Analysis
-
max time kernel
109s -
max time network
169s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04-10-2022 03:17
Static task
static1
Behavioral task
behavioral1
Sample
da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe
Resource
win7-20220812-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe
-
Size
206KB
-
MD5
33e6bb33eec6c2164bf159e828b66965
-
SHA1
a8d6d15d2675fc511dabdd0380cbc8b248c75688
-
SHA256
da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337
-
SHA512
ac5f234e7098bfd280e91a6e796f4267e5e6dcb210f4593b69e63bce9908ba074a8114a068fe32b24f101b2931d1db78dc4a0a9f8ea6c9242e0a8581be25ed7c
-
SSDEEP
3072:p9xbvI3tMJKDJDu2WE7ZG1SnkOT94qxkuM70bnSs5SU28+NRybbNmK20RDRu3D:p9xUtVDBu2NZG1qFiqZz35SxqpmKvuT
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 18 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\GloballyOpenPorts services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\AuthorizedApplications services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static\System services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static services.exe -
Modifies security service 2 TTPs 22 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Security da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\TriggerInfo da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\ErrorControl = "0" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Type = "32" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Start = "4" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\DeleteFlag = "1" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\IPTLSOut services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Security services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Parameters da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Type = "32" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\DeleteFlag = "1" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Security services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\RPC-EPMap services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Parameters services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\IPTLSIn services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\Teredo services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\TriggerInfo\0 da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\ErrorControl = "0" services.exe -
Executes dropped EXE 2 IoCs
pid Process 1384 Explorer.EXE 464 services.exe -
Registers COM server for autorun 1 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ThreadingModel = "Both" da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-21-3845472200-3839195424-595303356-1000\\$bb8ab67ad8382496fd4eead6952e3208\\n." da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-18\\$bb8ab67ad8382496fd4eead6952e3208\\n." da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe -
Unexpected DNS network traffic destination 9 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 194.165.17.3 Destination IP 194.165.17.3 Destination IP 194.165.17.3 Destination IP 194.165.17.3 Destination IP 194.165.17.3 Destination IP 194.165.17.3 Destination IP 194.165.17.3 Destination IP 194.165.17.3 Destination IP 194.165.17.3 -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1692 set thread context of 1640 1692 da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe 28 PID 1692 set thread context of 1640 1692 da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe 28 PID 1692 set thread context of 1640 1692 da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe 28 -
Drops file in Program Files directory 18 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Defender\MpClient.dll:! da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe File opened for modification C:\Program Files\Windows Defender\MpEvMsg.dll:! da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe File opened for modification C:\Program Files\Windows Defender\MpSvc.dll:! da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe File opened for modification C:\Program Files\Windows Defender\de-DE:! da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe File opened for modification C:\Program Files\Windows Defender\en-US:! da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe File opened for modification C:\Program Files\Windows Defender\es-ES:! da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe File opened for modification C:\Program Files\Windows Defender\MpCommu.dll:! da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe File opened for modification C:\Program Files\Windows Defender\MsMpCom.dll:! da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe File opened for modification C:\Program Files\Windows Defender\MpOAV.dll:! da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe File opened for modification C:\Program Files\Windows Defender\MsMpLics.dll:! da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe File opened for modification C:\Program Files\Windows Defender\fr-FR:! da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe File opened for modification C:\Program Files\Windows Defender\it-IT:! da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe File opened for modification C:\Program Files\Windows Defender\ja-JP:! da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe File opened for modification C:\Program Files\Windows Defender\MpAsDesc.dll:! da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe:! da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe File opened for modification C:\Program Files\Windows Defender\MpRTP.dll:! da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe:! da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe File opened for modification C:\Program Files\Windows Defender\MsMpRes.dll:! da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\clsid da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9} da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ThreadingModel = "Both" da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-21-3845472200-3839195424-595303356-1000\\$bb8ab67ad8382496fd4eead6952e3208\\n." da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-18\\$bb8ab67ad8382496fd4eead6952e3208\\n." da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe -
NTFS ADS 18 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Defender\de-DE:! da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe File opened for modification C:\Program Files\Windows Defender\MsMpLics.dll:! da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe File opened for modification C:\Program Files\Windows Defender\MpAsDesc.dll:! da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe File opened for modification C:\Program Files\Windows Defender\MpSvc.dll:! da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe:! da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe File opened for modification C:\Program Files\Windows Defender\es-ES:! da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe File opened for modification C:\Program Files\Windows Defender\it-IT:! da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe File opened for modification C:\Program Files\Windows Defender\ja-JP:! da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe File opened for modification C:\Program Files\Windows Defender\MpClient.dll:! da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe File opened for modification C:\Program Files\Windows Defender\MpOAV.dll:! da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe File opened for modification C:\Program Files\Windows Defender\MpRTP.dll:! da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe File opened for modification C:\Program Files\Windows Defender\MsMpCom.dll:! da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe File opened for modification C:\Program Files\Windows Defender\MsMpRes.dll:! da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe File opened for modification C:\Program Files\Windows Defender\en-US:! da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe File opened for modification C:\Program Files\Windows Defender\fr-FR:! da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe:! da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe File opened for modification C:\Program Files\Windows Defender\MpCommu.dll:! da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe File opened for modification C:\Program Files\Windows Defender\MpEvMsg.dll:! da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1640 da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe 1640 da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe 1640 da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe 1640 da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe 1640 da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe 1640 da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1692 da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1640 da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeDebugPrivilege 1640 da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe Token: SeDebugPrivilege 1640 da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe Token: SeDebugPrivilege 1640 da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe Token: SeBackupPrivilege 464 services.exe Token: SeRestorePrivilege 464 services.exe Token: SeSecurityPrivilege 464 services.exe Token: SeTakeOwnershipPrivilege 464 services.exe Token: SeBackupPrivilege 464 services.exe Token: SeRestorePrivilege 464 services.exe Token: SeSecurityPrivilege 464 services.exe Token: SeTakeOwnershipPrivilege 464 services.exe Token: SeBackupPrivilege 464 services.exe Token: SeRestorePrivilege 464 services.exe Token: SeSecurityPrivilege 464 services.exe Token: SeTakeOwnershipPrivilege 464 services.exe Token: SeBackupPrivilege 464 services.exe Token: SeRestorePrivilege 464 services.exe Token: SeSecurityPrivilege 464 services.exe Token: SeTakeOwnershipPrivilege 464 services.exe Token: SeBackupPrivilege 464 services.exe Token: SeRestorePrivilege 464 services.exe Token: SeSecurityPrivilege 464 services.exe Token: SeTakeOwnershipPrivilege 464 services.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1384 Explorer.EXE 1384 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1384 Explorer.EXE 1384 Explorer.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1692 wrote to memory of 1640 1692 da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe 28 PID 1692 wrote to memory of 1640 1692 da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe 28 PID 1692 wrote to memory of 1640 1692 da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe 28 PID 1692 wrote to memory of 1640 1692 da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe 28 PID 1640 wrote to memory of 1384 1640 da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe 16 PID 1640 wrote to memory of 1384 1640 da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe 16 PID 1640 wrote to memory of 464 1640 da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe 2
Processes
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
- Modifies firewall policy service
- Modifies security service
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:464
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe"C:\Users\Admin\AppData\Local\Temp\da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe"C:\Users\Admin\AppData\Local\Temp\da9ee958ba0d0a5df96fe09b4a71e6226919e538ae1d477b5ce53ff39324e337.exe"3⤵
- Modifies security service
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1640
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5fe12a5ce6727a51281f447ad8fb0f46b
SHA107451f622dedde0d50079f893d9da3f436a9baff
SHA256bf095ecc9cd1ba4d99b6e4e3bbca01013524fcbcfdff25205e7faacc2898262d
SHA512e371d7cab925fe0b234434d8c68d397a7bcb2f16cda76c81afcfa0bf2be8b62565717202f3d021dd8281596107694d5e8d4827388a1815073d9ea58b62432bcc
-
Filesize
25KB
MD59e0cd37b6d0809cf7d5fa5b521538d0d
SHA1411ffdbe6c151dbd417bc59fa9dfec22b0adc9f2
SHA25655d9748f0556576a8d522cf4b8dcfc9717436adcc487d49b3320770432960db2
SHA512b511ee744dbe6cf0f54cb840d3786e89161115d0038425dde86d57752f76cae7a05f020120b43dc1444bd914c8c1690049e456635cc794fbf90e26794587dfc5
-
Filesize
25KB
MD59e0cd37b6d0809cf7d5fa5b521538d0d
SHA1411ffdbe6c151dbd417bc59fa9dfec22b0adc9f2
SHA25655d9748f0556576a8d522cf4b8dcfc9717436adcc487d49b3320770432960db2
SHA512b511ee744dbe6cf0f54cb840d3786e89161115d0038425dde86d57752f76cae7a05f020120b43dc1444bd914c8c1690049e456635cc794fbf90e26794587dfc5
-
Filesize
25KB
MD59e0cd37b6d0809cf7d5fa5b521538d0d
SHA1411ffdbe6c151dbd417bc59fa9dfec22b0adc9f2
SHA25655d9748f0556576a8d522cf4b8dcfc9717436adcc487d49b3320770432960db2
SHA512b511ee744dbe6cf0f54cb840d3786e89161115d0038425dde86d57752f76cae7a05f020120b43dc1444bd914c8c1690049e456635cc794fbf90e26794587dfc5
-
Filesize
25KB
MD59e0cd37b6d0809cf7d5fa5b521538d0d
SHA1411ffdbe6c151dbd417bc59fa9dfec22b0adc9f2
SHA25655d9748f0556576a8d522cf4b8dcfc9717436adcc487d49b3320770432960db2
SHA512b511ee744dbe6cf0f54cb840d3786e89161115d0038425dde86d57752f76cae7a05f020120b43dc1444bd914c8c1690049e456635cc794fbf90e26794587dfc5