Analysis
-
max time kernel
149s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2022 15:40
Static task
static1
Behavioral task
behavioral1
Sample
33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe
Resource
win7-20220812-en
General
-
Target
33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe
-
Size
3.7MB
-
MD5
66000c5f4ab1a3e0581b82c7ec037eda
-
SHA1
266a7e51ac3ee8b5d73e19461a226a3dae5f5627
-
SHA256
33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e
-
SHA512
77ad229bc5db67a918db715a843ae5b14bb0547cf010cc7e56f70b89d5c3aac411590b9261440fd1db41a6f37788716fc0fe3a91c51e429a3b517b676e354ea8
-
SSDEEP
49152:XGkO/hDNTa/UhqNl8vLvwUQfsypLSvcnkKs0ByZq8gbfwTCEf5AMQBvPngksT68k:XGk/UYNl8zvwUQfsypOvT0Y8RjYM8u9
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe -
Drops startup file 2 IoCs
Processes:
33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Modifies registry class 3 IoCs
Processes:
33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{40197EE5-4019-7EE5-4019-7EE540197EE5} 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{40197EE5-4019-7EE5-4019-7EE540197EE5}\AutoConvertTo 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{40197EE5-4019-7EE5-4019-7EE540197EE5}\AutoConvertTo\ = "{00020803-0000-0000-C000-000000000046}" 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exedescription pid process Token: 33 5024 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe Token: SeIncBasePriorityPrivilege 5024 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe Token: 33 5024 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe Token: SeIncBasePriorityPrivilege 5024 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exedescription pid process target process PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe PID 1280 wrote to memory of 5024 1280 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe 33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe"C:\Users\Admin\AppData\Local\Temp\33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe"C:\Users\Admin\AppData\Local\Temp\33f3ca8799dac862d1083f5a7376a0ead3d79fa5ff4a57154ef4ea2c05f6a93e.exe"2⤵
- Checks BIOS information in registry
- Drops startup file
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1280-136-0x0000000000400000-0x0000000000854000-memory.dmpFilesize
4.3MB
-
memory/1280-541-0x0000000000400000-0x0000000000854000-memory.dmpFilesize
4.3MB
-
memory/5024-133-0x0000000000000000-mapping.dmp
-
memory/5024-135-0x0000000002BD0000-0x0000000002DD4000-memory.dmpFilesize
2.0MB
-
memory/5024-138-0x0000000000400000-0x0000000000854000-memory.dmpFilesize
4.3MB
-
memory/5024-143-0x0000000002BD0000-0x0000000002DD4000-memory.dmpFilesize
2.0MB
-
memory/5024-144-0x0000000000400000-0x0000000000854000-memory.dmpFilesize
4.3MB
-
memory/5024-146-0x0000000000400000-0x0000000000854000-memory.dmpFilesize
4.3MB
-
memory/5024-145-0x0000000000400000-0x0000000000854000-memory.dmpFilesize
4.3MB
-
memory/5024-154-0x0000000000411000-0x0000000000412000-memory.dmpFilesize
4KB
-
memory/5024-153-0x0000000000407000-0x0000000000408000-memory.dmpFilesize
4KB
-
memory/5024-167-0x0000000000414000-0x0000000000415000-memory.dmpFilesize
4KB
-
memory/5024-166-0x0000000000412000-0x0000000000413000-memory.dmpFilesize
4KB
-
memory/5024-165-0x0000000000413000-0x0000000000414000-memory.dmpFilesize
4KB
-
memory/5024-170-0x0000000000425000-0x0000000000426000-memory.dmpFilesize
4KB
-
memory/5024-169-0x0000000000426000-0x0000000000427000-memory.dmpFilesize
4KB
-
memory/5024-171-0x000000000041E000-0x000000000041F000-memory.dmpFilesize
4KB
-
memory/5024-172-0x000000000041F000-0x0000000000420000-memory.dmpFilesize
4KB
-
memory/5024-168-0x0000000000424000-0x0000000000425000-memory.dmpFilesize
4KB
-
memory/5024-164-0x0000000000419000-0x000000000041A000-memory.dmpFilesize
4KB
-
memory/5024-163-0x000000000041B000-0x000000000041C000-memory.dmpFilesize
4KB
-
memory/5024-162-0x000000000040F000-0x0000000000410000-memory.dmpFilesize
4KB
-
memory/5024-161-0x0000000000410000-0x0000000000411000-memory.dmpFilesize
4KB
-
memory/5024-160-0x000000000040E000-0x000000000040F000-memory.dmpFilesize
4KB
-
memory/5024-159-0x0000000000408000-0x0000000000409000-memory.dmpFilesize
4KB
-
memory/5024-158-0x000000000040B000-0x000000000040C000-memory.dmpFilesize
4KB
-
memory/5024-157-0x000000000040C000-0x000000000040D000-memory.dmpFilesize
4KB
-
memory/5024-156-0x0000000000402000-0x0000000000403000-memory.dmpFilesize
4KB
-
memory/5024-155-0x000000000040D000-0x000000000040E000-memory.dmpFilesize
4KB
-
memory/5024-173-0x000000000041C000-0x000000000041D000-memory.dmpFilesize
4KB
-
memory/5024-174-0x0000000000442000-0x0000000000443000-memory.dmpFilesize
4KB
-
memory/5024-175-0x0000000000448000-0x0000000000449000-memory.dmpFilesize
4KB
-
memory/5024-176-0x000000000042F000-0x0000000000430000-memory.dmpFilesize
4KB
-
memory/5024-177-0x0000000000415000-0x0000000000416000-memory.dmpFilesize
4KB
-
memory/5024-178-0x0000000000443000-0x0000000000444000-memory.dmpFilesize
4KB
-
memory/5024-179-0x0000000000427000-0x0000000000428000-memory.dmpFilesize
4KB
-
memory/5024-180-0x0000000000429000-0x000000000042A000-memory.dmpFilesize
4KB
-
memory/5024-181-0x000000000042D000-0x000000000042E000-memory.dmpFilesize
4KB
-
memory/5024-182-0x0000000000409000-0x000000000040A000-memory.dmpFilesize
4KB
-
memory/5024-183-0x0000000000428000-0x0000000000429000-memory.dmpFilesize
4KB
-
memory/5024-184-0x000000000042A000-0x000000000042B000-memory.dmpFilesize
4KB
-
memory/5024-185-0x000000000043F000-0x0000000000440000-memory.dmpFilesize
4KB
-
memory/5024-186-0x0000000000430000-0x0000000000431000-memory.dmpFilesize
4KB
-
memory/5024-187-0x000000000043E000-0x000000000043F000-memory.dmpFilesize
4KB
-
memory/5024-188-0x000000000044A000-0x000000000044B000-memory.dmpFilesize
4KB
-
memory/5024-189-0x0000000000451000-0x0000000000452000-memory.dmpFilesize
4KB
-
memory/5024-196-0x0000000000453000-0x0000000000454000-memory.dmpFilesize
4KB
-
memory/5024-195-0x0000000000423000-0x0000000000424000-memory.dmpFilesize
4KB
-
memory/5024-194-0x0000000000421000-0x0000000000422000-memory.dmpFilesize
4KB
-
memory/5024-193-0x0000000000452000-0x0000000000453000-memory.dmpFilesize
4KB
-
memory/5024-192-0x000000000041D000-0x000000000041E000-memory.dmpFilesize
4KB
-
memory/5024-191-0x000000000044D000-0x000000000044E000-memory.dmpFilesize
4KB
-
memory/5024-190-0x000000000041A000-0x000000000041B000-memory.dmpFilesize
4KB
-
memory/5024-197-0x0000000000454000-0x0000000000455000-memory.dmpFilesize
4KB
-
memory/5024-199-0x000000000043C000-0x000000000043D000-memory.dmpFilesize
4KB
-
memory/5024-198-0x000000000043B000-0x000000000043C000-memory.dmpFilesize
4KB
-
memory/5024-200-0x0000000000436000-0x0000000000437000-memory.dmpFilesize
4KB
-
memory/5024-201-0x0000000000433000-0x0000000000434000-memory.dmpFilesize
4KB
-
memory/5024-202-0x0000000000432000-0x0000000000433000-memory.dmpFilesize
4KB
-
memory/5024-204-0x0000000000416000-0x0000000000417000-memory.dmpFilesize
4KB
-
memory/5024-206-0x0000000000406000-0x0000000000407000-memory.dmpFilesize
4KB
-
memory/5024-208-0x0000000000434000-0x0000000000435000-memory.dmpFilesize
4KB
-
memory/5024-210-0x0000000000435000-0x0000000000436000-memory.dmpFilesize
4KB
-
memory/5024-212-0x0000000000438000-0x0000000000439000-memory.dmpFilesize
4KB
-
memory/5024-540-0x0000000002BD0000-0x0000000002DD4000-memory.dmpFilesize
2.0MB
-
memory/5024-542-0x0000000000400000-0x0000000000854000-memory.dmpFilesize
4.3MB