Analysis
-
max time kernel
93s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2022, 08:26
Static task
static1
Behavioral task
behavioral1
Sample
0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe
Resource
win7-20220812-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe
-
Size
239KB
-
MD5
4bc2867068deecc96f2ee482073b5650
-
SHA1
5741c51ba51354c91234e953f47d7bb67727c9c5
-
SHA256
0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1
-
SHA512
cb081c7ce4cc5804c0fc7614d1c61d9dd1ca521b3611cc4bcec1554f41662953e42061a55cc8b3cbffe30c3dc49e55c76621183a4d86a12ef7c75446117a2fc4
-
SSDEEP
3072:Ybziv5Eh+IHv4TeQjhndqMiGHIy/tcZlfPxSYDv567vo:82vihx5QjJwMTHHlUnFd6T
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3588 SafeSys.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe -
Loads dropped DLL 1 IoCs
pid Process 4072 Rundll32.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\B: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\F: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\H: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\P: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\R: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\V: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\E: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\G: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\I: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\Q: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\K: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\M: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\O: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\S: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\T: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\W: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\X: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\Y: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\A: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\J: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\L: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\N: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened (read-only) \??\Z: 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\lhunj.bak 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File opened for modification C:\Program Files (x86)\Common Files\SafeSys.exe 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe File created C:\Program Files (x86)\Common Files\SafeSys.exe 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Fonts\eqhea.fon Rundll32.exe File opened for modification C:\Windows\Fonts\eqhea.fon Rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 4800 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 4800 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 668 Process not Found 668 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe Token: SeDebugPrivilege 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1016 wrote to memory of 4800 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 83 PID 1016 wrote to memory of 4800 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 83 PID 1016 wrote to memory of 4800 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 83 PID 4800 wrote to memory of 4072 4800 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 84 PID 4800 wrote to memory of 4072 4800 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 84 PID 4800 wrote to memory of 4072 4800 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 84 PID 1016 wrote to memory of 3588 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 85 PID 1016 wrote to memory of 3588 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 85 PID 1016 wrote to memory of 3588 1016 0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe 85 PID 3588 wrote to memory of 2752 3588 SafeSys.exe 86 PID 3588 wrote to memory of 2752 3588 SafeSys.exe 86 PID 3588 wrote to memory of 2752 3588 SafeSys.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe"C:\Users\Admin\AppData\Local\Temp\0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exeC:\Users\Admin\AppData\Local\Temp\0a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1.exe -SafeSys2⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SysWOW64\Rundll32.exe"C:\Windows\system32\Rundll32.exe" "C:\Program Files (x86)\lhunj.bak",MyDLLEntry3⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:4072
-
-
-
C:\Program Files (x86)\Common Files\SafeSys.exe"C:\Program Files (x86)\Common Files\SafeSys.exe" SafeSys2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:2752
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
239KB
MD54bc2867068deecc96f2ee482073b5650
SHA15741c51ba51354c91234e953f47d7bb67727c9c5
SHA2560a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1
SHA512cb081c7ce4cc5804c0fc7614d1c61d9dd1ca521b3611cc4bcec1554f41662953e42061a55cc8b3cbffe30c3dc49e55c76621183a4d86a12ef7c75446117a2fc4
-
Filesize
239KB
MD54bc2867068deecc96f2ee482073b5650
SHA15741c51ba51354c91234e953f47d7bb67727c9c5
SHA2560a564855ac1df4ff74645e4a266a963a41868d7c49ca644753bf4a1855e7abe1
SHA512cb081c7ce4cc5804c0fc7614d1c61d9dd1ca521b3611cc4bcec1554f41662953e42061a55cc8b3cbffe30c3dc49e55c76621183a4d86a12ef7c75446117a2fc4
-
Filesize
11KB
MD5b0446ab2521d6192d2822ae762f449d3
SHA1faf7c23d599a0176769e725de1c4118d4fcf5745
SHA2563a0c35d289e3abc9004905abeac139674ddba348d5ab98ae863f73c194ffa4cc
SHA51234d270eeb518dec27682d21638574e5ba560c746ac45d2d24405c201a3887f36aab273864a361a5681086068dde85c9ae4180b2edd9985ee3b37c07d4a607710
-
Filesize
11KB
MD5b0446ab2521d6192d2822ae762f449d3
SHA1faf7c23d599a0176769e725de1c4118d4fcf5745
SHA2563a0c35d289e3abc9004905abeac139674ddba348d5ab98ae863f73c194ffa4cc
SHA51234d270eeb518dec27682d21638574e5ba560c746ac45d2d24405c201a3887f36aab273864a361a5681086068dde85c9ae4180b2edd9985ee3b37c07d4a607710