1cb37e9529dece1b6b9ec2dd9843c4b22ade64e6821e693ca64bd1ac244afe76

Analysis

max time kernel
151s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2022, 10:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1cb37e9529dece1b6b9ec2dd9843c4b22ade64e6821e693ca64bd1ac244afe76.exe
Size

108KB
MD5

6cfcfbdbcf2adcdbfcf9bafdee8536ca
SHA1

b114ffc44a3828f5f0aee94891629e93d0d8f00b
SHA256

1cb37e9529dece1b6b9ec2dd9843c4b22ade64e6821e693ca64bd1ac244afe76
SHA512

70843f307997a2f855c319f573fd729cd4f4a3cd143a775a581d3951fbbeb3d1b94bf65cf45094ab044ebec47f0f648fbe152379f49c5e39cfb3fb052edd0c8b
SSDEEP

768:ph/8nQpfDPUhh67zOizfdtCHKgS2hDx7wdkw7bzfzAL65nuplpnQzTGf3g4D3emg:ppEQlDcH0LLdtibSUWd77OTQEgJ54va

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe C:\\Windows\\system\\lsass.exe"	1cb37e9529dece1b6b9ec2dd9843c4b22ade64e6821e693ca64bd1ac244afe76.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\Windows\\system\\lsass.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe C:\\Windows\\system\\lsass.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\Windows\\system\\lsass.exe"	1cb37e9529dece1b6b9ec2dd9843c4b22ade64e6821e693ca64bd1ac244afe76.exe

Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	1cb37e9529dece1b6b9ec2dd9843c4b22ade64e6821e693ca64bd1ac244afe76.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	lsass.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	1cb37e9529dece1b6b9ec2dd9843c4b22ade64e6821e693ca64bd1ac244afe76.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	lsass.exe

Disables Task Manager via registry modification
evasion
Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	lsass.exe

Executes dropped EXE 1 IoCs

pid	Process
3320	lsass.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/224-132-0x0000000000400000-0x0000000000479000-memory.dmp	upx
behavioral2/files/0x0002000000022b0a-137.dat	upx
behavioral2/files/0x0002000000022b0a-138.dat	upx
behavioral2/memory/3320-144-0x0000000000400000-0x0000000000479000-memory.dmp	upx
behavioral2/memory/224-145-0x0000000000400000-0x0000000000479000-memory.dmp	upx
behavioral2/memory/224-149-0x0000000000400000-0x0000000000479000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	1cb37e9529dece1b6b9ec2dd9843c4b22ade64e6821e693ca64bd1ac244afe76.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	lsass.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\AUTORUN.inf	lsass.exe
File opened for modification	C:\AUTORUN.inf	lsass.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\lsass.exe	1cb37e9529dece1b6b9ec2dd9843c4b22ade64e6821e693ca64bd1ac244afe76.exe
File opened for modification	C:\Windows\lsass.exe	1cb37e9529dece1b6b9ec2dd9843c4b22ade64e6821e693ca64bd1ac244afe76.exe
File created	C:\Windows\system\lsass.exe	1cb37e9529dece1b6b9ec2dd9843c4b22ade64e6821e693ca64bd1ac244afe76.exe
File opened for modification	C:\Windows\system\lsass.exe	1cb37e9529dece1b6b9ec2dd9843c4b22ade64e6821e693ca64bd1ac244afe76.exe

Kills process with taskkill 46 IoCs

evasion

pid	Process
4276	taskkill.exe
916	taskkill.exe
3128	taskkill.exe
4708	taskkill.exe
4740	taskkill.exe
4852	taskkill.exe
2012	taskkill.exe
3604	taskkill.exe
4660	taskkill.exe
1352	taskkill.exe
484	taskkill.exe
3464	taskkill.exe
4728	taskkill.exe
4908	taskkill.exe
4184	taskkill.exe
856	taskkill.exe
2088	taskkill.exe
1492	taskkill.exe
4632	taskkill.exe
3824	taskkill.exe
4800	taskkill.exe
1664	taskkill.exe
1844	taskkill.exe
1308	taskkill.exe
1880	taskkill.exe
3120	taskkill.exe
2548	taskkill.exe
3416	taskkill.exe
4544	taskkill.exe
4536	taskkill.exe
2600	taskkill.exe
4804	taskkill.exe
1728	taskkill.exe
2420	taskkill.exe
5032	taskkill.exe
1372	taskkill.exe
4040	taskkill.exe
4028	taskkill.exe
4700	taskkill.exe
4564	taskkill.exe
4052	taskkill.exe
4648	taskkill.exe
1644	taskkill.exe
2716	taskkill.exe
3712	taskkill.exe
4032	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	1cb37e9529dece1b6b9ec2dd9843c4b22ade64e6821e693ca64bd1ac244afe76.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	lsass.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://trangcanhac.com/"	1cb37e9529dece1b6b9ec2dd9843c4b22ade64e6821e693ca64bd1ac244afe76.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://trangcanhac.com/"	lsass.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeDebugPrivilege	916	taskkill.exe
Token: SeDebugPrivilege	3416	taskkill.exe
Token: SeDebugPrivilege	1352	taskkill.exe
Token: SeDebugPrivilege	3128	taskkill.exe
Token: SeDebugPrivilege	856	taskkill.exe
Token: SeDebugPrivilege	4708	taskkill.exe
Token: SeDebugPrivilege	1844	taskkill.exe
Token: SeDebugPrivilege	4852	taskkill.exe
Token: SeDebugPrivilege	4740	taskkill.exe
Token: SeDebugPrivilege	2088	taskkill.exe
Token: SeDebugPrivilege	1492	taskkill.exe
Token: SeDebugPrivilege	2012	taskkill.exe
Token: SeDebugPrivilege	4544	taskkill.exe
Token: SeDebugPrivilege	484	taskkill.exe
Token: SeDebugPrivilege	1644	taskkill.exe
Token: SeDebugPrivilege	4536	taskkill.exe
Token: SeDebugPrivilege	3464	taskkill.exe
Token: SeDebugPrivilege	4632	taskkill.exe
Token: SeDebugPrivilege	1308	taskkill.exe
Token: SeDebugPrivilege	4728	taskkill.exe
Token: SeDebugPrivilege	4700	taskkill.exe
Token: SeDebugPrivilege	4564	taskkill.exe
Token: SeDebugPrivilege	4052	taskkill.exe
Token: SeDebugPrivilege	5032	taskkill.exe
Token: SeDebugPrivilege	2600	taskkill.exe
Token: SeDebugPrivilege	3604	taskkill.exe
Token: SeDebugPrivilege	4804	taskkill.exe
Token: SeDebugPrivilege	2716	taskkill.exe
Token: SeDebugPrivilege	3824	taskkill.exe
Token: SeDebugPrivilege	4276	taskkill.exe
Token: SeDebugPrivilege	1880	taskkill.exe
Token: SeDebugPrivilege	4800	taskkill.exe
Token: SeDebugPrivilege	1728	taskkill.exe
Token: SeDebugPrivilege	3712	taskkill.exe
Token: SeDebugPrivilege	3120	taskkill.exe
Token: SeDebugPrivilege	4184	taskkill.exe
Token: SeDebugPrivilege	1664	taskkill.exe
Token: SeDebugPrivilege	4660	taskkill.exe
Token: SeDebugPrivilege	2420	taskkill.exe
Token: SeDebugPrivilege	2548	taskkill.exe
Token: SeDebugPrivilege	4648	taskkill.exe
Token: SeDebugPrivilege	1372	taskkill.exe
Token: SeDebugPrivilege	4908	taskkill.exe
Token: SeDebugPrivilege	4032	taskkill.exe
Token: SeDebugPrivilege	4040	taskkill.exe
Token: SeDebugPrivilege	4028	taskkill.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
224	1cb37e9529dece1b6b9ec2dd9843c4b22ade64e6821e693ca64bd1ac244afe76.exe
3320	lsass.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 916	224	1cb37e9529dece1b6b9ec2dd9843c4b22ade64e6821e693ca64bd1ac244afe76.exe	83
PID 224 wrote to memory of 916	224	1cb37e9529dece1b6b9ec2dd9843c4b22ade64e6821e693ca64bd1ac244afe76.exe	83
PID 224 wrote to memory of 916	224	1cb37e9529dece1b6b9ec2dd9843c4b22ade64e6821e693ca64bd1ac244afe76.exe	83
PID 224 wrote to memory of 3320	224	1cb37e9529dece1b6b9ec2dd9843c4b22ade64e6821e693ca64bd1ac244afe76.exe	85
PID 224 wrote to memory of 3320	224	1cb37e9529dece1b6b9ec2dd9843c4b22ade64e6821e693ca64bd1ac244afe76.exe	85
PID 224 wrote to memory of 3320	224	1cb37e9529dece1b6b9ec2dd9843c4b22ade64e6821e693ca64bd1ac244afe76.exe	85
PID 3320 wrote to memory of 3128	3320	lsass.exe	91
PID 3320 wrote to memory of 3128	3320	lsass.exe	91
PID 3320 wrote to memory of 3128	3320	lsass.exe	91
PID 3320 wrote to memory of 3416	3320	lsass.exe	86
PID 3320 wrote to memory of 3416	3320	lsass.exe	86
PID 3320 wrote to memory of 3416	3320	lsass.exe	86
PID 3320 wrote to memory of 1352	3320	lsass.exe	89
PID 3320 wrote to memory of 1352	3320	lsass.exe	89
PID 3320 wrote to memory of 1352	3320	lsass.exe	89
PID 3320 wrote to memory of 856	3320	lsass.exe	92
PID 3320 wrote to memory of 856	3320	lsass.exe	92
PID 3320 wrote to memory of 856	3320	lsass.exe	92
PID 3320 wrote to memory of 4708	3320	lsass.exe	94
PID 3320 wrote to memory of 4708	3320	lsass.exe	94
PID 3320 wrote to memory of 4708	3320	lsass.exe	94
PID 3320 wrote to memory of 1844	3320	lsass.exe	96
PID 3320 wrote to memory of 1844	3320	lsass.exe	96
PID 3320 wrote to memory of 1844	3320	lsass.exe	96
PID 3320 wrote to memory of 4740	3320	lsass.exe	105
PID 3320 wrote to memory of 4740	3320	lsass.exe	105
PID 3320 wrote to memory of 4740	3320	lsass.exe	105
PID 3320 wrote to memory of 4852	3320	lsass.exe	109
PID 3320 wrote to memory of 4852	3320	lsass.exe	109
PID 3320 wrote to memory of 4852	3320	lsass.exe	109
PID 3320 wrote to memory of 2088	3320	lsass.exe	107
PID 3320 wrote to memory of 2088	3320	lsass.exe	107
PID 3320 wrote to memory of 2088	3320	lsass.exe	107
PID 3320 wrote to memory of 1492	3320	lsass.exe	111
PID 3320 wrote to memory of 1492	3320	lsass.exe	111
PID 3320 wrote to memory of 1492	3320	lsass.exe	111
PID 3320 wrote to memory of 2012	3320	lsass.exe	113
PID 3320 wrote to memory of 2012	3320	lsass.exe	113
PID 3320 wrote to memory of 2012	3320	lsass.exe	113
PID 3320 wrote to memory of 4544	3320	lsass.exe	115
PID 3320 wrote to memory of 4544	3320	lsass.exe	115
PID 3320 wrote to memory of 4544	3320	lsass.exe	115
PID 3320 wrote to memory of 4536	3320	lsass.exe	117
PID 3320 wrote to memory of 4536	3320	lsass.exe	117
PID 3320 wrote to memory of 4536	3320	lsass.exe	117
PID 3320 wrote to memory of 1644	3320	lsass.exe	118
PID 3320 wrote to memory of 1644	3320	lsass.exe	118
PID 3320 wrote to memory of 1644	3320	lsass.exe	118
PID 3320 wrote to memory of 484	3320	lsass.exe	119
PID 3320 wrote to memory of 484	3320	lsass.exe	119
PID 3320 wrote to memory of 484	3320	lsass.exe	119
PID 3320 wrote to memory of 3464	3320	lsass.exe	123
PID 3320 wrote to memory of 3464	3320	lsass.exe	123
PID 3320 wrote to memory of 3464	3320	lsass.exe	123
PID 3320 wrote to memory of 4632	3320	lsass.exe	127
PID 3320 wrote to memory of 4632	3320	lsass.exe	127
PID 3320 wrote to memory of 4632	3320	lsass.exe	127
PID 3320 wrote to memory of 1308	3320	lsass.exe	124
PID 3320 wrote to memory of 1308	3320	lsass.exe	124
PID 3320 wrote to memory of 1308	3320	lsass.exe	124
PID 3320 wrote to memory of 4728	3320	lsass.exe	129
PID 3320 wrote to memory of 4728	3320	lsass.exe	129
PID 3320 wrote to memory of 4728	3320	lsass.exe	129
PID 3320 wrote to memory of 4700	3320	lsass.exe	131

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	1cb37e9529dece1b6b9ec2dd9843c4b22ade64e6821e693ca64bd1ac244afe76.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	1cb37e9529dece1b6b9ec2dd9843c4b22ade64e6821e693ca64bd1ac244afe76.exe

C:\Users\Admin\AppData\Local\Temp\1cb37e9529dece1b6b9ec2dd9843c4b22ade64e6821e693ca64bd1ac244afe76.exe
"C:\Users\Admin\AppData\Local\Temp\1cb37e9529dece1b6b9ec2dd9843c4b22ade64e6821e693ca64bd1ac244afe76.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Adds Run key to start application
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:224
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /im firefox.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:916
- C:\Windows\lsass.exe
  C:\Windows\lsass.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops autorun.inf file
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3320
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3416
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im hijackthis.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1352
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im regedit.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3128
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im regedit.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:856
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4708
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im hijackthis.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1844
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im regedit.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4740
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im hijackthis.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2088
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4852
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im regedit.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1492
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2012
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im hijackthis.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4544
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im regedit.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4536
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1644
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im hijackthis.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:484
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im regedit.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3464
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im hijackthis.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1308
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4632
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im regedit.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4728
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4700
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im hijackthis.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4564
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im regedit.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5032
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4052
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im hijackthis.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2600
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im regedit.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3604
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4804
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im hijackthis.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2716
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im regedit.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3824
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im hijackthis.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4276
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1880
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im regedit.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4800
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1728
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im hijackthis.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3712
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im regedit.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3120
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1664
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im hijackthis.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4184
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im regedit.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2420
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4660
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im hijackthis.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2548
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im regedit.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4648
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1372
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im hijackthis.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4908
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im regedit.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4032
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4040
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im hijackthis.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\lsass.exe

Filesize
108KB

MD5
6cfcfbdbcf2adcdbfcf9bafdee8536ca

SHA1
b114ffc44a3828f5f0aee94891629e93d0d8f00b

SHA256
1cb37e9529dece1b6b9ec2dd9843c4b22ade64e6821e693ca64bd1ac244afe76

SHA512
70843f307997a2f855c319f573fd729cd4f4a3cd143a775a581d3951fbbeb3d1b94bf65cf45094ab044ebec47f0f648fbe152379f49c5e39cfb3fb052edd0c8b

Download Submit
C:\Windows\lsass.exe

Filesize
108KB

MD5
6cfcfbdbcf2adcdbfcf9bafdee8536ca

SHA1
b114ffc44a3828f5f0aee94891629e93d0d8f00b

SHA256
1cb37e9529dece1b6b9ec2dd9843c4b22ade64e6821e693ca64bd1ac244afe76

SHA512
70843f307997a2f855c319f573fd729cd4f4a3cd143a775a581d3951fbbeb3d1b94bf65cf45094ab044ebec47f0f648fbe152379f49c5e39cfb3fb052edd0c8b

Download Submit
memory/224-132-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/224-145-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/224-149-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/3320-144-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads