Analysis
-
max time kernel
152s -
max time network
180s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24/11/2022, 00:56
Static task
static1
Behavioral task
behavioral1
Sample
508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe
Resource
win7-20221111-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe
-
Size
234KB
-
MD5
38b1c1b60b969c116ed8f05cbdf46610
-
SHA1
10477ac94f70cb7abdd128c9c0f7d339adf65282
-
SHA256
508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18
-
SHA512
4bf5157e601d8f457a98478314663687f5b1c17591aceab7f34f762f8afd1bde134521e200d7eed5231262f6a7f75b663722fa89968702660c6ac586702125e7
-
SSDEEP
3072:YXJ+KhZ1RcBEZAZ2MiaHMXhalr0fOeXAdWEuX/dvo:4VhZ1RQEO2MvH6hnkCXJ
Score
8/10
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 316 SafeSys.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe -
Loads dropped DLL 1 IoCs
pid Process 1328 Rundll32.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe File opened (read-only) \??\E: 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe File opened (read-only) \??\F: 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe File opened (read-only) \??\L: 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe File opened (read-only) \??\M: 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe File opened (read-only) \??\P: 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe File opened (read-only) \??\T: 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe File opened (read-only) \??\W: 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe File opened (read-only) \??\B: 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe File opened (read-only) \??\G: 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe File opened (read-only) \??\H: 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe File opened (read-only) \??\I: 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe File opened (read-only) \??\K: 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe File opened (read-only) \??\N: 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe File opened (read-only) \??\Q: 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe File opened (read-only) \??\Y: 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe File opened (read-only) \??\J: 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe File opened (read-only) \??\U: 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe File opened (read-only) \??\O: 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe File opened (read-only) \??\R: 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe File opened (read-only) \??\S: 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe File opened (read-only) \??\V: 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe File opened (read-only) \??\X: 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe File opened (read-only) \??\Z: 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 316 set thread context of 4028 316 SafeSys.exe 86 -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\rwlur.bak 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe File opened for modification C:\Program Files (x86)\Common Files\SafeSys.exe 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe File created C:\Program Files (x86)\Common Files\SafeSys.exe 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Fonts\rlcps.fon Rundll32.exe File opened for modification C:\Windows\Fonts\rlcps.fon Rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 5012 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 5012 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 664 Process not Found 664 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe Token: SeDebugPrivilege 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1684 wrote to memory of 5012 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 83 PID 1684 wrote to memory of 5012 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 83 PID 1684 wrote to memory of 5012 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 83 PID 5012 wrote to memory of 1328 5012 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 84 PID 5012 wrote to memory of 1328 5012 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 84 PID 5012 wrote to memory of 1328 5012 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 84 PID 1684 wrote to memory of 316 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 85 PID 1684 wrote to memory of 316 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 85 PID 1684 wrote to memory of 316 1684 508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe 85 PID 316 wrote to memory of 4028 316 SafeSys.exe 86 PID 316 wrote to memory of 4028 316 SafeSys.exe 86 PID 316 wrote to memory of 4028 316 SafeSys.exe 86 PID 316 wrote to memory of 4028 316 SafeSys.exe 86 PID 316 wrote to memory of 4028 316 SafeSys.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe"C:\Users\Admin\AppData\Local\Temp\508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exeC:\Users\Admin\AppData\Local\Temp\508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18.exe -SafeSys2⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\SysWOW64\Rundll32.exe"C:\Windows\system32\Rundll32.exe" "C:\Program Files (x86)\rwlur.bak",MyDLLEntry3⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1328
-
-
-
C:\Program Files (x86)\Common Files\SafeSys.exe"C:\Program Files (x86)\Common Files\SafeSys.exe" SafeSys2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:4028
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 4028 -ip 40281⤵PID:4544
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
234KB
MD538b1c1b60b969c116ed8f05cbdf46610
SHA110477ac94f70cb7abdd128c9c0f7d339adf65282
SHA256508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18
SHA5124bf5157e601d8f457a98478314663687f5b1c17591aceab7f34f762f8afd1bde134521e200d7eed5231262f6a7f75b663722fa89968702660c6ac586702125e7
-
Filesize
234KB
MD538b1c1b60b969c116ed8f05cbdf46610
SHA110477ac94f70cb7abdd128c9c0f7d339adf65282
SHA256508e2231feddc8d3429b345f5f85979ce3339351216c587fbc456e9d464b0c18
SHA5124bf5157e601d8f457a98478314663687f5b1c17591aceab7f34f762f8afd1bde134521e200d7eed5231262f6a7f75b663722fa89968702660c6ac586702125e7
-
Filesize
10KB
MD50a8d07ff358703bf65b83b09b7b78432
SHA12ad9134da8db9ce75489dcaed7ec8828b7ed0651
SHA25693878bfdddfff8c1ad14af2bdae67a386d1bc8aac8ddb594c68898d90f5a0118
SHA5123aa1dbe7016f856205d127e5ad29b723f80c7bd337419ab66d61e8cef2390cbe2df3418ca71a68ed88aa26e18551c2a94e532b5d7e36aa8fb4d7abb572856361
-
Filesize
10KB
MD50a8d07ff358703bf65b83b09b7b78432
SHA12ad9134da8db9ce75489dcaed7ec8828b7ed0651
SHA25693878bfdddfff8c1ad14af2bdae67a386d1bc8aac8ddb594c68898d90f5a0118
SHA5123aa1dbe7016f856205d127e5ad29b723f80c7bd337419ab66d61e8cef2390cbe2df3418ca71a68ed88aa26e18551c2a94e532b5d7e36aa8fb4d7abb572856361