Analysis
-
max time kernel
54s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
20/10/2022, 19:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe
Resource
win7-20220812-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe
-
Size
1.2MB
-
MD5
a07d308fc1170811313f2b48a756c8ef
-
SHA1
9515a5259b21517487118b1e6db7062088cfaaed
-
SHA256
e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d
-
SHA512
9e8f83548e890edd939273c3950c03b67a43d679d43956df31e00860158168e9a178dc354834e5260c6096c77e173f68547d73e0d3f6661f08db7f41e10c3d8d
-
SSDEEP
24576:fJeJfAqkjp98zHpieTXCeGOxmI8/+po9TFEu5OJe:BeJfAJGpLrCeGOxmsQTFEu5OJ
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe rundll.exe" e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe -
Disables Task Manager via registry modification
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Windows\\system32\\regsvr.exe" e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\q: e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe File opened (read-only) \??\a: e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe File opened (read-only) \??\f: e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe File opened (read-only) \??\h: e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe File opened (read-only) \??\j: e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe File opened (read-only) \??\k: e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe File opened (read-only) \??\n: e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe File opened (read-only) \??\o: e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe File opened (read-only) \??\r: e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe File opened (read-only) \??\z: e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe File opened (read-only) \??\g: e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe File opened (read-only) \??\p: e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe File opened (read-only) \??\t: e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe File opened (read-only) \??\v: e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe File opened (read-only) \??\x: e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe File opened (read-only) \??\y: e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe File opened (read-only) \??\e: e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe File opened (read-only) \??\i: e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe File opened (read-only) \??\l: e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe File opened (read-only) \??\s: e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe File opened (read-only) \??\b: e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe File opened (read-only) \??\m: e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe File opened (read-only) \??\u: e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe File opened (read-only) \??\w: e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe -
Modifies WinLogon 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\system = "Winhelp.exe" e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/1976-55-0x0000000000400000-0x00000000004B6000-memory.dmp autoit_exe behavioral1/memory/1976-62-0x0000000000400000-0x00000000004B6000-memory.dmp autoit_exe -
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\regsvr.exe e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe File opened for modification C:\Windows\SysWOW64\regsvr.exe e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe File created C:\Windows\SysWOW64\winhelp.exe e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe File opened for modification C:\Windows\SysWOW64\winhelp.exe e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe File opened for modification C:\Windows\SysWOW64\setup.ini e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\winhelp.ini e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe File opened for modification C:\Windows\winhelp.ini e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe File created C:\Windows\regsvr.exe e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe File opened for modification C:\Windows\regsvr.exe e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1976 wrote to memory of 1952 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 26 PID 1976 wrote to memory of 1952 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 26 PID 1976 wrote to memory of 1952 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 26 PID 1976 wrote to memory of 1952 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 26 PID 1952 wrote to memory of 824 1952 cmd.exe 28 PID 1952 wrote to memory of 824 1952 cmd.exe 28 PID 1952 wrote to memory of 824 1952 cmd.exe 28 PID 1952 wrote to memory of 824 1952 cmd.exe 28 PID 1976 wrote to memory of 1180 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 29 PID 1976 wrote to memory of 1180 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 29 PID 1976 wrote to memory of 1180 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 29 PID 1976 wrote to memory of 1180 1976 e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe 29 PID 1180 wrote to memory of 1288 1180 cmd.exe 31 PID 1180 wrote to memory of 1288 1180 cmd.exe 31 PID 1180 wrote to memory of 1288 1180 cmd.exe 31 PID 1180 wrote to memory of 1288 1180 cmd.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe"C:\Users\Admin\AppData\Local\Temp\e49132ac287389f5e3b92d29349b76aabbe29f7cfa53fbfe22d5952d4657ff4d.exe"1⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Adds Run key to start application
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes2⤵
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\at.exeAT /delete /yes3⤵PID:824
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\winhelp.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\winhelp.exe3⤵PID:1288
-
-