Analysis
-
max time kernel
159s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2022 19:02
Static task
static1
Behavioral task
behavioral1
Sample
38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe
Resource
win10v2004-20221111-en
General
-
Target
38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe
-
Size
580KB
-
MD5
0484f772e045b1e8029d3cca90fea9c2
-
SHA1
4dc084088bbe3ce8b00c578282539f0efa125cb4
-
SHA256
38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95
-
SHA512
f93da0eb01d1758c9ee8d66347c40989c46648df48b287f80faec0feb62828426b4934bcdc48e7ccedc66b3cc50cd64d5b64f6315f8a1619cb3ea86a7c7fb670
-
SSDEEP
12288:r0Yyb5eyBc0I8aVbHtfu6oPFmz2JNQxi8WbxV450oM5B:r0/5fwxfGXJ+1uQVM
Malware Config
Extracted
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
dknenltgrbejvytn
Signatures
-
NirSoft MailPassView 5 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/3980-135-0x0000000000400000-0x0000000000484000-memory.dmp MailPassView behavioral2/memory/4720-159-0x0000000000000000-mapping.dmp MailPassView behavioral2/memory/4720-160-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral2/memory/4720-162-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral2/memory/4720-163-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 6 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral2/memory/3980-135-0x0000000000400000-0x0000000000484000-memory.dmp WebBrowserPassView behavioral2/memory/5096-165-0x0000000000000000-mapping.dmp WebBrowserPassView behavioral2/memory/5096-166-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral2/memory/5096-168-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral2/memory/5096-169-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral2/memory/5096-171-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView -
Nirsoft 10 IoCs
Processes:
resource yara_rule behavioral2/memory/3980-135-0x0000000000400000-0x0000000000484000-memory.dmp Nirsoft behavioral2/memory/4720-159-0x0000000000000000-mapping.dmp Nirsoft behavioral2/memory/4720-160-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/4720-162-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/4720-163-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/5096-165-0x0000000000000000-mapping.dmp Nirsoft behavioral2/memory/5096-166-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral2/memory/5096-168-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral2/memory/5096-169-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral2/memory/5096-171-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft -
Executes dropped EXE 4 IoCs
Processes:
WUDHost.exeAcctres.exeAcctres.exeWUDHost.exepid process 3620 WUDHost.exe 4556 Acctres.exe 3532 Acctres.exe 1964 WUDHost.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exeAcctres.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Control Panel\International\Geo\Nation 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe Key value queried \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Control Panel\International\Geo\Nation Acctres.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
WUDHost.exeWUDHost.exe38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Boot File Servicing Utility = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\WUDHost.exe" WUDHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Boot File Servicing Utility = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\WUDHost.exe" WUDHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 29 whatismyipaddress.com -
Suspicious use of SetThreadContext 4 IoCs
Processes:
38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exeAcctres.exe38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exedescription pid process target process PID 4988 set thread context of 3980 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe PID 4556 set thread context of 3532 4556 Acctres.exe Acctres.exe PID 3980 set thread context of 4720 3980 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe vbc.exe PID 3980 set thread context of 5096 3980 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exepid process 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exeWUDHost.exeAcctres.exeWUDHost.exedescription pid process Token: SeDebugPrivilege 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe Token: SeDebugPrivilege 3980 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe Token: SeDebugPrivilege 3620 WUDHost.exe Token: SeDebugPrivilege 4556 Acctres.exe Token: SeDebugPrivilege 1964 WUDHost.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exeWUDHost.exeAcctres.exe38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exedescription pid process target process PID 4988 wrote to memory of 3980 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe PID 4988 wrote to memory of 3980 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe PID 4988 wrote to memory of 3980 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe PID 4988 wrote to memory of 3980 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe PID 4988 wrote to memory of 3980 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe PID 4988 wrote to memory of 3980 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe PID 4988 wrote to memory of 3980 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe PID 4988 wrote to memory of 3980 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe PID 4988 wrote to memory of 3620 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe WUDHost.exe PID 4988 wrote to memory of 3620 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe WUDHost.exe PID 4988 wrote to memory of 3620 4988 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe WUDHost.exe PID 3620 wrote to memory of 4556 3620 WUDHost.exe Acctres.exe PID 3620 wrote to memory of 4556 3620 WUDHost.exe Acctres.exe PID 3620 wrote to memory of 4556 3620 WUDHost.exe Acctres.exe PID 4556 wrote to memory of 3532 4556 Acctres.exe Acctres.exe PID 4556 wrote to memory of 3532 4556 Acctres.exe Acctres.exe PID 4556 wrote to memory of 3532 4556 Acctres.exe Acctres.exe PID 4556 wrote to memory of 3532 4556 Acctres.exe Acctres.exe PID 4556 wrote to memory of 3532 4556 Acctres.exe Acctres.exe PID 4556 wrote to memory of 3532 4556 Acctres.exe Acctres.exe PID 4556 wrote to memory of 3532 4556 Acctres.exe Acctres.exe PID 4556 wrote to memory of 3532 4556 Acctres.exe Acctres.exe PID 4556 wrote to memory of 1964 4556 Acctres.exe WUDHost.exe PID 4556 wrote to memory of 1964 4556 Acctres.exe WUDHost.exe PID 4556 wrote to memory of 1964 4556 Acctres.exe WUDHost.exe PID 3980 wrote to memory of 4720 3980 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe vbc.exe PID 3980 wrote to memory of 4720 3980 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe vbc.exe PID 3980 wrote to memory of 4720 3980 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe vbc.exe PID 3980 wrote to memory of 4720 3980 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe vbc.exe PID 3980 wrote to memory of 4720 3980 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe vbc.exe PID 3980 wrote to memory of 4720 3980 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe vbc.exe PID 3980 wrote to memory of 4720 3980 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe vbc.exe PID 3980 wrote to memory of 4720 3980 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe vbc.exe PID 3980 wrote to memory of 4720 3980 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe vbc.exe PID 3980 wrote to memory of 5096 3980 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe vbc.exe PID 3980 wrote to memory of 5096 3980 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe vbc.exe PID 3980 wrote to memory of 5096 3980 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe vbc.exe PID 3980 wrote to memory of 5096 3980 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe vbc.exe PID 3980 wrote to memory of 5096 3980 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe vbc.exe PID 3980 wrote to memory of 5096 3980 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe vbc.exe PID 3980 wrote to memory of 5096 3980 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe vbc.exe PID 3980 wrote to memory of 5096 3980 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe vbc.exe PID 3980 wrote to memory of 5096 3980 38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe"C:\Users\Admin\AppData\Local\Temp\38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe"C:\Users\Admin\AppData\Local\Temp\38e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"3⤵
- Accesses Microsoft Outlook accounts
PID:4720 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"3⤵PID:5096
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe"4⤵
- Executes dropped EXE
PID:3532 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1964
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224B
MD5c19eb8c8e7a40e6b987f9d2ee952996e
SHA16fc3049855bc9100643e162511673c6df0f28bfb
SHA256677e9e30350df17e2bc20fa9f7d730e9f7cc6e870d6520a345f5f7dc5b31f58a
SHA512860713b4a787c2189ed12a47d4b68b60ac00c7a253cae52dd4eb9276dacafeae3a81906b6d0742c8ecfdfaa255777c445beb7c2a532f3c677a9903237ac97596
-
Filesize
3KB
MD5f94dc819ca773f1e3cb27abbc9e7fa27
SHA19a7700efadc5ea09ab288544ef1e3cd876255086
SHA256a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92
SHA51272a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196
-
Filesize
580KB
MD50484f772e045b1e8029d3cca90fea9c2
SHA14dc084088bbe3ce8b00c578282539f0efa125cb4
SHA25638e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95
SHA512f93da0eb01d1758c9ee8d66347c40989c46648df48b287f80faec0feb62828426b4934bcdc48e7ccedc66b3cc50cd64d5b64f6315f8a1619cb3ea86a7c7fb670
-
Filesize
580KB
MD50484f772e045b1e8029d3cca90fea9c2
SHA14dc084088bbe3ce8b00c578282539f0efa125cb4
SHA25638e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95
SHA512f93da0eb01d1758c9ee8d66347c40989c46648df48b287f80faec0feb62828426b4934bcdc48e7ccedc66b3cc50cd64d5b64f6315f8a1619cb3ea86a7c7fb670
-
Filesize
580KB
MD50484f772e045b1e8029d3cca90fea9c2
SHA14dc084088bbe3ce8b00c578282539f0efa125cb4
SHA25638e654c69f2de92cb79e7b4009559277438b27ad465d76ce21bfcdf601a6cd95
SHA512f93da0eb01d1758c9ee8d66347c40989c46648df48b287f80faec0feb62828426b4934bcdc48e7ccedc66b3cc50cd64d5b64f6315f8a1619cb3ea86a7c7fb670
-
Filesize
8KB
MD544fe6d432dc0e3138b118d7e59858841
SHA1669b99829ce3fb45c89fab670ede5130d8cc5f07
SHA25621484c6668c3581e15e447bb2ebe2f3f7e6a5f9b383cbd990368fe8ea323419d
SHA5121592165716ae7b5194b78e9732c214ce5f782431ab0a63e76e4dd56d250999307efdb6b7030909ef4a0ee70de5d573269bf6f4ab0685890930225815bfa04660
-
Filesize
8KB
MD544fe6d432dc0e3138b118d7e59858841
SHA1669b99829ce3fb45c89fab670ede5130d8cc5f07
SHA25621484c6668c3581e15e447bb2ebe2f3f7e6a5f9b383cbd990368fe8ea323419d
SHA5121592165716ae7b5194b78e9732c214ce5f782431ab0a63e76e4dd56d250999307efdb6b7030909ef4a0ee70de5d573269bf6f4ab0685890930225815bfa04660
-
Filesize
8KB
MD544fe6d432dc0e3138b118d7e59858841
SHA1669b99829ce3fb45c89fab670ede5130d8cc5f07
SHA25621484c6668c3581e15e447bb2ebe2f3f7e6a5f9b383cbd990368fe8ea323419d
SHA5121592165716ae7b5194b78e9732c214ce5f782431ab0a63e76e4dd56d250999307efdb6b7030909ef4a0ee70de5d573269bf6f4ab0685890930225815bfa04660
-
Filesize
8KB
MD544fe6d432dc0e3138b118d7e59858841
SHA1669b99829ce3fb45c89fab670ede5130d8cc5f07
SHA25621484c6668c3581e15e447bb2ebe2f3f7e6a5f9b383cbd990368fe8ea323419d
SHA5121592165716ae7b5194b78e9732c214ce5f782431ab0a63e76e4dd56d250999307efdb6b7030909ef4a0ee70de5d573269bf6f4ab0685890930225815bfa04660