Analysis
-
max time kernel
123s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11/10/2022, 08:26
Static task
static1
Behavioral task
behavioral1
Sample
0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe
Resource
win7-20220812-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe
-
Size
239KB
-
MD5
4bc2867068deecc96f2ee482073b5650
-
SHA1
5741c51ba51354c91234e953f47d7bb67727c9c5
-
SHA256
0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1
-
SHA512
cb081c7ce4cc5804c0fc7614d1c61d9dd1ca521b3611cc4bcec1554f41662953e42061a55cc8b3cbffe30c3dc49e55c76621183a4d86a12ef7c75446117a2fc4
-
SSDEEP
3072:Ybziv5Eh+IHv4TeQjhndqMiGHIy/tcZlfPxSYDv567vo:82vihx5QjJwMTHHlUnFd6T
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1076 SafeSys.exe -
Loads dropped DLL 3 IoCs
pid Process 1064 Rundll32.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\O: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\K: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\M: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\Q: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\T: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\V: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\W: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\E: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\G: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\H: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\N: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\R: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\S: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\U: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\X: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\B: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\F: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\Y: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\L: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\P: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\Z: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\I: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\J: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1076 set thread context of 1752 1076 SafeSys.exe 33 -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\edpfg.bak 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened for modification C:\Program Files (x86)\Common Files\SafeSys.exe 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File created C:\Program Files (x86)\Common Files\SafeSys.exe 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Fonts\bxnwv.fon Rundll32.exe File opened for modification C:\Windows\Fonts\bxnwv.fon Rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 916 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 460 Process not Found 460 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1756 wrote to memory of 916 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 27 PID 1756 wrote to memory of 916 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 27 PID 1756 wrote to memory of 916 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 27 PID 1756 wrote to memory of 916 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 27 PID 916 wrote to memory of 1064 916 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 28 PID 916 wrote to memory of 1064 916 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 28 PID 916 wrote to memory of 1064 916 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 28 PID 916 wrote to memory of 1064 916 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 28 PID 916 wrote to memory of 1064 916 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 28 PID 916 wrote to memory of 1064 916 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 28 PID 916 wrote to memory of 1064 916 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 28 PID 1756 wrote to memory of 1076 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 32 PID 1756 wrote to memory of 1076 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 32 PID 1756 wrote to memory of 1076 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 32 PID 1756 wrote to memory of 1076 1756 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 32 PID 1076 wrote to memory of 1752 1076 SafeSys.exe 33 PID 1076 wrote to memory of 1752 1076 SafeSys.exe 33 PID 1076 wrote to memory of 1752 1076 SafeSys.exe 33 PID 1076 wrote to memory of 1752 1076 SafeSys.exe 33 PID 1076 wrote to memory of 1752 1076 SafeSys.exe 33 PID 1076 wrote to memory of 1752 1076 SafeSys.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe"C:\Users\Admin\AppData\Local\Temp\0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exeC:\Users\Admin\AppData\Local\Temp\0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe -SafeSys2⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Windows\SysWOW64\Rundll32.exe"C:\Windows\system32\Rundll32.exe" "C:\Program Files (x86)\edpfg.bak",MyDLLEntry3⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1064
-
-
-
C:\Program Files (x86)\Common Files\SafeSys.exe"C:\Program Files (x86)\Common Files\SafeSys.exe" SafeSys2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:1752
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding1⤵PID:1648
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
239KB
MD54bc2867068deecc96f2ee482073b5650
SHA15741c51ba51354c91234e953f47d7bb67727c9c5
SHA2560a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1
SHA512cb081c7ce4cc5804c0fc7614d1c61d9dd1ca521b3611cc4bcec1554f41662953e42061a55cc8b3cbffe30c3dc49e55c76621183a4d86a12ef7c75446117a2fc4
-
Filesize
239KB
MD54bc2867068deecc96f2ee482073b5650
SHA15741c51ba51354c91234e953f47d7bb67727c9c5
SHA2560a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1
SHA512cb081c7ce4cc5804c0fc7614d1c61d9dd1ca521b3611cc4bcec1554f41662953e42061a55cc8b3cbffe30c3dc49e55c76621183a4d86a12ef7c75446117a2fc4
-
Filesize
11KB
MD5b0446ab2521d6192d2822ae762f449d3
SHA1faf7c23d599a0176769e725de1c4118d4fcf5745
SHA2563a0c35d289e3abc9004905abeac139674ddba348d5ab98ae863f73c194ffa4cc
SHA51234d270eeb518dec27682d21638574e5ba560c746ac45d2d24405c201a3887f36aab273864a361a5681086068dde85c9ae4180b2edd9985ee3b37c07d4a607710
-
Filesize
239KB
MD54bc2867068deecc96f2ee482073b5650
SHA15741c51ba51354c91234e953f47d7bb67727c9c5
SHA2560a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1
SHA512cb081c7ce4cc5804c0fc7614d1c61d9dd1ca521b3611cc4bcec1554f41662953e42061a55cc8b3cbffe30c3dc49e55c76621183a4d86a12ef7c75446117a2fc4
-
Filesize
239KB
MD54bc2867068deecc96f2ee482073b5650
SHA15741c51ba51354c91234e953f47d7bb67727c9c5
SHA2560a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1
SHA512cb081c7ce4cc5804c0fc7614d1c61d9dd1ca521b3611cc4bcec1554f41662953e42061a55cc8b3cbffe30c3dc49e55c76621183a4d86a12ef7c75446117a2fc4
-
Filesize
11KB
MD5b0446ab2521d6192d2822ae762f449d3
SHA1faf7c23d599a0176769e725de1c4118d4fcf5745
SHA2563a0c35d289e3abc9004905abeac139674ddba348d5ab98ae863f73c194ffa4cc
SHA51234d270eeb518dec27682d21638574e5ba560c746ac45d2d24405c201a3887f36aab273864a361a5681086068dde85c9ae4180b2edd9985ee3b37c07d4a607710