db87395e7eeb7c725f0004c00b27eb60b8b1cf3c0509e25b9e008de3666ff37a5d1bb54642cc927b54b927e65ffd32de1b94ebc7fa44121904177a6391fea9ee39fd0666f05ecaa767ebf6b16a0ebb5c7fc92542f2b11272537784c516ab0f3cc585d14f16a4815ffc207b6b18d0f8e5c5046b33dbf01984fb25954473e347b786d56932e73ea662878cd1d14bfa08f2f2eb82e8ef2148acce9b57cfb6c9d0ca5e196 59F0.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4772 235920237c07cb8decfa53e9c92d72e6.exe 4772 235920237c07cb8decfa53e9c92d72e6.exe 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2484 Process not Found - Suspicious behavior: MapViewOfSection 19 IoCs
pid Process 4772 235920237c07cb8decfa53e9c92d72e6.exe 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found 2484 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2484 Process not Found Token: SeCreatePagefilePrivilege 2484 Process not Found Token: SeShutdownPrivilege 2484 Process not Found Token: SeCreatePagefilePrivilege 2484 Process not Found Token: SeShutdownPrivilege 2484 Process not Found Token: SeCreatePagefilePrivilege 2484 Process not Found Token: SeShutdownPrivilege 2484 Process not Found Token: SeCreatePagefilePrivilege 2484 Process not Found Token: SeShutdownPrivilege 2484 Process not Found Token: SeCreatePagefilePrivilege 2484 Process not Found Token: SeShutdownPrivilege 2484 Process not Found Token: SeCreatePagefilePrivilege 2484 Process not Found Token: SeShutdownPrivilege 2484 Process not Found Token: SeCreatePagefilePrivilege 2484 Process not Found Token: SeShutdownPrivilege 2484 Process not Found Token: SeCreatePagefilePrivilege 2484 Process not Found Token: SeShutdownPrivilege 2484 Process not Found Token: SeCreatePagefilePrivilege 2484 Process not Found Token: SeShutdownPrivilege 2484 Process not Found Token: SeCreatePagefilePrivilege 2484 Process not Found Token: SeShutdownPrivilege 2484 Process not Found Token: SeCreatePagefilePrivilege 2484 Process not Found Token: SeShutdownPrivilege 2484 Process not Found Token: SeCreatePagefilePrivilege 2484 Process not Found Token: SeShutdownPrivilege 2484 Process not Found Token: SeCreatePagefilePrivilege 2484 Process not Found Token: SeShutdownPrivilege 2484 Process not Found Token: SeCreatePagefilePrivilege 2484 Process not Found Token: SeShutdownPrivilege 2484 Process not Found Token: SeCreatePagefilePrivilege 2484 Process not Found Token: SeIncreaseQuotaPrivilege 2448 WMIC.exe Token: SeSecurityPrivilege 2448 WMIC.exe Token: SeTakeOwnershipPrivilege 2448 WMIC.exe Token: SeLoadDriverPrivilege 2448 WMIC.exe Token: SeSystemProfilePrivilege 2448 WMIC.exe Token: SeSystemtimePrivilege 2448 WMIC.exe Token: SeProfSingleProcessPrivilege 2448 WMIC.exe Token: SeIncBasePriorityPrivilege 2448 WMIC.exe Token: SeCreatePagefilePrivilege 2448 WMIC.exe Token: SeBackupPrivilege 2448 WMIC.exe Token: SeRestorePrivilege 2448 WMIC.exe Token: SeShutdownPrivilege 2448 WMIC.exe Token: SeDebugPrivilege 2448 WMIC.exe Token: SeSystemEnvironmentPrivilege 2448 WMIC.exe Token: SeRemoteShutdownPrivilege 2448 WMIC.exe Token: SeUndockPrivilege 2448 WMIC.exe Token: SeManageVolumePrivilege 2448 WMIC.exe Token: 33 2448 WMIC.exe Token: 34 2448 WMIC.exe Token: 35 2448 WMIC.exe Token: 36 2448 WMIC.exe Token: SeIncreaseQuotaPrivilege 2448 WMIC.exe Token: SeSecurityPrivilege 2448 WMIC.exe Token: SeTakeOwnershipPrivilege 2448 WMIC.exe Token: SeLoadDriverPrivilege 2448 WMIC.exe Token: SeSystemProfilePrivilege 2448 WMIC.exe Token: SeSystemtimePrivilege 2448 WMIC.exe Token: SeProfSingleProcessPrivilege 2448 WMIC.exe Token: SeIncBasePriorityPrivilege 2448 WMIC.exe Token: SeCreatePagefilePrivilege 2448 WMIC.exe Token: SeBackupPrivilege 2448 WMIC.exe Token: SeRestorePrivilege 2448 WMIC.exe Token: SeShutdownPrivilege 2448 WMIC.exe Token: SeDebugPrivilege 2448 WMIC.exe - Suspicious use of WriteProcessMemory 51 IoCs
description pid Process procid_target PID 2484 wrote to memory of 4740 2484 Process not Found 81 PID 2484 wrote to memory of 4740 2484 Process not Found 81 PID 2484 wrote to memory of 4740 2484 Process not Found 81 PID 2484 wrote to memory of 4272 2484 Process not Found 84 PID 2484 wrote to memory of 4272 2484 Process not Found 84 PID 2484 wrote to memory of 4272 2484 Process not Found 84 PID 4740 wrote to memory of 3092 4740 15EF.exe 87 PID 4740 wrote to memory of 3092 4740 15EF.exe 87 PID 4740 wrote to memory of 3092 4740 15EF.exe 87 PID 2484 wrote to memory of 1064 2484 Process not Found 90 PID 2484 wrote to memory of 1064 2484 Process not Found 90 PID 2484 wrote to memory of 1064 2484 Process not Found 90 PID 2484 wrote to memory of 3948 2484 Process not Found 91 PID 2484 wrote to memory of 3948 2484 Process not Found 91 PID 2484 wrote to memory of 3948 2484 Process not Found 91 PID 2484 wrote to memory of 3948 2484 Process not Found 91 PID 2484 wrote to memory of 4656 2484 Process not Found 92 PID 2484 wrote to memory of 4656 2484 Process not Found 92 PID 2484 wrote to memory of 4656 2484 Process not Found 92 PID 2484 wrote to memory of 1732 2484 Process not Found 94 PID 2484 wrote to memory of 1732 2484 Process not Found 94 PID 2484 wrote to memory of 1732 2484 Process not Found 94 PID 2484 wrote to memory of 1732 2484 Process not Found 94 PID 2484 wrote to memory of 4540 2484 Process not Found 95 PID 2484 wrote to memory of 4540 2484 Process not Found 95 PID 2484 wrote to memory of 4540 2484 Process not Found 95 PID 2484 wrote to memory of 900 2484 Process not Found 97 PID 2484 wrote to memory of 900 2484 Process not Found 97 PID 2484 wrote to memory of 900 2484 Process not Found 97 PID 2484 wrote to memory of 900 2484 Process not Found 97 PID 1064 wrote to memory of 2064 1064 59F0.exe 98 PID 1064 wrote to memory of 2064 1064 59F0.exe 98 PID 1064 wrote to memory of 2064 1064 59F0.exe 98 PID 2484 wrote to memory of 4544 2484 Process not Found 100 PID 2484 wrote to memory of 4544 2484 Process not Found 100 PID 2484 wrote to memory of 4544 2484 Process not Found 100 PID 2484 wrote to memory of 4544 2484 Process not Found 100 PID 2064 wrote to memory of 2448 2064 cmd.exe 102 PID 2064 wrote to memory of 2448 2064 cmd.exe 102 PID 2064 wrote to memory of 2448 2064 cmd.exe 102 PID 2484 wrote to memory of 4012 2484 Process not Found 103 PID 2484 wrote to memory of 4012 2484 Process not Found 103 PID 2484 wrote to memory of 4012 2484 Process not Found 103 PID 2484 wrote to memory of 4012 2484 Process not Found 103 PID 2484 wrote to memory of 4668 2484 Process not Found 104 PID 2484 wrote to memory of 4668 2484 Process not Found 104 PID 2484 wrote to memory of 4668 2484 Process not Found 104 PID 2484 wrote to memory of 3280 2484 Process not Found 105 PID 2484 wrote to memory of 3280 2484 Process not Found 105 PID 2484 wrote to memory of 3280 2484 Process not Found 105 PID 2484 wrote to memory of 3280 2484 Process not Found 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\235920237c07cb8decfa53e9c92d72e6.exe"C:\Users\Admin\AppData\Local\Temp\235920237c07cb8decfa53e9c92d72e6.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4772
-
C:\Users\Admin\AppData\Local\Temp\15EF.exeC:\Users\Admin\AppData\Local\Temp\15EF.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"2⤵
- Executes dropped EXE
PID:3092
-
-
C:\Users\Admin\AppData\Local\Temp\3B99.exeC:\Users\Admin\AppData\Local\Temp\3B99.exe1⤵
- Executes dropped EXE
PID:4272
-
C:\Users\Admin\AppData\Local\Temp\59F0.exeC:\Users\Admin\AppData\Local\Temp\59F0.exe1⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2448
-
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3948
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4656
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1732
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4540
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:900
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4544
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4012
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4668
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3280
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\15EF.exe
- Size 466KB
- SHA256 3238f627cf753b195a814ad7a01bd16fa13616802e39f48a981c5c8703a2ff6f
- MD5 2955a7fdcda8c0768d106b135a352173
- SHA1 1de1f74183421d4f811af2dc469840c8d266eec9
- SHA512 c87bf10bc4eaaa912a74da441c3a3894535e54764e60a76c505c628e70e35822fcbe147aaabd117ddacbc88294ad16243c7f721400ac64178681633db8898bbb
- SSDEEP 12288:JcrNS33L10QdrXZT+tcWnv7E+CiOQF0V8eeZ4w3SV:0NA3R5drX/WTjjbF0V8VSV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\15EF.exe
- Size 466KB
- SHA256 3238f627cf753b195a814ad7a01bd16fa13616802e39f48a981c5c8703a2ff6f
- MD5 2955a7fdcda8c0768d106b135a352173
- SHA1 1de1f74183421d4f811af2dc469840c8d266eec9
- SHA512 c87bf10bc4eaaa912a74da441c3a3894535e54764e60a76c505c628e70e35822fcbe147aaabd117ddacbc88294ad16243c7f721400ac64178681633db8898bbb
- SSDEEP 12288:JcrNS33L10QdrXZT+tcWnv7E+CiOQF0V8eeZ4w3SV:0NA3R5drX/WTjjbF0V8VSV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\3B99.exe
- Size 315KB
- SHA256 6398a682b929077fa895ca80e77f5ada30103387b76cb0021712e33ab8122dde
- MD5 6b6cf541f7e8d8a4973afb7f212c9ddc
- SHA1 a7f1a3671295ce9016edf7f660c23f3ecf890e79
- SHA512 e3faa66f1feb93129e56937a0e232728ece6a1f17e36b8dd8baef94e4279e6f3cce00304711a64b2f8b74314699c2943de3ccd49a709f45d0934749b78485791
- SSDEEP 6144:lHKu6pyZPCtT0ICidHvnkJF3PwjW5AOJLN5mY8y7WXU8s4u6qSaATdnr887:YuI2PCtwICidPOnLNIY17WXU8s4DqRA7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\3B99.exe
- Size 315KB
- SHA256 6398a682b929077fa895ca80e77f5ada30103387b76cb0021712e33ab8122dde
- MD5 6b6cf541f7e8d8a4973afb7f212c9ddc
- SHA1 a7f1a3671295ce9016edf7f660c23f3ecf890e79
- SHA512 e3faa66f1feb93129e56937a0e232728ece6a1f17e36b8dd8baef94e4279e6f3cce00304711a64b2f8b74314699c2943de3ccd49a709f45d0934749b78485791
- SSDEEP 6144:lHKu6pyZPCtT0ICidHvnkJF3PwjW5AOJLN5mY8y7WXU8s4u6qSaATdnr887:YuI2PCtwICidPOnLNIY17WXU8s4DqRA7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\59F0.exe
- Size 4.3MB
- SHA256 ed14ed57c0a785e01024deffe5a05a79ed9d61a21c58ea8be136c79d31e2daa6
- MD5 06a1dc7aae769814998f99c0bca5ea41
- SHA1 81ea40089386bffadd0e0a6bb780b7ddd4dc71a9
- SHA512 aa4a4f8cfe7d7e68c6751e518763cbc509a7ba31699dc7541104170af1a19b439e9ae687d92c8b09450088317e58b5fc78b921646ddba0a28b1f080b7190f65b
- SSDEEP 49152:ctIRXyLObIrw7pLv1jcev/iCwiiR2h+B3OmB0TW6qcAb7/i:c+XIObGwNLtjcoGB/i
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\59F0.exe
- Size 4.3MB
- SHA256 ed14ed57c0a785e01024deffe5a05a79ed9d61a21c58ea8be136c79d31e2daa6
- MD5 06a1dc7aae769814998f99c0bca5ea41
- SHA1 81ea40089386bffadd0e0a6bb780b7ddd4dc71a9
- SHA512 aa4a4f8cfe7d7e68c6751e518763cbc509a7ba31699dc7541104170af1a19b439e9ae687d92c8b09450088317e58b5fc78b921646ddba0a28b1f080b7190f65b
- SSDEEP 49152:ctIRXyLObIrw7pLv1jcev/iCwiiR2h+B3OmB0TW6qcAb7/i:c+XIObGwNLtjcoGB/i
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\1.exe
- Size 369KB
- SHA256 61059bd8f3bdb2b07ca01c87efe6284b8b3b77ca63e9a063e0e9010774a482a4
- MD5 4a32a16c5a3c79ade487c098ee71a2be
- SHA1 414b203eeb20ac7e74316fd2877ca4ebf52193df
- SHA512 6470c0269052bbccea48bfb5da80cdcf96fec71e0e45ae79a42acacd7c4d92139ccc6f122ab97e5b104fc93bee84891850a80aa9c835c0b31418f151517b1ee5
- SSDEEP 6144:pUPiPsF0WZlbCH5Wreqe3/Edq6XYAOR0BOi+ieaYNBtGNyE04g0Kzh4OcWy+W4Dw:pUa0F0WZlbCHwg+XY3HVyWI2SXw1hvb8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\1.exe
- Size 369KB
- SHA256 61059bd8f3bdb2b07ca01c87efe6284b8b3b77ca63e9a063e0e9010774a482a4
- MD5 4a32a16c5a3c79ade487c098ee71a2be
- SHA1 414b203eeb20ac7e74316fd2877ca4ebf52193df
- SHA512 6470c0269052bbccea48bfb5da80cdcf96fec71e0e45ae79a42acacd7c4d92139ccc6f122ab97e5b104fc93bee84891850a80aa9c835c0b31418f151517b1ee5
- SSDEEP 6144:pUPiPsF0WZlbCH5Wreqe3/Edq6XYAOR0BOi+ieaYNBtGNyE04g0Kzh4OcWy+W4Dw:pUa0F0WZlbCHwg+XY3HVyWI2SXw1hvb8
- MD5 SHA1 SHA512 SSDEEP