Analysis
-
max time kernel
139s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
21/11/2022, 11:54
Static task
static1
Behavioral task
behavioral1
Sample
27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe
Resource
win7-20220901-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe
-
Size
701KB
-
MD5
0a4a1902275248e1644f11f0e4a9ddd0
-
SHA1
affc46b23ee9a38346c8bbaea21e7739924f29c6
-
SHA256
27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3
-
SHA512
4bfd96b8906beab6ab3e701948fa90da1e3704645d03981991370531bb0b504458f213a36d6638f35893dac8c9cf6f148ad2526b978e7a257992394a308c05ee
-
SSDEEP
6144:a+nglw9ayQv3ahvyn/PU7O0KXgTTSjiZ7ifckWEN4+Ugh+VuSfCpJipim:rjS3Yvyn/0TvhifHW8NUnVuSaXi1
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe smrss.exe" 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe -
Executes dropped EXE 1 IoCs
pid Process 2816 21113.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\WINDOWS\\system32\\svchost.exe" reg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\freizer = "C:\\WINDOWS\\system32\\freizer.exe" reg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\smrss.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Windows\SysWOW64\smrss.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File created C:\WINDOWS\SysWOW64\freizer.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\schemagen.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jp2launcher.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ssvagent.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\kinit.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\klist.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jabswitch.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ktab.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\tnameserv.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmc.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ktab.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javacpl.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\pack200.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jvisualvm.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\keytool.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec64.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmid.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\7-Zip\7z.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstatd.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\ktab.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\pack200.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\keytool.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jp2launcher.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\orbd.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\policytool.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\policytool.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\pack200.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\servertool.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\notification_helper.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\klist.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java-rmi.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\kinit.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\WINDOWS\svchost.exe 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4588 wrote to memory of 4944 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 82 PID 4588 wrote to memory of 4944 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 82 PID 4588 wrote to memory of 4944 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 82 PID 4588 wrote to memory of 988 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 83 PID 4588 wrote to memory of 988 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 83 PID 4588 wrote to memory of 988 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 83 PID 988 wrote to memory of 4332 988 cmd.exe 86 PID 988 wrote to memory of 4332 988 cmd.exe 86 PID 988 wrote to memory of 4332 988 cmd.exe 86 PID 4944 wrote to memory of 1380 4944 cmd.exe 87 PID 4944 wrote to memory of 1380 4944 cmd.exe 87 PID 4944 wrote to memory of 1380 4944 cmd.exe 87 PID 4588 wrote to memory of 2816 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 88 PID 4588 wrote to memory of 2816 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 88 PID 4588 wrote to memory of 2816 4588 27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe"C:\Users\Admin\AppData\Local\Temp\27d753449438fad15e39cedaa82835811751fbfb632ed3213504a1308a3e11a3.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Windows\SysWOW64\cmd.execmd /c reg ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v freizer /t REG_SZ /d C:\WINDOWS\system32\freizer.exe /f2⤵
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\reg.exereg ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v freizer /t REG_SZ /d C:\WINDOWS\system32\freizer.exe /f3⤵
- Adds Run key to start application
PID:1380
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c reg ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v svchost /t REG_SZ /d C:\WINDOWS\system32\svchost.exe /f2⤵
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\SysWOW64\reg.exereg ADD HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /v svchost /t REG_SZ /d C:\WINDOWS\system32\svchost.exe /f3⤵
- Adds Run key to start application
PID:4332
-
-
-
C:\windows\temp\21113.exe"C:\windows\temp\21113.exe"2⤵
- Executes dropped EXE
PID:2816
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD534a0b44796543ce75f0cf99e31c847f6
SHA1b388c1903611e0ab9df4097a9deff81f05f5275d
SHA25657416c130191468a1f9f5c2ba044c01a3f8cc9ae6c942370a68cf9da09ea6e7b
SHA512a2a06d5c58fd2faab784f4fcd03d08e3cd530e1b0cac1ea4d498a6ffe0da9efcc2e9f6e1ff3b50eb171ba885b3d4a547a7a98e1836ff454dc0ee0cec97bce3c0
-
Filesize
14KB
MD534a0b44796543ce75f0cf99e31c847f6
SHA1b388c1903611e0ab9df4097a9deff81f05f5275d
SHA25657416c130191468a1f9f5c2ba044c01a3f8cc9ae6c942370a68cf9da09ea6e7b
SHA512a2a06d5c58fd2faab784f4fcd03d08e3cd530e1b0cac1ea4d498a6ffe0da9efcc2e9f6e1ff3b50eb171ba885b3d4a547a7a98e1836ff454dc0ee0cec97bce3c0