Analysis
-
max time kernel
152s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
30-10-2022 07:16
Static task
static1
Behavioral task
behavioral1
Sample
53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe
Resource
win7-20220812-en
windows7-x64
15 signatures
150 seconds
General
-
Target
53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe
-
Size
269KB
-
MD5
57a8e8164abfa421719eaabf5b6724d0
-
SHA1
56bd47864f4fca9ab8005365262aa16148366cd2
-
SHA256
53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08
-
SHA512
b77f411cbd12b7d61453755bb831cfd785cd2cdedd520165427552f2199df410e6b92d39add6a43fee539dcae29536b42102feeebb176cd6ea3575d23131c193
-
SSDEEP
3072:bNxxryjRaR/wQkdKq/8cPoEOMlE/3H/QDjpt7cuwBCi1BHHBFobHbEzVa8/RX4P/:bEjRV/84obRffs7UCi8zbE1+
Malware Config
Extracted
Family
pony
C2
http://bosconova.com/mcs/gate.php
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 4400 NcbService.exe 3460 CertPropSvc.exe 4256 CertPropSvc.exe 4656 NcbService.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation CertPropSvc.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts CertPropSvc.exe -
Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook CertPropSvc.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3268 set thread context of 3536 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 91 PID 3460 set thread context of 4256 3460 CertPropSvc.exe 95 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 4400 NcbService.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 4400 NcbService.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 4400 NcbService.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeImpersonatePrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeTcbPrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeChangeNotifyPrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeCreateTokenPrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeBackupPrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeRestorePrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeIncreaseQuotaPrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeAssignPrimaryTokenPrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeImpersonatePrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeTcbPrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeChangeNotifyPrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeCreateTokenPrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeBackupPrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeRestorePrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeIncreaseQuotaPrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeAssignPrimaryTokenPrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeImpersonatePrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeTcbPrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeChangeNotifyPrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeCreateTokenPrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeBackupPrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeRestorePrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeIncreaseQuotaPrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeAssignPrimaryTokenPrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeImpersonatePrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeTcbPrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeChangeNotifyPrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeCreateTokenPrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeBackupPrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeRestorePrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeIncreaseQuotaPrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeAssignPrimaryTokenPrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeImpersonatePrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeTcbPrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeChangeNotifyPrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeCreateTokenPrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeBackupPrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeRestorePrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeIncreaseQuotaPrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeAssignPrimaryTokenPrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeImpersonatePrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeTcbPrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeChangeNotifyPrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeCreateTokenPrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeBackupPrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeRestorePrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeIncreaseQuotaPrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeAssignPrimaryTokenPrivilege 3536 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe Token: SeDebugPrivilege 4400 NcbService.exe Token: SeDebugPrivilege 3460 CertPropSvc.exe Token: SeImpersonatePrivilege 4256 CertPropSvc.exe Token: SeTcbPrivilege 4256 CertPropSvc.exe Token: SeChangeNotifyPrivilege 4256 CertPropSvc.exe Token: SeCreateTokenPrivilege 4256 CertPropSvc.exe Token: SeBackupPrivilege 4256 CertPropSvc.exe Token: SeRestorePrivilege 4256 CertPropSvc.exe Token: SeIncreaseQuotaPrivilege 4256 CertPropSvc.exe Token: SeAssignPrimaryTokenPrivilege 4256 CertPropSvc.exe Token: SeImpersonatePrivilege 4256 CertPropSvc.exe Token: SeTcbPrivilege 4256 CertPropSvc.exe Token: SeChangeNotifyPrivilege 4256 CertPropSvc.exe Token: SeCreateTokenPrivilege 4256 CertPropSvc.exe Token: SeBackupPrivilege 4256 CertPropSvc.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 3268 wrote to memory of 3536 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 91 PID 3268 wrote to memory of 3536 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 91 PID 3268 wrote to memory of 3536 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 91 PID 3268 wrote to memory of 3536 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 91 PID 3268 wrote to memory of 3536 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 91 PID 3268 wrote to memory of 3536 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 91 PID 3268 wrote to memory of 3536 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 91 PID 3268 wrote to memory of 3536 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 91 PID 3268 wrote to memory of 3536 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 91 PID 3268 wrote to memory of 4400 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 93 PID 3268 wrote to memory of 4400 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 93 PID 3268 wrote to memory of 4400 3268 53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe 93 PID 4400 wrote to memory of 3460 4400 NcbService.exe 94 PID 4400 wrote to memory of 3460 4400 NcbService.exe 94 PID 4400 wrote to memory of 3460 4400 NcbService.exe 94 PID 3460 wrote to memory of 4256 3460 CertPropSvc.exe 95 PID 3460 wrote to memory of 4256 3460 CertPropSvc.exe 95 PID 3460 wrote to memory of 4256 3460 CertPropSvc.exe 95 PID 3460 wrote to memory of 4256 3460 CertPropSvc.exe 95 PID 3460 wrote to memory of 4256 3460 CertPropSvc.exe 95 PID 3460 wrote to memory of 4256 3460 CertPropSvc.exe 95 PID 3460 wrote to memory of 4256 3460 CertPropSvc.exe 95 PID 3460 wrote to memory of 4256 3460 CertPropSvc.exe 95 PID 3460 wrote to memory of 4256 3460 CertPropSvc.exe 95 PID 3460 wrote to memory of 4656 3460 CertPropSvc.exe 96 PID 3460 wrote to memory of 4656 3460 CertPropSvc.exe 96 PID 3460 wrote to memory of 4656 3460 CertPropSvc.exe 96 -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook CertPropSvc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe"C:\Users\Admin\AppData\Local\Temp\53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe"C:\Users\Admin\AppData\Local\Temp\53622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08.exe"2⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
PID:3536
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exe"4⤵
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_win_path
PID:4256
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe"4⤵
- Executes dropped EXE
PID:4656
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
404B
MD515b6596d028baa2a113143d1828bcc36
SHA1f1be43126c4e765fe499718c388823d44bf1fef1
SHA256529f9fde2234067382b4c6fb8e5aee49d8a8b1b85c82b0bdae425fa2a0264f75
SHA512f2a6cb8498f596c7bf9178ea32a245dbb3657f43a179f378ce952ce5cb8580810cd67ef1efb623bcf6cd796d74e2c9b7bc42cb8665ead397546ce3b400181e83
-
Filesize
269KB
MD557a8e8164abfa421719eaabf5b6724d0
SHA156bd47864f4fca9ab8005365262aa16148366cd2
SHA25653622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08
SHA512b77f411cbd12b7d61453755bb831cfd785cd2cdedd520165427552f2199df410e6b92d39add6a43fee539dcae29536b42102feeebb176cd6ea3575d23131c193
-
Filesize
269KB
MD557a8e8164abfa421719eaabf5b6724d0
SHA156bd47864f4fca9ab8005365262aa16148366cd2
SHA25653622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08
SHA512b77f411cbd12b7d61453755bb831cfd785cd2cdedd520165427552f2199df410e6b92d39add6a43fee539dcae29536b42102feeebb176cd6ea3575d23131c193
-
Filesize
269KB
MD557a8e8164abfa421719eaabf5b6724d0
SHA156bd47864f4fca9ab8005365262aa16148366cd2
SHA25653622b8898937072e67d11ea5224d5f78cfb9f23a61d1a076a14519f77e46f08
SHA512b77f411cbd12b7d61453755bb831cfd785cd2cdedd520165427552f2199df410e6b92d39add6a43fee539dcae29536b42102feeebb176cd6ea3575d23131c193
-
Filesize
8KB
MD5f9fe1396d5b9cb38c12bfaa7984e3054
SHA1aff30e9431717d5ea325d3737956dae6bb748d4b
SHA2569d6f5ca2dbd1bad6dbbc938e92a2f0e59993aada7482b386c2833dff9a7644f7
SHA51242c40c62b0b84d99711ae067d256972305eaf28bafd2cce4e84138d6c11257e812dd6b489f39ad653e2ecbde1fa05cdf8809c9d2a5a05a4c98c89d5fa5f7ade3
-
Filesize
8KB
MD5f9fe1396d5b9cb38c12bfaa7984e3054
SHA1aff30e9431717d5ea325d3737956dae6bb748d4b
SHA2569d6f5ca2dbd1bad6dbbc938e92a2f0e59993aada7482b386c2833dff9a7644f7
SHA51242c40c62b0b84d99711ae067d256972305eaf28bafd2cce4e84138d6c11257e812dd6b489f39ad653e2ecbde1fa05cdf8809c9d2a5a05a4c98c89d5fa5f7ade3
-
Filesize
8KB
MD5f9fe1396d5b9cb38c12bfaa7984e3054
SHA1aff30e9431717d5ea325d3737956dae6bb748d4b
SHA2569d6f5ca2dbd1bad6dbbc938e92a2f0e59993aada7482b386c2833dff9a7644f7
SHA51242c40c62b0b84d99711ae067d256972305eaf28bafd2cce4e84138d6c11257e812dd6b489f39ad653e2ecbde1fa05cdf8809c9d2a5a05a4c98c89d5fa5f7ade3
-
Filesize
8KB
MD5f9fe1396d5b9cb38c12bfaa7984e3054
SHA1aff30e9431717d5ea325d3737956dae6bb748d4b
SHA2569d6f5ca2dbd1bad6dbbc938e92a2f0e59993aada7482b386c2833dff9a7644f7
SHA51242c40c62b0b84d99711ae067d256972305eaf28bafd2cce4e84138d6c11257e812dd6b489f39ad653e2ecbde1fa05cdf8809c9d2a5a05a4c98c89d5fa5f7ade3