Analysis
-
max time kernel
32s -
max time network
172s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 18:49
Static task
static1
Behavioral task
behavioral1
Sample
5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe
Resource
win10v2004-20221111-en
General
-
Target
5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe
-
Size
898KB
-
MD5
5c41de5cea0bc148b8177cb41803d7c9
-
SHA1
47fbd7205613bd5f451439ccec5b514dbc4c7c0f
-
SHA256
5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08
-
SHA512
b0d812109610e8754b3a52b370c37ea188099e2d5ae1ce2fdf5fca4b3a8ef62edb2af87634726bda971efc81704978faa6f52d181167f4f7f8707b334d8450cd
-
SSDEEP
6144:E3i8X7pt4Oti0BWmKWIBtOcI9SSbA+cuXhDM6a1F9nBG:E3TdtLW5WIj1YSSdFxs1z4
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe regsvr.exe" 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe -
Disables Task Manager via registry modification
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\Msn Messsenger = "C:\\Windows\\system32\\regsvr.exe" 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exedescription ioc process File opened (read-only) \??\s: 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe File opened (read-only) \??\v: 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe File opened (read-only) \??\x: 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe File opened (read-only) \??\e: 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe File opened (read-only) \??\g: 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe File opened (read-only) \??\h: 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe File opened (read-only) \??\i: 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe File opened (read-only) \??\p: 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe File opened (read-only) \??\z: 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe File opened (read-only) \??\o: 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe File opened (read-only) \??\q: 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe File opened (read-only) \??\u: 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe File opened (read-only) \??\f: 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe File opened (read-only) \??\k: 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe File opened (read-only) \??\l: 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe File opened (read-only) \??\m: 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe File opened (read-only) \??\n: 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe File opened (read-only) \??\w: 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe File opened (read-only) \??\y: 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe File opened (read-only) \??\a: 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe File opened (read-only) \??\j: 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe File opened (read-only) \??\r: 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe File opened (read-only) \??\t: 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe File opened (read-only) \??\b: 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/1144-61-0x0000000000400000-0x0000000000506000-memory.dmp autoit_exe behavioral1/memory/1144-62-0x0000000000400000-0x0000000000506000-memory.dmp autoit_exe -
Drops file in System32 directory 8 IoCs
Processes:
5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exedescription ioc process File opened for modification C:\Windows\SysWOW64\svchost .exe 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe File opened for modification C:\Windows\SysWOW64\setup.ini 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe File created C:\Windows\SysWOW64\setting.ini 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe File opened for modification C:\Windows\SysWOW64\setting.ini 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe File opened for modification C:\Windows\SysWOW64\28463 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe File created C:\Windows\SysWOW64\regsvr.exe 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe File opened for modification C:\Windows\SysWOW64\regsvr.exe 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe File created C:\Windows\SysWOW64\svchost .exe 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe -
Drops file in Windows directory 2 IoCs
Processes:
5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exedescription ioc process File created C:\Windows\regsvr.exe 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe File opened for modification C:\Windows\regsvr.exe 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exepid process 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.execmd.execmd.exedescription pid process target process PID 1144 wrote to memory of 2036 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe cmd.exe PID 1144 wrote to memory of 2036 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe cmd.exe PID 1144 wrote to memory of 2036 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe cmd.exe PID 1144 wrote to memory of 2036 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe cmd.exe PID 2036 wrote to memory of 460 2036 cmd.exe at.exe PID 2036 wrote to memory of 460 2036 cmd.exe at.exe PID 2036 wrote to memory of 460 2036 cmd.exe at.exe PID 2036 wrote to memory of 460 2036 cmd.exe at.exe PID 1144 wrote to memory of 568 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe cmd.exe PID 1144 wrote to memory of 568 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe cmd.exe PID 1144 wrote to memory of 568 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe cmd.exe PID 1144 wrote to memory of 568 1144 5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe cmd.exe PID 568 wrote to memory of 1116 568 cmd.exe at.exe PID 568 wrote to memory of 1116 568 cmd.exe at.exe PID 568 wrote to memory of 1116 568 cmd.exe at.exe PID 568 wrote to memory of 1116 568 cmd.exe at.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe"C:\Users\Admin\AppData\Local\Temp\5363962b9ef23677c82ce5294f42c622a941d238180ffcde9fb6f1cee9571f08.exe"1⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\at.exeAT /delete /yes3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\svchost .exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\svchost .exe3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/460-56-0x0000000000000000-mapping.dmp
-
memory/568-58-0x0000000000000000-mapping.dmp
-
memory/1116-59-0x0000000000000000-mapping.dmp
-
memory/1144-54-0x0000000075F01000-0x0000000075F03000-memory.dmpFilesize
8KB
-
memory/1144-61-0x0000000000400000-0x0000000000506000-memory.dmpFilesize
1.0MB
-
memory/1144-62-0x0000000000400000-0x0000000000506000-memory.dmpFilesize
1.0MB
-
memory/2036-55-0x0000000000000000-mapping.dmp