Analysis
-
max time kernel
152s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-10-2022 16:17
Behavioral task
behavioral1
Sample
0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe
Resource
win7-20220812-en
windows7-x64
16 signatures
150 seconds
General
-
Target
0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe
-
Size
477KB
-
MD5
34e4111287c0af6b8c72167016a1f9f0
-
SHA1
61b9719f5efd4fc88daee199b0adf8fd454058a3
-
SHA256
0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04
-
SHA512
56fc07a2db806b4907ed8bc2ad645c44b98722f0ce5c0eb14672acf8840475bb82253b6fbc9cae3c88f51e6e95469356d5423a3ab6a1ad729e9477ba974dc747
-
SSDEEP
12288:XwkHcpSHY7VSrfT2/czO3Hx+p7aPZcByrH1Ia2aRTiua:Xh8uYxSrDzwRmAZcB+H1Y
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\winlogon.exe" 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\winlogon.exe,C:\\Windows\\system32\\winlogon.exe" TUNATIC.EXE -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" explorer.exe -
Executes dropped EXE 1 IoCs
pid Process 1456 TUNATIC.EXE -
resource yara_rule behavioral2/memory/2876-132-0x0000000013140000-0x00000000132D2000-memory.dmp upx behavioral2/files/0x0007000000022e54-138.dat upx behavioral2/memory/2876-139-0x0000000013140000-0x00000000132D2000-memory.dmp upx behavioral2/memory/2100-141-0x0000000013140000-0x00000000132D2000-memory.dmp upx behavioral2/memory/2100-143-0x0000000013140000-0x00000000132D2000-memory.dmp upx behavioral2/memory/2100-144-0x0000000013140000-0x00000000132D2000-memory.dmp upx behavioral2/memory/2100-151-0x0000000013140000-0x00000000132D2000-memory.dmp upx behavioral2/memory/2876-152-0x0000000013140000-0x00000000132D2000-memory.dmp upx -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate TUNATIC.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate explorer.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation TUNATIC.EXE -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Windows\\system32\\winlogon.exe" TUNATIC.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Windows\\system32\\winlogon.exe" notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Windows\\system32\\winlogon.exe" 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Windows\\system32\\winlogon.exe" notepad.exe -
Drops file in System32 directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\winlogon.exe TUNATIC.EXE File opened for modification C:\Windows\SysWOW64\ TUNATIC.EXE File created C:\Windows\SysWOW64\winlogon.exe notepad.exe File created C:\Windows\SysWOW64\winlogon.exe 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe File opened for modification C:\Windows\SysWOW64\winlogon.exe 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe File opened for modification C:\Windows\SysWOW64\ 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe File created C:\Windows\SysWOW64\winlogon.exe notepad.exe File created C:\Windows\SysWOW64\winlogon.exe TUNATIC.EXE -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2876 set thread context of 2100 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe 86 PID 1456 set thread context of 2808 1456 TUNATIC.EXE 87 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 16 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier TUNATIC.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier TUNATIC.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TUNATIC.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString TUNATIC.EXE -
Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier TUNATIC.EXE -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ TUNATIC.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2100 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe Token: SeSecurityPrivilege 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe Token: SeTakeOwnershipPrivilege 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe Token: SeLoadDriverPrivilege 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe Token: SeSystemProfilePrivilege 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe Token: SeSystemtimePrivilege 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe Token: SeProfSingleProcessPrivilege 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe Token: SeIncBasePriorityPrivilege 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe Token: SeCreatePagefilePrivilege 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe Token: SeBackupPrivilege 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe Token: SeRestorePrivilege 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe Token: SeShutdownPrivilege 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe Token: SeDebugPrivilege 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe Token: SeSystemEnvironmentPrivilege 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe Token: SeChangeNotifyPrivilege 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe Token: SeRemoteShutdownPrivilege 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe Token: SeUndockPrivilege 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe Token: SeManageVolumePrivilege 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe Token: SeImpersonatePrivilege 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe Token: SeCreateGlobalPrivilege 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe Token: 33 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe Token: 34 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe Token: 35 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe Token: 36 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe Token: SeIncreaseQuotaPrivilege 1456 TUNATIC.EXE Token: SeSecurityPrivilege 1456 TUNATIC.EXE Token: SeTakeOwnershipPrivilege 1456 TUNATIC.EXE Token: SeLoadDriverPrivilege 1456 TUNATIC.EXE Token: SeSystemProfilePrivilege 1456 TUNATIC.EXE Token: SeSystemtimePrivilege 1456 TUNATIC.EXE Token: SeProfSingleProcessPrivilege 1456 TUNATIC.EXE Token: SeIncBasePriorityPrivilege 1456 TUNATIC.EXE Token: SeCreatePagefilePrivilege 1456 TUNATIC.EXE Token: SeBackupPrivilege 1456 TUNATIC.EXE Token: SeRestorePrivilege 1456 TUNATIC.EXE Token: SeShutdownPrivilege 1456 TUNATIC.EXE Token: SeDebugPrivilege 1456 TUNATIC.EXE Token: SeSystemEnvironmentPrivilege 1456 TUNATIC.EXE Token: SeChangeNotifyPrivilege 1456 TUNATIC.EXE Token: SeRemoteShutdownPrivilege 1456 TUNATIC.EXE Token: SeUndockPrivilege 1456 TUNATIC.EXE Token: SeManageVolumePrivilege 1456 TUNATIC.EXE Token: SeImpersonatePrivilege 1456 TUNATIC.EXE Token: SeCreateGlobalPrivilege 1456 TUNATIC.EXE Token: 33 1456 TUNATIC.EXE Token: 34 1456 TUNATIC.EXE Token: 35 1456 TUNATIC.EXE Token: 36 1456 TUNATIC.EXE Token: SeIncreaseQuotaPrivilege 2100 explorer.exe Token: SeSecurityPrivilege 2100 explorer.exe Token: SeTakeOwnershipPrivilege 2100 explorer.exe Token: SeLoadDriverPrivilege 2100 explorer.exe Token: SeSystemProfilePrivilege 2100 explorer.exe Token: SeSystemtimePrivilege 2100 explorer.exe Token: SeProfSingleProcessPrivilege 2100 explorer.exe Token: SeIncBasePriorityPrivilege 2100 explorer.exe Token: SeCreatePagefilePrivilege 2100 explorer.exe Token: SeBackupPrivilege 2100 explorer.exe Token: SeRestorePrivilege 2100 explorer.exe Token: SeShutdownPrivilege 2100 explorer.exe Token: SeDebugPrivilege 2100 explorer.exe Token: SeSystemEnvironmentPrivilege 2100 explorer.exe Token: SeChangeNotifyPrivilege 2100 explorer.exe Token: SeRemoteShutdownPrivilege 2100 explorer.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2100 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2876 wrote to memory of 4120 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe 83 PID 2876 wrote to memory of 4120 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe 83 PID 2876 wrote to memory of 4120 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe 83 PID 2876 wrote to memory of 4120 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe 83 PID 2876 wrote to memory of 4120 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe 83 PID 2876 wrote to memory of 4120 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe 83 PID 2876 wrote to memory of 4120 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe 83 PID 2876 wrote to memory of 4120 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe 83 PID 2876 wrote to memory of 4120 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe 83 PID 2876 wrote to memory of 4120 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe 83 PID 2876 wrote to memory of 4120 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe 83 PID 2876 wrote to memory of 4120 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe 83 PID 2876 wrote to memory of 4120 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe 83 PID 2876 wrote to memory of 4120 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe 83 PID 2876 wrote to memory of 4120 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe 83 PID 2876 wrote to memory of 4120 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe 83 PID 2876 wrote to memory of 4120 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe 83 PID 2876 wrote to memory of 4120 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe 83 PID 2876 wrote to memory of 4120 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe 83 PID 2876 wrote to memory of 4120 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe 83 PID 2876 wrote to memory of 4120 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe 83 PID 2876 wrote to memory of 4120 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe 83 PID 2876 wrote to memory of 4120 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe 83 PID 2876 wrote to memory of 1456 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe 84 PID 2876 wrote to memory of 1456 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe 84 PID 2876 wrote to memory of 1456 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe 84 PID 1456 wrote to memory of 628 1456 TUNATIC.EXE 85 PID 1456 wrote to memory of 628 1456 TUNATIC.EXE 85 PID 1456 wrote to memory of 628 1456 TUNATIC.EXE 85 PID 1456 wrote to memory of 628 1456 TUNATIC.EXE 85 PID 1456 wrote to memory of 628 1456 TUNATIC.EXE 85 PID 1456 wrote to memory of 628 1456 TUNATIC.EXE 85 PID 1456 wrote to memory of 628 1456 TUNATIC.EXE 85 PID 1456 wrote to memory of 628 1456 TUNATIC.EXE 85 PID 1456 wrote to memory of 628 1456 TUNATIC.EXE 85 PID 1456 wrote to memory of 628 1456 TUNATIC.EXE 85 PID 1456 wrote to memory of 628 1456 TUNATIC.EXE 85 PID 1456 wrote to memory of 628 1456 TUNATIC.EXE 85 PID 1456 wrote to memory of 628 1456 TUNATIC.EXE 85 PID 1456 wrote to memory of 628 1456 TUNATIC.EXE 85 PID 1456 wrote to memory of 628 1456 TUNATIC.EXE 85 PID 1456 wrote to memory of 628 1456 TUNATIC.EXE 85 PID 1456 wrote to memory of 628 1456 TUNATIC.EXE 85 PID 1456 wrote to memory of 628 1456 TUNATIC.EXE 85 PID 1456 wrote to memory of 628 1456 TUNATIC.EXE 85 PID 1456 wrote to memory of 628 1456 TUNATIC.EXE 85 PID 1456 wrote to memory of 628 1456 TUNATIC.EXE 85 PID 1456 wrote to memory of 628 1456 TUNATIC.EXE 85 PID 1456 wrote to memory of 628 1456 TUNATIC.EXE 85 PID 2876 wrote to memory of 2100 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe 86 PID 2876 wrote to memory of 2100 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe 86 PID 2876 wrote to memory of 2100 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe 86 PID 2876 wrote to memory of 2100 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe 86 PID 2876 wrote to memory of 2100 2876 0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe 86 PID 1456 wrote to memory of 2808 1456 TUNATIC.EXE 87 PID 1456 wrote to memory of 2808 1456 TUNATIC.EXE 87 PID 1456 wrote to memory of 2808 1456 TUNATIC.EXE 87 PID 1456 wrote to memory of 2808 1456 TUNATIC.EXE 87 PID 1456 wrote to memory of 2808 1456 TUNATIC.EXE 87 PID 2100 wrote to memory of 2764 2100 explorer.exe 88 PID 2100 wrote to memory of 2764 2100 explorer.exe 88 PID 2100 wrote to memory of 2764 2100 explorer.exe 88 PID 2100 wrote to memory of 2764 2100 explorer.exe 88 PID 2100 wrote to memory of 2764 2100 explorer.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe"C:\Users\Admin\AppData\Local\Temp\0fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04.exe"1⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:4120
-
-
C:\Users\Admin\AppData\Local\Temp\TUNATIC.EXE"C:\Users\Admin\AppData\Local\Temp\TUNATIC.EXE"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks BIOS information in registry
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:628
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"3⤵
- Windows security bypass
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
PID:2808
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Windows security bypass
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\SysWOW64\notepad.exeC:\Windows\SysWOW64\notepad.exe3⤵PID:2764
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
659KB
MD56dfc5ab3bb5702b5c59500d3750d81c1
SHA1aac989b2f6b2be811e818d0e8a3201a0e25e55c5
SHA2568c5ba747805bf8cc41958b7e0d69b11355980de344743701803eabec7349317c
SHA51297749ddc6b231ddefad7fb329ef4af3e2f2b02af73a5aee1a3d555af834343c6462c53295b3fdc3122e82d1cd40c2d0cef09f61ea89ebd39fc61bd0822e30d71
-
Filesize
659KB
MD56dfc5ab3bb5702b5c59500d3750d81c1
SHA1aac989b2f6b2be811e818d0e8a3201a0e25e55c5
SHA2568c5ba747805bf8cc41958b7e0d69b11355980de344743701803eabec7349317c
SHA51297749ddc6b231ddefad7fb329ef4af3e2f2b02af73a5aee1a3d555af834343c6462c53295b3fdc3122e82d1cd40c2d0cef09f61ea89ebd39fc61bd0822e30d71
-
Filesize
477KB
MD534e4111287c0af6b8c72167016a1f9f0
SHA161b9719f5efd4fc88daee199b0adf8fd454058a3
SHA2560fc3af1121b633c79be228f58cc004062a3188ef2e8e6db1851d7494f7d7de04
SHA51256fc07a2db806b4907ed8bc2ad645c44b98722f0ce5c0eb14672acf8840475bb82253b6fbc9cae3c88f51e6e95469356d5423a3ab6a1ad729e9477ba974dc747