Analysis
-
max time kernel
120s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04/10/2022, 05:36
Static task
static1
Behavioral task
behavioral1
Sample
02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe
Resource
win7-20220812-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe
-
Size
965KB
-
MD5
549c785be5f331099bb88475d75ae1c0
-
SHA1
2e8b701cc9f0c1deb57d7599098c740695758e11
-
SHA256
02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3
-
SHA512
f8ff86427974a0c17eb76c6e57d4badeddabcc935a9eedfcedbd8eccd6d38e8b923797e66eb4dded411b5d72f5a99c2a96df0b0550ad318636e6a598d08f6fb0
-
SSDEEP
12288:rj9l69ZU++3jUOIcr1MFNXJM44qwjxIZhKp1NplhifHW8NUnVuSIW5EykhXG5w:rDsOIcrMXP/wlIZha798NUnVPE05w
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe smrss.exe" 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe -
Executes dropped EXE 1 IoCs
pid Process 1560 12142.exe -
Loads dropped DLL 2 IoCs
pid Process 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\WINDOWS\\system32\\svchost.exe" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\freizer = "C:\\WINDOWS\\system32\\freizer.exe" reg.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\WINDOWS\SysWOW64\freizer.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File created C:\Windows\SysWOW64\smrss.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Windows\SysWOW64\smrss.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateOnDemand.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\Java\jre7\bin\ssvagent.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\Windows Media Player\WMPSideShowGadget.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\vsta_ep32.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\7-Zip\7z.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\Hearts.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdate.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleCrashHandler64.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\WINDOWS\svchost.exe 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1116 wrote to memory of 2044 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 26 PID 1116 wrote to memory of 2044 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 26 PID 1116 wrote to memory of 2044 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 26 PID 1116 wrote to memory of 2044 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 26 PID 1116 wrote to memory of 1988 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 28 PID 1116 wrote to memory of 1988 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 28 PID 1116 wrote to memory of 1988 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 28 PID 1116 wrote to memory of 1988 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 28 PID 2044 wrote to memory of 1632 2044 cmd.exe 31 PID 2044 wrote to memory of 1632 2044 cmd.exe 31 PID 2044 wrote to memory of 1632 2044 cmd.exe 31 PID 2044 wrote to memory of 1632 2044 cmd.exe 31 PID 1988 wrote to memory of 1628 1988 cmd.exe 30 PID 1988 wrote to memory of 1628 1988 cmd.exe 30 PID 1988 wrote to memory of 1628 1988 cmd.exe 30 PID 1988 wrote to memory of 1628 1988 cmd.exe 30 PID 1116 wrote to memory of 1560 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 32 PID 1116 wrote to memory of 1560 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 32 PID 1116 wrote to memory of 1560 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 32 PID 1116 wrote to memory of 1560 1116 02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe"C:\Users\Admin\AppData\Local\Temp\02042e0dd1a0a9a0f1975c89a8a28a353b5ae8a09710c2b40c3acc5b919171e3.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\SysWOW64\cmd.execmd /c reg ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v freizer /t REG_SZ /d C:\WINDOWS\system32\freizer.exe /f2⤵
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\reg.exereg ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v freizer /t REG_SZ /d C:\WINDOWS\system32\freizer.exe /f3⤵
- Adds Run key to start application
PID:1632
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c reg ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v svchost /t REG_SZ /d C:\WINDOWS\system32\svchost.exe /f2⤵
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\reg.exereg ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v svchost /t REG_SZ /d C:\WINDOWS\system32\svchost.exe /f3⤵
- Adds Run key to start application
PID:1628
-
-
-
C:\windows\temp\12142.exe"C:\windows\temp\12142.exe"2⤵
- Executes dropped EXE
PID:1560
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184KB
MD5a8ef50ede1254a4d946de85b34aadb55
SHA121303951331992e4933622ae43f0c86d8f162a85
SHA2565b1640fcd03919113e7d702de7ad3b40810880803e9f9b14717d24617b57f8ee
SHA512fab6c11c3f6d0179cd37d74218fb3b52195e0d1ecdf55ae4c44fc45969315d1d26dcb6e4e45e353254d4083ca6ffaffe5c3bfaf0f789d782bf75848da2856980
-
Filesize
184KB
MD5a8ef50ede1254a4d946de85b34aadb55
SHA121303951331992e4933622ae43f0c86d8f162a85
SHA2565b1640fcd03919113e7d702de7ad3b40810880803e9f9b14717d24617b57f8ee
SHA512fab6c11c3f6d0179cd37d74218fb3b52195e0d1ecdf55ae4c44fc45969315d1d26dcb6e4e45e353254d4083ca6ffaffe5c3bfaf0f789d782bf75848da2856980
-
Filesize
184KB
MD5a8ef50ede1254a4d946de85b34aadb55
SHA121303951331992e4933622ae43f0c86d8f162a85
SHA2565b1640fcd03919113e7d702de7ad3b40810880803e9f9b14717d24617b57f8ee
SHA512fab6c11c3f6d0179cd37d74218fb3b52195e0d1ecdf55ae4c44fc45969315d1d26dcb6e4e45e353254d4083ca6ffaffe5c3bfaf0f789d782bf75848da2856980