Analysis
-
max time kernel
197s -
max time network
210s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2022, 15:39
Static task
static1
Behavioral task
behavioral1
Sample
52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe
Resource
win7-20220812-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe
-
Size
2.1MB
-
MD5
4f03e2f125ce3bf82000b709ca6cce01
-
SHA1
8c0ab6247f127a6232745bd0432a4bedf070612c
-
SHA256
52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028
-
SHA512
7472a8157823f72efec5d205557b0ccd1d1e607af3cb745ff1865517cd82b705f64d8631fb184736f43d660fbdc3547ba20334ffee55012e192e85939f88841e
-
SSDEEP
6144:6YHNNS4aXOxFYuDi8XSW2Uuk7UURyBAumEGWSYkCBStouz4FMxQyg:fnryO8w1wyAURyBLwWfkkzUS1yg
Score
8/10
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\recovery = "C:\\Windows\\system32\\idcmsras.exe" 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe -
Executes dropped EXE 5 IoCs
pid Process 2852 raspptpdsp.exe 1744 smss.exe 1824 smss.exe 4884 smss.exe 4996 smss.exe -
Modifies Installed Components in the registry 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95}\Version = "1,1,1,2" 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95}\ComponentID = "DOTNETFRAMEWORKS" 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95}\DontAsk = "2" 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95}\IsInstalled = "1" 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95}\ = "Themes Setup" 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95} 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95}\StubPath = "rundll32.exe C:\\Windows\\system32\\themeuichk.dll,ThemesSetupInstallCheck" 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d7f312-b0f6-11d2-94ab-0080c33c7e95}\IconsBinary = 43003a005c00570069006e0064006f00770073005c00730079007300740065006d00330032005c00770069006e00730079007300750069002e006500780065000000 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\recovery = "C:\\Windows\\system32\\idcmsras.exe" 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\ = "AcroIEHelperStub" 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\NoExplorer = "1" 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe -
Drops file in System32 directory 14 IoCs
description ioc Process File created C:\Windows\SysWOW64\rascmswdm.exe 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe File created C:\Windows\SysWOW64\idcmsras.exe 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe File created C:\Windows\SysWOW64\sqllibsys.ocx 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe File opened for modification C:\Windows\SysWOW64\ipdspfw.exe 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe File created C:\Windows\SysWOW64\ipdspfw.exe 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe File created C:\Windows\SysWOW64\winsysui.exe 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe File opened for modification C:\Windows\SysWOW64\idcmsras.exe 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe File opened for modification C:\Windows\SysWOW64\sqllibsys.ocx 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe File opened for modification C:\Windows\SysWOW64\fslsaid.exe 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe File opened for modification C:\Windows\SysWOW64\cfgenveng.exe 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe File opened for modification C:\Windows\SysWOW64\winsysui.exe 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe File created C:\Windows\SysWOW64\fslsaid.exe 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe File created C:\Windows\SysWOW64\cfgenveng.exe 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe File opened for modification C:\Windows\SysWOW64\rascmswdm.exe 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe -
Program crash 3 IoCs
pid pid_target Process procid_target 4136 2852 WerFault.exe 82 4264 2852 WerFault.exe 82 4212 2852 WerFault.exe 82 -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\InprocServer32 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\InprocServer32\ = "C:\\Windows\\SysWow64\\sqllibsys.ocx" 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\VersionIndependentProgID 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\ = "Adobe PDF Link Helper" 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\InprocServer32\ThreadingModel = "Apartment" 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\ProgID 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\ProgID\ = "AcroIEHelperShim.AcroIEHelperShimObj.1" 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\VersionIndependentProgID\ = "AcroIEHelperShim.AcroIEHelperShimObj" 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeDebugPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeBackupPrivilege 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe Token: SeDebugPrivilege 2852 raspptpdsp.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 4812 wrote to memory of 2852 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 82 PID 4812 wrote to memory of 2852 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 82 PID 4812 wrote to memory of 2852 4812 52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe 82 PID 2852 wrote to memory of 820 2852 raspptpdsp.exe 83 PID 2852 wrote to memory of 820 2852 raspptpdsp.exe 83 PID 2852 wrote to memory of 820 2852 raspptpdsp.exe 83 PID 820 wrote to memory of 1744 820 cmd.exe 87 PID 820 wrote to memory of 1744 820 cmd.exe 87 PID 820 wrote to memory of 1744 820 cmd.exe 87 PID 820 wrote to memory of 4380 820 cmd.exe 90 PID 820 wrote to memory of 4380 820 cmd.exe 90 PID 820 wrote to memory of 4380 820 cmd.exe 90 PID 820 wrote to memory of 1824 820 cmd.exe 91 PID 820 wrote to memory of 1824 820 cmd.exe 91 PID 820 wrote to memory of 1824 820 cmd.exe 91 PID 820 wrote to memory of 2984 820 cmd.exe 94 PID 820 wrote to memory of 2984 820 cmd.exe 94 PID 820 wrote to memory of 2984 820 cmd.exe 94 PID 820 wrote to memory of 4884 820 cmd.exe 95 PID 820 wrote to memory of 4884 820 cmd.exe 95 PID 820 wrote to memory of 4884 820 cmd.exe 95 PID 820 wrote to memory of 4604 820 cmd.exe 103 PID 820 wrote to memory of 4604 820 cmd.exe 103 PID 820 wrote to memory of 4604 820 cmd.exe 103 PID 820 wrote to memory of 4996 820 cmd.exe 104 PID 820 wrote to memory of 4996 820 cmd.exe 104 PID 820 wrote to memory of 4996 820 cmd.exe 104 PID 820 wrote to memory of 4092 820 cmd.exe 105 PID 820 wrote to memory of 4092 820 cmd.exe 105 PID 820 wrote to memory of 4092 820 cmd.exe 105 -
Views/modifies file attributes 1 TTPs 4 IoCs
pid Process 4380 attrib.exe 2984 attrib.exe 4604 attrib.exe 4092 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe"C:\Users\Admin\AppData\Local\Temp\52226fd06e7703664829e22beee7fc0b7c3f51f8e5baaf066a6c22e80202d028.exe"1⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\raspptpdsp.exe"C:\Users\Admin\AppData\Local\Temp\raspptpdsp.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\612B.tmp.cmd "C:\Users\Admin\AppData\Local\Temp\RASPPT~1.EXE""3⤵
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Users\Admin\AppData\Local\Temp\smss.exe"C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 54⤵
- Executes dropped EXE
PID:1744
-
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\Users\Admin\AppData\Local\Temp\RASPPT~1.EXE"4⤵
- Views/modifies file attributes
PID:4380
-
-
C:\Users\Admin\AppData\Local\Temp\smss.exe"C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 54⤵
- Executes dropped EXE
PID:1824
-
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\Users\Admin\AppData\Local\Temp\RASPPT~1.EXE"4⤵
- Views/modifies file attributes
PID:2984
-
-
C:\Users\Admin\AppData\Local\Temp\smss.exe"C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 54⤵
- Executes dropped EXE
PID:4884
-
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\Users\Admin\AppData\Local\Temp\RASPPT~1.EXE"4⤵
- Views/modifies file attributes
PID:4604
-
-
C:\Users\Admin\AppData\Local\Temp\smss.exe"C:\Users\Admin\AppData\Local\Temp\smss.exe" 127.1 -n 54⤵
- Executes dropped EXE
PID:4996
-
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\Users\Admin\AppData\Local\Temp\RASPPT~1.EXE"4⤵
- Views/modifies file attributes
PID:4092
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 9283⤵
- Program crash
PID:4136
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 9243⤵
- Program crash
PID:4264
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 9323⤵
- Program crash
PID:4212
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2852 -ip 28521⤵PID:3504
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2852 -ip 28521⤵PID:3248
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2852 -ip 28521⤵PID:4940
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5e7efc2c945a798b4dab3fe50f1524592
SHA10bb937ccd89e40c91c0e58b376873ef909fe805b
SHA256624acac79fdcfe30592f5321b4ab73d360f393dbcdbe8daa50fcce63c710f5dc
SHA512e75840979404587aa15fd4d1e46707c33e32dca086ca72c7666045e14191e29857d06dc8ba737e69925c71b2e2d6a5ee3b63c36ecd2f32ae515f85a985d8f257
-
Filesize
400KB
MD535c6928790ce08309af997654ed6d719
SHA1a81b58b2171c6a728039dc493faaf2cab7d146a5
SHA2567d9296ac474b991780b41f654b557e01ba93ae932ba717146e60c1b9ed579539
SHA5123ae694a67d3a0f44729d54077e7c7259f608db258622fafa735e28ee9e73a0fb0e387e5cc923130cf6a15412050ace57fa9d4f7278c6df5cc7c4287efc79e752
-
Filesize
400KB
MD535c6928790ce08309af997654ed6d719
SHA1a81b58b2171c6a728039dc493faaf2cab7d146a5
SHA2567d9296ac474b991780b41f654b557e01ba93ae932ba717146e60c1b9ed579539
SHA5123ae694a67d3a0f44729d54077e7c7259f608db258622fafa735e28ee9e73a0fb0e387e5cc923130cf6a15412050ace57fa9d4f7278c6df5cc7c4287efc79e752
-
Filesize
18KB
MD5b3624dd758ccecf93a1226cef252ca12
SHA1fcf4dad8c4ad101504b1bf47cbbddbac36b558a7
SHA2564aaa74f294c15aeb37ada8185d0dead58bd87276a01a814abc0c4b40545bf2ef
SHA512c613d18511b00fa25fc7b1bdde10d96debb42a99b5aaab9e9826538d0e229085bb371f0197f6b1086c4f9c605f01e71287ffc5442f701a95d67c232a5f031838
-
Filesize
18KB
MD5b3624dd758ccecf93a1226cef252ca12
SHA1fcf4dad8c4ad101504b1bf47cbbddbac36b558a7
SHA2564aaa74f294c15aeb37ada8185d0dead58bd87276a01a814abc0c4b40545bf2ef
SHA512c613d18511b00fa25fc7b1bdde10d96debb42a99b5aaab9e9826538d0e229085bb371f0197f6b1086c4f9c605f01e71287ffc5442f701a95d67c232a5f031838
-
Filesize
18KB
MD5b3624dd758ccecf93a1226cef252ca12
SHA1fcf4dad8c4ad101504b1bf47cbbddbac36b558a7
SHA2564aaa74f294c15aeb37ada8185d0dead58bd87276a01a814abc0c4b40545bf2ef
SHA512c613d18511b00fa25fc7b1bdde10d96debb42a99b5aaab9e9826538d0e229085bb371f0197f6b1086c4f9c605f01e71287ffc5442f701a95d67c232a5f031838
-
Filesize
18KB
MD5b3624dd758ccecf93a1226cef252ca12
SHA1fcf4dad8c4ad101504b1bf47cbbddbac36b558a7
SHA2564aaa74f294c15aeb37ada8185d0dead58bd87276a01a814abc0c4b40545bf2ef
SHA512c613d18511b00fa25fc7b1bdde10d96debb42a99b5aaab9e9826538d0e229085bb371f0197f6b1086c4f9c605f01e71287ffc5442f701a95d67c232a5f031838