Analysis
-
max time kernel
152s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-10-2022 03:30
Static task
static1
Behavioral task
behavioral1
Sample
c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe
Resource
win7-20220812-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe
-
Size
999KB
-
MD5
a304f49554ed7ebb5b9b512708b717e1
-
SHA1
d4582d81d7a2f13f31100f2b858c0f64e6b2889b
-
SHA256
c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e
-
SHA512
52edcbcf88dc5339ace5122a482c6909aee03e61ea4a69998efc14e7e62e62f21ae660269c635d3bad2333101aeb9436a3ce84330ab82bcb989583dada1b242d
-
SSDEEP
6144:a+nglw9ayQv3ahvyn/PU7O0KXgTTSjyEN2ERBOzllz5jtGvA4qVub/OBHDbXDgbM:rjS3Yvyn/0Tvlzq44qEUTDzLFt
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe smrss.exe" c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe -
Executes dropped EXE 1 IoCs
pid Process 1280 34212.exe -
Loads dropped DLL 2 IoCs
pid Process 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\freizer = "C:\\WINDOWS\\system32\\freizer.exe" reg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\WINDOWS\\system32\\svchost.exe" reg.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\smrss.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Windows\SysWOW64\smrss.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File created C:\WINDOWS\SysWOW64\freizer.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateBroker.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Windows Journal\Journal.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Windows Media Player\wmpenc.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleCrashHandler.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Microsoft Games\Chess\Chess.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Java\jre7\bin\ssvagent.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Java\jre7\bin\keytool.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Windows Media Player\WMPDMC.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Java\jre7\bin\klist.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateSetup.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\WINDOWS\svchost.exe c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1708 wrote to memory of 1856 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 26 PID 1708 wrote to memory of 1856 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 26 PID 1708 wrote to memory of 1856 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 26 PID 1708 wrote to memory of 1856 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 26 PID 1708 wrote to memory of 1704 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 28 PID 1708 wrote to memory of 1704 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 28 PID 1708 wrote to memory of 1704 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 28 PID 1708 wrote to memory of 1704 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 28 PID 1704 wrote to memory of 1976 1704 cmd.exe 31 PID 1704 wrote to memory of 1976 1704 cmd.exe 31 PID 1704 wrote to memory of 1976 1704 cmd.exe 31 PID 1704 wrote to memory of 1976 1704 cmd.exe 31 PID 1856 wrote to memory of 1168 1856 cmd.exe 30 PID 1856 wrote to memory of 1168 1856 cmd.exe 30 PID 1856 wrote to memory of 1168 1856 cmd.exe 30 PID 1856 wrote to memory of 1168 1856 cmd.exe 30 PID 1708 wrote to memory of 1280 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 32 PID 1708 wrote to memory of 1280 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 32 PID 1708 wrote to memory of 1280 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 32 PID 1708 wrote to memory of 1280 1708 c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe"C:\Users\Admin\AppData\Local\Temp\c70867e6da7dfe18a0221c7184784f8143909031d67e5251ae32e8d774be8d9e.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\cmd.execmd /c reg ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v freizer /t REG_SZ /d C:\WINDOWS\system32\freizer.exe /f2⤵
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\reg.exereg ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v freizer /t REG_SZ /d C:\WINDOWS\system32\freizer.exe /f3⤵
- Adds Run key to start application
PID:1168
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c reg ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v svchost /t REG_SZ /d C:\WINDOWS\system32\svchost.exe /f2⤵
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\reg.exereg ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v svchost /t REG_SZ /d C:\WINDOWS\system32\svchost.exe /f3⤵
- Adds Run key to start application
PID:1976
-
-
-
C:\windows\temp\34212.exe"C:\windows\temp\34212.exe"2⤵
- Executes dropped EXE
PID:1280
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
117KB
MD5a31cad2960a660cb558b32ba7236b49e
SHA1b9aaaade26a07000d13550ec2de5008315750d65
SHA256763fccd41404d4ea9191df4aa36ffe603d932cf54279aa8260fe1eaeb7f800bf
SHA512d4652d059f3c9510846497188e697c1b9af0b5ab710046eb25ff965d760c4a35db1270bfd4fe8bebf59add3c63bf9173ee194c3b145f974f52c393e0bd47d0cf
-
Filesize
117KB
MD5a31cad2960a660cb558b32ba7236b49e
SHA1b9aaaade26a07000d13550ec2de5008315750d65
SHA256763fccd41404d4ea9191df4aa36ffe603d932cf54279aa8260fe1eaeb7f800bf
SHA512d4652d059f3c9510846497188e697c1b9af0b5ab710046eb25ff965d760c4a35db1270bfd4fe8bebf59add3c63bf9173ee194c3b145f974f52c393e0bd47d0cf
-
Filesize
117KB
MD5a31cad2960a660cb558b32ba7236b49e
SHA1b9aaaade26a07000d13550ec2de5008315750d65
SHA256763fccd41404d4ea9191df4aa36ffe603d932cf54279aa8260fe1eaeb7f800bf
SHA512d4652d059f3c9510846497188e697c1b9af0b5ab710046eb25ff965d760c4a35db1270bfd4fe8bebf59add3c63bf9173ee194c3b145f974f52c393e0bd47d0cf