Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2022, 04:45
Static task
static1
Behavioral task
behavioral1
Sample
fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe
Resource
win7-20220812-en
General
-
Target
fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe
-
Size
759KB
-
MD5
4e58165e216a9be463352e13034e58c0
-
SHA1
b48e3c4958f83798a4dcbf96a793fbb2a5960d8f
-
SHA256
fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f
-
SHA512
c09b3bc0cd586a3327e0f2732a11d5dbb60b9007234066677fa496f54057bb0d19e86f378a472e50ae00aae2ccd755fa5f468947c94667fd65ea413f165078d8
-
SSDEEP
12288:SphltQO6QBtpRgvCUBv40cbBcHEihhcmN2FanJTz7nRcsC2wgWiVWLfq1b:SLWvCUBA0cbFihBX9msC2wgbYLSb
Malware Config
Extracted
darkcomet
Guest16
enrispony.no-ip.biz:1604
DC_MUTEX-2VS027H
-
gencode
y1yFesyf2sa7
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe -
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe -
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 2204 attrib.exe 3100 attrib.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe" fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe" fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4172 set thread context of 4932 4172 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 83 PID 4172 set thread context of 4644 4172 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 85 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30989628" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "372235318" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30989628" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30989628" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "948185434" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "832091651" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{5A2AAEE7-492F-11ED-A0EE-C2D2A1265889} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "832091651" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "948030015" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30989628" iexplore.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4172 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 4172 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 4932 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe Token: SeSecurityPrivilege 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe Token: SeTakeOwnershipPrivilege 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe Token: SeLoadDriverPrivilege 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe Token: SeSystemProfilePrivilege 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe Token: SeSystemtimePrivilege 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe Token: SeProfSingleProcessPrivilege 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe Token: SeIncBasePriorityPrivilege 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe Token: SeCreatePagefilePrivilege 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe Token: SeBackupPrivilege 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe Token: SeRestorePrivilege 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe Token: SeShutdownPrivilege 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe Token: SeDebugPrivilege 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe Token: SeSystemEnvironmentPrivilege 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe Token: SeChangeNotifyPrivilege 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe Token: SeRemoteShutdownPrivilege 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe Token: SeUndockPrivilege 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe Token: SeManageVolumePrivilege 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe Token: SeImpersonatePrivilege 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe Token: SeCreateGlobalPrivilege 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe Token: 33 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe Token: 34 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe Token: 35 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe Token: 36 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4932 iexplore.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 4932 iexplore.exe 4932 iexplore.exe 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 3428 IEXPLORE.EXE 3428 IEXPLORE.EXE 3428 IEXPLORE.EXE 3428 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4172 wrote to memory of 4876 4172 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 82 PID 4172 wrote to memory of 4876 4172 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 82 PID 4172 wrote to memory of 4876 4172 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 82 PID 4172 wrote to memory of 4932 4172 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 83 PID 4172 wrote to memory of 4932 4172 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 83 PID 4172 wrote to memory of 4932 4172 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 83 PID 4172 wrote to memory of 4932 4172 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 83 PID 4172 wrote to memory of 4932 4172 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 83 PID 4172 wrote to memory of 4932 4172 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 83 PID 4172 wrote to memory of 4932 4172 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 83 PID 4172 wrote to memory of 4932 4172 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 83 PID 4172 wrote to memory of 4932 4172 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 83 PID 4172 wrote to memory of 4932 4172 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 83 PID 4172 wrote to memory of 4932 4172 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 83 PID 4172 wrote to memory of 4932 4172 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 83 PID 4172 wrote to memory of 4644 4172 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 85 PID 4172 wrote to memory of 4644 4172 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 85 PID 4172 wrote to memory of 4644 4172 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 85 PID 4172 wrote to memory of 4644 4172 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 85 PID 4172 wrote to memory of 4644 4172 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 85 PID 4172 wrote to memory of 4644 4172 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 85 PID 4172 wrote to memory of 4644 4172 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 85 PID 4172 wrote to memory of 4644 4172 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 85 PID 4172 wrote to memory of 4644 4172 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 85 PID 4172 wrote to memory of 4644 4172 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 85 PID 4172 wrote to memory of 4644 4172 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 85 PID 4172 wrote to memory of 4644 4172 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 85 PID 4172 wrote to memory of 4644 4172 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 85 PID 4172 wrote to memory of 4644 4172 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 85 PID 4876 wrote to memory of 848 4876 cmd.exe 86 PID 4876 wrote to memory of 848 4876 cmd.exe 86 PID 4876 wrote to memory of 848 4876 cmd.exe 86 PID 848 wrote to memory of 4636 848 net.exe 87 PID 848 wrote to memory of 4636 848 net.exe 87 PID 848 wrote to memory of 4636 848 net.exe 87 PID 4932 wrote to memory of 3428 4932 iexplore.exe 88 PID 4932 wrote to memory of 3428 4932 iexplore.exe 88 PID 4932 wrote to memory of 3428 4932 iexplore.exe 88 PID 4644 wrote to memory of 4400 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 89 PID 4644 wrote to memory of 4400 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 89 PID 4644 wrote to memory of 4400 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 89 PID 4644 wrote to memory of 4772 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 91 PID 4644 wrote to memory of 4772 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 91 PID 4644 wrote to memory of 4772 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 91 PID 4644 wrote to memory of 2320 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 93 PID 4644 wrote to memory of 2320 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 93 PID 4644 wrote to memory of 2320 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 93 PID 4644 wrote to memory of 2320 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 93 PID 4644 wrote to memory of 2320 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 93 PID 4644 wrote to memory of 2320 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 93 PID 4644 wrote to memory of 2320 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 93 PID 4644 wrote to memory of 2320 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 93 PID 4644 wrote to memory of 2320 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 93 PID 4644 wrote to memory of 2320 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 93 PID 4644 wrote to memory of 2320 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 93 PID 4644 wrote to memory of 2320 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 93 PID 4644 wrote to memory of 2320 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 93 PID 4644 wrote to memory of 2320 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 93 PID 4644 wrote to memory of 2320 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 93 PID 4644 wrote to memory of 2320 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 93 PID 4644 wrote to memory of 2320 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 93 PID 4644 wrote to memory of 2320 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 93 PID 4644 wrote to memory of 2320 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 93 PID 4644 wrote to memory of 2320 4644 fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe 93 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 2204 attrib.exe 3100 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe"C:\Users\Admin\AppData\Local\Temp\fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Windows\SysWOW64\cmd.exe/c net stop MpsSvc2⤵
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\SysWOW64\net.exenet stop MpsSvc3⤵
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc4⤵PID:4636
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4932 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3428
-
-
-
C:\Users\Admin\AppData\Local\Temp\fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exeC:\Users\Admin\AppData\Local\Temp\fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Checks computer location settings
- Windows security modification
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe" +s +h3⤵PID:4400
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2204
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵PID:4772
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3100
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵PID:2320
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f.exe
Filesize759KB
MD54e58165e216a9be463352e13034e58c0
SHA1b48e3c4958f83798a4dcbf96a793fbb2a5960d8f
SHA256fa464cefaa570096e5217b8a6b16e0f183d59c12333773b5433397628c87011f
SHA512c09b3bc0cd586a3327e0f2732a11d5dbb60b9007234066677fa496f54057bb0d19e86f378a472e50ae00aae2ccd755fa5f468947c94667fd65ea413f165078d8