aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26

General

Target

aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
Size

380KB
MD5

91dc7d7c0608c2e76a59704c7ad83b7c
SHA1

9fe75c22fef8caa144765406df4a83d279290c4e
SHA256

aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26
SHA512

b9763fabd191e9690fa84883ce0fdce7748c6b6f1981ae761cd978d6253e8af6cfe40fe9ae7636757591332e208b1e0ba5f077fa5b789c71f946d46fbb4a7e02
SSDEEP

6144:Uzv+kSZBbdH19ex4T02J4fqz22tvymTiB62iKnWKKmDTcNwjreOwI+Tm1T8vbp:UzcRD02J4Sq2vHGB67KWKKmDWKSp

Score

10^/10

evasion persistence trojan upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe"	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1444-55-0x0000000000400000-0x00000000004C2000-memory.dmp	upx

Drops startup file 1 IoCs

Processes:

aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe.lnk	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/1444-55-0x0000000000400000-0x00000000004C2000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 11 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
1896	taskkill.exe
1696	taskkill.exe
1708	taskkill.exe
1556	taskkill.exe
848	taskkill.exe
1092	taskkill.exe
924	taskkill.exe
1576	taskkill.exe
1644	taskkill.exe
816	taskkill.exe
1336	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe

pid	process
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe

pid process

1444 aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	848	taskkill.exe
Token: SeDebugPrivilege	1644	taskkill.exe
Token: SeDebugPrivilege	816	taskkill.exe
Token: SeDebugPrivilege	1708	taskkill.exe
Token: SeDebugPrivilege	1556	taskkill.exe
Token: SeDebugPrivilege	1696	taskkill.exe
Token: SeDebugPrivilege	1896	taskkill.exe
Token: SeDebugPrivilege	924	taskkill.exe
Token: SeDebugPrivilege	1092	taskkill.exe
Token: SeDebugPrivilege	1336	taskkill.exe
Token: SeDebugPrivilege	1576	taskkill.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe

pid	process
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1444 wrote to memory of 756	1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe	cmd.exe
PID 1444 wrote to memory of 756	1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe	cmd.exe
PID 1444 wrote to memory of 756	1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe	cmd.exe
PID 1444 wrote to memory of 756	1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe	cmd.exe
PID 756 wrote to memory of 1556	756	cmd.exe	taskkill.exe
PID 756 wrote to memory of 1556	756	cmd.exe	taskkill.exe
PID 756 wrote to memory of 1556	756	cmd.exe	taskkill.exe
PID 756 wrote to memory of 1556	756	cmd.exe	taskkill.exe
PID 1444 wrote to memory of 772	1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe	cmd.exe
PID 1444 wrote to memory of 772	1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe	cmd.exe
PID 1444 wrote to memory of 772	1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe	cmd.exe
PID 1444 wrote to memory of 772	1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe	cmd.exe
PID 772 wrote to memory of 1644	772	cmd.exe	taskkill.exe
PID 772 wrote to memory of 1644	772	cmd.exe	taskkill.exe
PID 772 wrote to memory of 1644	772	cmd.exe	taskkill.exe
PID 772 wrote to memory of 1644	772	cmd.exe	taskkill.exe
PID 1444 wrote to memory of 1884	1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe	cmd.exe
PID 1444 wrote to memory of 1884	1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe	cmd.exe
PID 1444 wrote to memory of 1884	1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe	cmd.exe
PID 1444 wrote to memory of 1884	1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe	cmd.exe
PID 1884 wrote to memory of 848	1884	cmd.exe	taskkill.exe
PID 1884 wrote to memory of 848	1884	cmd.exe	taskkill.exe
PID 1884 wrote to memory of 848	1884	cmd.exe	taskkill.exe
PID 1884 wrote to memory of 848	1884	cmd.exe	taskkill.exe
PID 1444 wrote to memory of 1104	1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe	cmd.exe
PID 1444 wrote to memory of 1104	1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe	cmd.exe
PID 1444 wrote to memory of 1104	1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe	cmd.exe
PID 1444 wrote to memory of 1104	1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe	cmd.exe
PID 1104 wrote to memory of 1092	1104	cmd.exe	taskkill.exe
PID 1104 wrote to memory of 1092	1104	cmd.exe	taskkill.exe
PID 1104 wrote to memory of 1092	1104	cmd.exe	taskkill.exe
PID 1104 wrote to memory of 1092	1104	cmd.exe	taskkill.exe
PID 1444 wrote to memory of 532	1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe	cmd.exe
PID 1444 wrote to memory of 532	1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe	cmd.exe
PID 1444 wrote to memory of 532	1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe	cmd.exe
PID 1444 wrote to memory of 532	1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe	cmd.exe
PID 532 wrote to memory of 1896	532	cmd.exe	taskkill.exe
PID 532 wrote to memory of 1896	532	cmd.exe	taskkill.exe
PID 532 wrote to memory of 1896	532	cmd.exe	taskkill.exe
PID 532 wrote to memory of 1896	532	cmd.exe	taskkill.exe
PID 1444 wrote to memory of 1732	1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe	cmd.exe
PID 1444 wrote to memory of 1732	1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe	cmd.exe
PID 1444 wrote to memory of 1732	1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe	cmd.exe
PID 1444 wrote to memory of 1732	1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe	cmd.exe
PID 1732 wrote to memory of 816	1732	cmd.exe	taskkill.exe
PID 1732 wrote to memory of 816	1732	cmd.exe	taskkill.exe
PID 1732 wrote to memory of 816	1732	cmd.exe	taskkill.exe
PID 1732 wrote to memory of 816	1732	cmd.exe	taskkill.exe
PID 1444 wrote to memory of 1752	1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe	cmd.exe
PID 1444 wrote to memory of 1752	1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe	cmd.exe
PID 1444 wrote to memory of 1752	1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe	cmd.exe
PID 1444 wrote to memory of 1752	1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe	cmd.exe
PID 1752 wrote to memory of 1696	1752	cmd.exe	taskkill.exe
PID 1752 wrote to memory of 1696	1752	cmd.exe	taskkill.exe
PID 1752 wrote to memory of 1696	1752	cmd.exe	taskkill.exe
PID 1752 wrote to memory of 1696	1752	cmd.exe	taskkill.exe
PID 1444 wrote to memory of 360	1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe	cmd.exe
PID 1444 wrote to memory of 360	1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe	cmd.exe
PID 1444 wrote to memory of 360	1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe	cmd.exe
PID 1444 wrote to memory of 360	1444	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe	cmd.exe
PID 360 wrote to memory of 1336	360	cmd.exe	taskkill.exe
PID 360 wrote to memory of 1336	360	cmd.exe	taskkill.exe
PID 360 wrote to memory of 1336	360	cmd.exe	taskkill.exe
PID 360 wrote to memory of 1336	360	cmd.exe	taskkill.exe

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

Processes:

aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1"	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe

C:\Users\Admin\AppData\Local\Temp\aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe
"C:\Users\Admin\AppData\Local\Temp\aa7a2ca6699a022ec1b964aff1916051447403df3a818fd6b246256b5c99ac26.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Drops startup file
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1444

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:756

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im explorer.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1556

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:772

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im explorer.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1644

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1884

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im explorer.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:848

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1104

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im explorer.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1092

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:532

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im explorer.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1896

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1732

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im explorer.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:816

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1752

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im explorer.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1696

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:360

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im explorer.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1336

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe
2⤵
PID:580

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im explorer.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1708

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe
2⤵
PID:520

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im explorer.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:924

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe
2⤵
PID:1676

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im explorer.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1576

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/360-73-0x0000000000000000-mapping.dmp

Download
memory/520-77-0x0000000000000000-mapping.dmp

Download
memory/532-67-0x0000000000000000-mapping.dmp

Download
memory/580-75-0x0000000000000000-mapping.dmp

Download
memory/756-59-0x0000000000000000-mapping.dmp

Download
memory/772-61-0x0000000000000000-mapping.dmp

Download
memory/816-70-0x0000000000000000-mapping.dmp

Download
memory/848-64-0x0000000000000000-mapping.dmp

Download
memory/924-78-0x0000000000000000-mapping.dmp

Download
memory/1092-66-0x0000000000000000-mapping.dmp

Download
memory/1104-65-0x0000000000000000-mapping.dmp

Download
memory/1336-74-0x0000000000000000-mapping.dmp

Download
memory/1444-56-0x00000000008E0000-0x00000000008F0000-memory.dmp

Filesize
64KB

Download
memory/1444-57-0x00000000008E0000-0x00000000008F0000-memory.dmp

Filesize
64KB

Download
memory/1444-54-0x0000000075491000-0x0000000075493000-memory.dmp

Filesize
8KB

Download
memory/1444-55-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/1556-60-0x0000000000000000-mapping.dmp

Download
memory/1576-80-0x0000000000000000-mapping.dmp

Download
memory/1644-62-0x0000000000000000-mapping.dmp

Download
memory/1676-79-0x0000000000000000-mapping.dmp

Download
memory/1696-72-0x0000000000000000-mapping.dmp

Download
memory/1708-76-0x0000000000000000-mapping.dmp

Download
memory/1732-69-0x0000000000000000-mapping.dmp

Download
memory/1752-71-0x0000000000000000-mapping.dmp

Download
memory/1884-63-0x0000000000000000-mapping.dmp

Download
memory/1896-68-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads