Analysis
-
max time kernel
150s -
max time network
56s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
21-10-2022 19:18
Static task
static1
Behavioral task
behavioral1
Sample
b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe
Resource
win10v2004-20220812-en
General
-
Target
b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe
-
Size
1.7MB
-
MD5
597029dcb2738c17be6d79814cdaf229
-
SHA1
4a99520e5e2070d02883cdba89ecf188b3b39add
-
SHA256
b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd
-
SHA512
6d80f6cbaf71e20f8622d0d3bdf4a263da9cddad8d53c4230ff0df302feba29a297f66fa9fb04c4660e5227074c3f6c8f97b2f770054c749f9f002691b6094d0
-
SSDEEP
24576:eRmJkcoQricOIQxiZY1iaH0xxxxxxxxxxxxxxvMi6Ro1s8JyfsOqa6tBkazn572J:LJZoQrbTFZY1ia8MiNFyfsOlc95Iku
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/584-73-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/584-75-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/584-76-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/584-79-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/584-80-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/584-85-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/1960-87-0x0000000001610000-0x000000000171E000-memory.dmp upx behavioral1/memory/1960-90-0x0000000001610000-0x000000000171E000-memory.dmp upx behavioral1/memory/1960-93-0x0000000001610000-0x000000000171E000-memory.dmp upx behavioral1/memory/1960-96-0x0000000001610000-0x000000000171E000-memory.dmp upx behavioral1/memory/1960-99-0x0000000001610000-0x000000000171E000-memory.dmp upx behavioral1/memory/1960-100-0x0000000001610000-0x000000000171E000-memory.dmp upx behavioral1/memory/1960-101-0x0000000001610000-0x000000000171E000-memory.dmp upx behavioral1/memory/584-106-0x0000000000400000-0x000000000041B000-memory.dmp upx -
Drops startup file 2 IoCs
Processes:
b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exeb1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exedescription pid process target process PID 1376 set thread context of 1080 1376 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe PID 1376 set thread context of 584 1376 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe PID 1080 set thread context of 1960 1080 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exeb1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exeb1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exepid process 1376 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 1376 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 1376 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 1376 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 1376 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 1376 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 1376 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 1376 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 1960 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
Processes:
b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exeb1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exepid process 960 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 960 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 960 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 1376 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 1376 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 1376 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe -
Suspicious use of SendNotifyMessage 6 IoCs
Processes:
b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exeb1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exepid process 960 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 960 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 960 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 1376 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 1376 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 1376 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exeb1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exeb1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exepid process 584 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 1080 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe 1960 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exeb1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exeb1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exedescription pid process target process PID 960 wrote to memory of 1376 960 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe PID 960 wrote to memory of 1376 960 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe PID 960 wrote to memory of 1376 960 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe PID 960 wrote to memory of 1376 960 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe PID 1376 wrote to memory of 1080 1376 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe PID 1376 wrote to memory of 1080 1376 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe PID 1376 wrote to memory of 1080 1376 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe PID 1376 wrote to memory of 1080 1376 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe PID 1376 wrote to memory of 1080 1376 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe PID 1376 wrote to memory of 1080 1376 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe PID 1376 wrote to memory of 1080 1376 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe PID 1376 wrote to memory of 1080 1376 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe PID 1376 wrote to memory of 1080 1376 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe PID 1376 wrote to memory of 1080 1376 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe PID 1376 wrote to memory of 1080 1376 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe PID 1376 wrote to memory of 1080 1376 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe PID 1376 wrote to memory of 584 1376 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe PID 1376 wrote to memory of 584 1376 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe PID 1376 wrote to memory of 584 1376 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe PID 1376 wrote to memory of 584 1376 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe PID 1376 wrote to memory of 584 1376 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe PID 1376 wrote to memory of 584 1376 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe PID 1376 wrote to memory of 584 1376 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe PID 1376 wrote to memory of 584 1376 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe PID 1080 wrote to memory of 1960 1080 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe PID 1080 wrote to memory of 1960 1080 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe PID 1080 wrote to memory of 1960 1080 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe PID 1080 wrote to memory of 1960 1080 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe PID 1080 wrote to memory of 1960 1080 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe PID 1080 wrote to memory of 1960 1080 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe PID 1080 wrote to memory of 1960 1080 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe PID 1080 wrote to memory of 1960 1080 b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe"C:\Users\Admin\AppData\Local\Temp\b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe"C:\Users\Admin\AppData\Local\Temp\b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe" /AutoIt3ExecuteScript C:\Users\Admin\AppData\Local\Temp\eWEpCwslF2⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe"C:\Users\Admin\AppData\Local\Temp\b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exeC:\Users\Admin\AppData\Local\Temp\b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe"C:\Users\Admin\AppData\Local\Temp\b1221bb12788f188e4259305e1d37e91cac7ca2810d0211c45600a23697882bd.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\eWEpCwslFFilesize
812KB
MD5dad5d2d610e1c0264e664f73a10197c6
SHA128ae30e028bd6edf793ba094e937041dd6ac1801
SHA256061fdd248897c3b4ea237ebfbe01f2907d7e2ed69254766ebddd36186b88d4dd
SHA51217a21f5335c03265074106982ce371885f73c0bc932f175e1bedd891d02e1227aa4bb3ba03990c03ed9012c6239ba58d3023a4f21a04a7fa9005535b324dbd92
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\9hGVNkAaKZH\9hGVNkAaKZH.datFilesize
2B
MD593e00066d099c0485cfffa1359246d26
SHA1bc69a773f37b2f2071e25f755a66d47b871e5d98
SHA2563b271649a94ad5be4ef46ecbb6a4e7363e8498b7e69b751737bf30df2e0d1dde
SHA512d3dfe508cacae7d36f13908134b5b438b87429fcf93ccb060bcfa346c04633a99e9ca497297418c969537be1da2405171982794055dd0f52e59a82720d3b3d02
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\9hGVNkAaKZH\9hGVNkAaKZH.nfoFilesize
3KB
MD55fae023d0f4d9d94bcdbf6b5581a71ca
SHA1b6569e50b87b53c912430e8fe1dc1eda4192053e
SHA2561ff222637a9ef5c034bba5747b119bba0b7635aaf308832d2410d83b89f07ea2
SHA51297718df3e5f51d20966e4682bcd3ec29b43deafa912b46977197d51e55a1a34431f601462d658e58f5b6057e6708315b38f3a7432494ba8b0dbac31471b90b1c
-
memory/584-80-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/584-106-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/584-85-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/584-71-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/584-79-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/584-77-0x00000000004193A0-mapping.dmp
-
memory/584-76-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/584-75-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/584-73-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/960-54-0x00000000757A1000-0x00000000757A3000-memory.dmpFilesize
8KB
-
memory/1080-68-0x00000000004085B0-mapping.dmp
-
memory/1080-64-0x0000000000400000-0x000000000046F000-memory.dmpFilesize
444KB
-
memory/1080-65-0x0000000000400000-0x000000000046F000-memory.dmpFilesize
444KB
-
memory/1080-69-0x0000000000400000-0x000000000046F000-memory.dmpFilesize
444KB
-
memory/1080-67-0x0000000000400000-0x000000000046F000-memory.dmpFilesize
444KB
-
memory/1080-63-0x0000000000400000-0x000000000046F000-memory.dmpFilesize
444KB
-
memory/1080-62-0x0000000000400000-0x000000000046F000-memory.dmpFilesize
444KB
-
memory/1080-97-0x0000000000400000-0x000000000046F000-memory.dmpFilesize
444KB
-
memory/1080-84-0x0000000000400000-0x000000000046F000-memory.dmpFilesize
444KB
-
memory/1080-61-0x0000000000400000-0x000000000046F000-memory.dmpFilesize
444KB
-
memory/1080-72-0x0000000000400000-0x000000000046F000-memory.dmpFilesize
444KB
-
memory/1080-59-0x0000000000400000-0x000000000046F000-memory.dmpFilesize
444KB
-
memory/1080-58-0x0000000000400000-0x000000000046F000-memory.dmpFilesize
444KB
-
memory/1376-55-0x0000000000000000-mapping.dmp
-
memory/1960-93-0x0000000001610000-0x000000000171E000-memory.dmpFilesize
1.1MB
-
memory/1960-96-0x0000000001610000-0x000000000171E000-memory.dmpFilesize
1.1MB
-
memory/1960-95-0x000000000171B950-mapping.dmp
-
memory/1960-99-0x0000000001610000-0x000000000171E000-memory.dmpFilesize
1.1MB
-
memory/1960-100-0x0000000001610000-0x000000000171E000-memory.dmpFilesize
1.1MB
-
memory/1960-101-0x0000000001610000-0x000000000171E000-memory.dmpFilesize
1.1MB
-
memory/1960-90-0x0000000001610000-0x000000000171E000-memory.dmpFilesize
1.1MB
-
memory/1960-87-0x0000000001610000-0x000000000171E000-memory.dmpFilesize
1.1MB
-
memory/1960-104-0x00000000016C4000-0x000000000171C000-memory.dmpFilesize
352KB
-
memory/1960-105-0x0000000001611000-0x00000000016C4000-memory.dmpFilesize
716KB
-
memory/1960-86-0x0000000001610000-0x000000000171E000-memory.dmpFilesize
1.1MB
-
memory/1960-107-0x00000000016C4000-0x000000000171C000-memory.dmpFilesize
352KB