Analysis
-
max time kernel
149s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30/10/2022, 03:31
Static task
static1
Behavioral task
behavioral1
Sample
2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe
Resource
win7-20220812-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe
-
Size
941KB
-
MD5
5dc1cfe63eae44a81bda99350e29020b
-
SHA1
fd516f851784eecd10e4ff38e2b54f897c2c1a66
-
SHA256
2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91
-
SHA512
8d604af7079d0ce74a89b88e3fbf1e65a138a90ca6699a2750431a7a2c2a3600a1ece83a00bad4e67d233907ea60627272bb870e502289079a541467e2e1ad46
-
SSDEEP
12288:rj9l69ZU++3jUOIcr1MFNXJU6MqmITDpgrJ9YQ1DNIZmzIbwUB/9:rDsOIcrMXPMq6RimzIbwu/9
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe smrss.exe" 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe -
Executes dropped EXE 1 IoCs
pid Process 1752 31332.exe -
Loads dropped DLL 1 IoCs
pid Process 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\WINDOWS\\system32\\svchost.exe" reg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\freizer = "C:\\WINDOWS\\system32\\freizer.exe" reg.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\smrss.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Windows\SysWOW64\smrss.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File created C:\WINDOWS\SysWOW64\freizer.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateBroker.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\Hearts.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleCrashHandler.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-hang-ui.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateOnDemand.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Windows Sidebar\sidebar.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateCore.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{89BA9AFB-5EEA-4B19-9C5E-CEDE048A6D36}\chrome_installer.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Windows Journal\PDIALOG.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Java\jre7\bin\servertool.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Windows Journal\Journal.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Java\jre7\bin\javacpl.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\notification_helper.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\WINDOWS\svchost.exe 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1752 31332.exe 1752 31332.exe 1752 31332.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1920 wrote to memory of 1972 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 28 PID 1920 wrote to memory of 1972 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 28 PID 1920 wrote to memory of 1972 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 28 PID 1920 wrote to memory of 1972 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 28 PID 1920 wrote to memory of 1452 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 30 PID 1920 wrote to memory of 1452 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 30 PID 1920 wrote to memory of 1452 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 30 PID 1920 wrote to memory of 1452 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 30 PID 1452 wrote to memory of 864 1452 cmd.exe 32 PID 1452 wrote to memory of 864 1452 cmd.exe 32 PID 1452 wrote to memory of 864 1452 cmd.exe 32 PID 1452 wrote to memory of 864 1452 cmd.exe 32 PID 1972 wrote to memory of 856 1972 cmd.exe 33 PID 1972 wrote to memory of 856 1972 cmd.exe 33 PID 1972 wrote to memory of 856 1972 cmd.exe 33 PID 1972 wrote to memory of 856 1972 cmd.exe 33 PID 1920 wrote to memory of 1752 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 34 PID 1920 wrote to memory of 1752 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 34 PID 1920 wrote to memory of 1752 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 34 PID 1920 wrote to memory of 1752 1920 2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe"C:\Users\Admin\AppData\Local\Temp\2ca87f44cb8c43acfd7fbd1553439f029b06666a5b891d0a162bc889b5812f91.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\cmd.execmd /c reg ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v freizer /t REG_SZ /d C:\WINDOWS\system32\freizer.exe /f2⤵
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\SysWOW64\reg.exereg ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v freizer /t REG_SZ /d C:\WINDOWS\system32\freizer.exe /f3⤵
- Adds Run key to start application
PID:856
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c reg ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v svchost /t REG_SZ /d C:\WINDOWS\system32\svchost.exe /f2⤵
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Windows\SysWOW64\reg.exereg ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v svchost /t REG_SZ /d C:\WINDOWS\system32\svchost.exe /f3⤵
- Adds Run key to start application
PID:864
-
-
-
C:\windows\temp\31332.exe"C:\windows\temp\31332.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1752
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
312KB
MD56b5ed259ffcdd40663007b6047e1efe0
SHA1c2a1991493682285eed4ecf3e47b27431d8ea0db
SHA256b9320542d9e3dab454881b771c3895e1bdc96d603379cbb597fd8bd7dc9f2719
SHA5129ecaed27389750f0902dfdfc59fae513b6870c13238e0d89c7bd9c05bc000d4f60dc7f3601e68e3c87bdd609a9df1b723a67442f49a37e5659cbaefc8452ec31
-
Filesize
312KB
MD56b5ed259ffcdd40663007b6047e1efe0
SHA1c2a1991493682285eed4ecf3e47b27431d8ea0db
SHA256b9320542d9e3dab454881b771c3895e1bdc96d603379cbb597fd8bd7dc9f2719
SHA5129ecaed27389750f0902dfdfc59fae513b6870c13238e0d89c7bd9c05bc000d4f60dc7f3601e68e3c87bdd609a9df1b723a67442f49a37e5659cbaefc8452ec31