Analysis
-
max time kernel
157s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2022, 22:49
Static task
static1
Behavioral task
behavioral1
Sample
4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe
-
Size
775KB
-
MD5
4d1fb0eb9f401a7f43572197d12e29a0
-
SHA1
b4c0814f552fe5d88a249fdc808925c37cb19e0c
-
SHA256
4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69
-
SHA512
f584ab9c21734bfe25a559bb98ac048bf8b0ba910e59c186ff6c79825482a2b91a299afa65f409f2bb28440e26489123a4271cdc897bc91eab242e557fe04f3f
-
SSDEEP
12288:HXZKu9TygrJ9YQ1DNIZmzIbwUB/qsgIsqA:HXZJRimzIbwu/qsgI1A
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe smrss.exe" 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe -
Executes dropped EXE 1 IoCs
pid Process 4512 22040.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\smrss.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File created C:\Windows\SysWOW64\smrss.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\notification_helper.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javacpl.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec64.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jabswitch.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jjs.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\servertool.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmiregistry.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\unpack200.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jjs.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\policytool.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\keytool.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\servertool.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmid.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmid.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\servertool.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\kinit.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\unpack200.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jp2launcher.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javacpl.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsgen.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\keytool.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\tnameserv.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\orbd.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\pack200.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\policytool.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jp2launcher.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\unpack200.exe 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3176 wrote to memory of 4512 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 83 PID 3176 wrote to memory of 4512 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 83 PID 3176 wrote to memory of 4512 3176 4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe"C:\Users\Admin\AppData\Local\Temp\4cf2ce5115b1d8005180f44af203824a76a2ead283d003eecfbf4c8bcd57fb69.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\windows\temp\22040.exe"C:\windows\temp\22040.exe"2⤵
- Executes dropped EXE
PID:4512
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD509ae02badc8b2086b93bf9a8e6e571d9
SHA12e11e03477348890d59be465b6ebd57643ba4b2e
SHA256035314fbb4239808456f30f60a6562a911b55e12a1432bdfe7ef33ae5d1748ec
SHA512877380540fd8ea834dab3681d7e4920a56458f20048bffcec092daddaca21933faeadb2ce18f22040b2172279c42aa258d39f56decb2a1497db30aa24eaad224
-
Filesize
90KB
MD509ae02badc8b2086b93bf9a8e6e571d9
SHA12e11e03477348890d59be465b6ebd57643ba4b2e
SHA256035314fbb4239808456f30f60a6562a911b55e12a1432bdfe7ef33ae5d1748ec
SHA512877380540fd8ea834dab3681d7e4920a56458f20048bffcec092daddaca21933faeadb2ce18f22040b2172279c42aa258d39f56decb2a1497db30aa24eaad224