Analysis
-
max time kernel
150s -
max time network
80s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30/10/2022, 11:21
Static task
static1
Behavioral task
behavioral1
Sample
a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe
Resource
win10v2004-20220812-en
General
-
Target
a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe
-
Size
122KB
-
MD5
a278c51d045f4c670bea12219c8f6b20
-
SHA1
293426797b79e315bfd7633b3ef20a09ae3a7925
-
SHA256
a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5
-
SHA512
bbf5cc8065edbbc9a8ee65261d6c759b9d594d7f00189d68bde579639e89639d5e76b542fa66f4b3fa8a42189132b25613de8ea6c459c1a04933901b18ed333f
-
SSDEEP
1536:0gkD6vVUs4GuXRvhcSpZmtVVIEf4jYFLdz7hCdHIucMLITR1yA5/qrisKldJ:0gFWphvhcSMH9f4jIL7CdoeLIT/yA9N
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Runonce = "C:\\Windows\\system32\\runouce.exe" a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe File opened (read-only) \??\Y: a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe File opened (read-only) \??\Z: a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe File opened (read-only) \??\G: a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe File opened (read-only) \??\J: a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe File opened (read-only) \??\R: a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe File opened (read-only) \??\U: a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe File opened (read-only) \??\M: a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe File opened (read-only) \??\P: a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe File opened (read-only) \??\Q: a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe File opened (read-only) \??\S: a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe File opened (read-only) \??\E: a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe File opened (read-only) \??\F: a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe File opened (read-only) \??\I: a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe File opened (read-only) \??\L: a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe File opened (read-only) \??\T: a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe File opened (read-only) \??\V: a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe File opened (read-only) \??\H: a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe File opened (read-only) \??\K: a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe File opened (read-only) \??\N: a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe File opened (read-only) \??\X: a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe File opened (read-only) \??\O: a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\runouce.exe a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe File opened for modification C:\WINDOWS\SysWOW64\RUNOUCE.EXE a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe File opened for modification C:\Windows\SysWOW64\runouce.exe a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe -
Suspicious behavior: MapViewOfSection 22 IoCs
pid Process 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeTakeOwnershipPrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeRestorePrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeBackupPrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeChangeNotifyPrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeTakeOwnershipPrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeRestorePrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeBackupPrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeChangeNotifyPrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeTakeOwnershipPrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeRestorePrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeBackupPrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeChangeNotifyPrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeTakeOwnershipPrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeRestorePrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeBackupPrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeChangeNotifyPrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeTakeOwnershipPrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeRestorePrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeBackupPrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeChangeNotifyPrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeTakeOwnershipPrivilege 1140 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeRestorePrivilege 1140 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeBackupPrivilege 1140 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeChangeNotifyPrivilege 1140 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeTakeOwnershipPrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeRestorePrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeBackupPrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeChangeNotifyPrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeTakeOwnershipPrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeRestorePrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeBackupPrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeChangeNotifyPrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeTakeOwnershipPrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeRestorePrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeBackupPrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeChangeNotifyPrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeTakeOwnershipPrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeRestorePrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeBackupPrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeChangeNotifyPrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeTakeOwnershipPrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeRestorePrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeBackupPrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeChangeNotifyPrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeTakeOwnershipPrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeRestorePrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeBackupPrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeChangeNotifyPrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeTakeOwnershipPrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeRestorePrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeBackupPrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeChangeNotifyPrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeTakeOwnershipPrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeRestorePrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeBackupPrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeChangeNotifyPrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeTakeOwnershipPrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeRestorePrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeBackupPrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeChangeNotifyPrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeTakeOwnershipPrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeRestorePrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe Token: SeBackupPrivilege 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1140 wrote to memory of 1016 1140 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 27 PID 1140 wrote to memory of 1016 1140 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 27 PID 1140 wrote to memory of 1016 1140 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 27 PID 1140 wrote to memory of 1016 1140 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 27 PID 1016 wrote to memory of 372 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 5 PID 1016 wrote to memory of 372 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 5 PID 1016 wrote to memory of 372 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 5 PID 1016 wrote to memory of 372 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 5 PID 1016 wrote to memory of 372 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 5 PID 1016 wrote to memory of 384 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 4 PID 1016 wrote to memory of 384 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 4 PID 1016 wrote to memory of 384 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 4 PID 1016 wrote to memory of 384 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 4 PID 1016 wrote to memory of 384 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 4 PID 1016 wrote to memory of 420 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 3 PID 1016 wrote to memory of 420 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 3 PID 1016 wrote to memory of 420 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 3 PID 1016 wrote to memory of 420 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 3 PID 1016 wrote to memory of 420 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 3 PID 1016 wrote to memory of 468 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 2 PID 1016 wrote to memory of 468 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 2 PID 1016 wrote to memory of 468 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 2 PID 1016 wrote to memory of 468 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 2 PID 1016 wrote to memory of 468 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 2 PID 1016 wrote to memory of 476 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 1 PID 1016 wrote to memory of 476 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 1 PID 1016 wrote to memory of 476 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 1 PID 1016 wrote to memory of 476 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 1 PID 1016 wrote to memory of 476 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 1 PID 1016 wrote to memory of 484 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 8 PID 1016 wrote to memory of 484 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 8 PID 1016 wrote to memory of 484 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 8 PID 1016 wrote to memory of 484 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 8 PID 1016 wrote to memory of 484 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 8 PID 1016 wrote to memory of 600 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 25 PID 1016 wrote to memory of 600 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 25 PID 1016 wrote to memory of 600 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 25 PID 1016 wrote to memory of 600 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 25 PID 1016 wrote to memory of 600 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 25 PID 1016 wrote to memory of 676 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 24 PID 1016 wrote to memory of 676 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 24 PID 1016 wrote to memory of 676 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 24 PID 1016 wrote to memory of 676 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 24 PID 1016 wrote to memory of 676 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 24 PID 1016 wrote to memory of 764 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 23 PID 1016 wrote to memory of 764 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 23 PID 1016 wrote to memory of 764 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 23 PID 1016 wrote to memory of 764 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 23 PID 1016 wrote to memory of 764 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 23 PID 1016 wrote to memory of 824 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 22 PID 1016 wrote to memory of 824 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 22 PID 1016 wrote to memory of 824 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 22 PID 1016 wrote to memory of 824 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 22 PID 1016 wrote to memory of 824 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 22 PID 1016 wrote to memory of 860 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 21 PID 1016 wrote to memory of 860 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 21 PID 1016 wrote to memory of 860 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 21 PID 1016 wrote to memory of 860 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 21 PID 1016 wrote to memory of 860 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 21 PID 1016 wrote to memory of 888 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 20 PID 1016 wrote to memory of 888 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 20 PID 1016 wrote to memory of 888 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 20 PID 1016 wrote to memory of 888 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 20 PID 1016 wrote to memory of 888 1016 a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe 20
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:476
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵PID:468
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵PID:1588
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵PID:1632
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵PID:1156
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵PID:1056
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵PID:280
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵PID:300
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵PID:888
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵PID:860
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵PID:824
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵PID:764
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵PID:676
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵PID:600
-
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:420
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:384
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:372
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:484
-
-
\\?\C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R1⤵PID:1116
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe"C:\Users\Admin\AppData\Local\Temp\a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe"2⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe"C:\Users\Admin\AppData\Local\Temp\a1906e5dc11f44775450aa73320bbba67709a7dc195bc77903617b5356892bf5.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1016
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1228