Analysis
-
max time kernel
106s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11/10/2022, 22:49
Static task
static1
Behavioral task
behavioral1
Sample
4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe
-
Size
775KB
-
MD5
4d1fb0eb9f401a7f43572197d12e29a0
-
SHA1
b4c0814f552fe5d88a249fdc808925c37cb19e0c
-
SHA256
4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69
-
SHA512
f584ab9c21734bfe25a559bb98ac048bf8b0ba910e59c186ff6c79825482a2b91a299afa65f409f2bb28440e26489123a4271cdc897bc91eab242e557fe04f3f
-
SSDEEP
12288:HXZKu9TygrJ9YQ1DNIZmzIbwUB/qsgIsqA:HXZJRimzIbwu/qsgI1A
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe smrss.exe" 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe -
Executes dropped EXE 1 IoCs
pid Process 1348 22040.exe -
Loads dropped DLL 1 IoCs
pid Process 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\smrss.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Windows\SysWOW64\smrss.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\mip.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Windows Media Player\WMPSideShowGadget.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateBroker.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateSetup.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\chrome_installer.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleCrashHandler64.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdate.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2036 wrote to memory of 1348 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 26 PID 2036 wrote to memory of 1348 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 26 PID 2036 wrote to memory of 1348 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 26 PID 2036 wrote to memory of 1348 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 26 PID 2036 wrote to memory of 1348 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 26 PID 2036 wrote to memory of 1348 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 26 PID 2036 wrote to memory of 1348 2036 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe"C:\Users\Admin\AppData\Local\Temp\4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\windows\temp\22040.exe"C:\windows\temp\22040.exe"2⤵
- Executes dropped EXE
PID:1348
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD509ae02badc8b2086b93bf9a8e6e571d9
SHA12e11e03477348890d59be465b6ebd57643ba4b2e
SHA256035314fbb4239808456f30f60a6562a911b55e12a1432bdfe7ef33ae5d1748ec
SHA512877380540fd8ea834dab3681d7e4920a56458f20048bffcec092daddaca21933faeadb2ce18f22040b2172279c42aa258d39f56decb2a1497db30aa24eaad224
-
Filesize
90KB
MD509ae02badc8b2086b93bf9a8e6e571d9
SHA12e11e03477348890d59be465b6ebd57643ba4b2e
SHA256035314fbb4239808456f30f60a6562a911b55e12a1432bdfe7ef33ae5d1748ec
SHA512877380540fd8ea834dab3681d7e4920a56458f20048bffcec092daddaca21933faeadb2ce18f22040b2172279c42aa258d39f56decb2a1497db30aa24eaad224