Analysis
-
max time kernel
206s -
max time network
292s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 11:45
Static task
static1
Behavioral task
behavioral1
Sample
578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe
Resource
win10v2004-20221111-en
General
-
Target
578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe
-
Size
258KB
-
MD5
8316cf2207ab369a8b48615324f4d794
-
SHA1
e1ce12d761c055692847b5281f9c457f19847d67
-
SHA256
578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744
-
SHA512
c0f3c27125d947469286c7df30859256054bedd02b0834e14a7dde801064235246a94dd805ca54cc538f0442c7e1b4009ee2fd12b5ad885b3f307ead9901bbfc
-
SSDEEP
6144:N2c68qqv3gyy6wP2xnK7KlEV7DVKduhqb:N6877y7P2xnIK+lpGuh+
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1692-57-0x0000000000400000-0x0000000000429000-memory.dmp cryptone behavioral1/memory/1692-59-0x0000000000400000-0x0000000000429000-memory.dmp cryptone behavioral1/memory/1692-60-0x0000000000400000-0x0000000000429000-memory.dmp cryptone behavioral1/memory/1692-62-0x0000000000400000-0x0000000000429000-memory.dmp cryptone behavioral1/memory/1692-63-0x0000000000400000-0x0000000000429000-memory.dmp cryptone behavioral1/memory/1692-68-0x0000000000400000-0x0000000000429000-memory.dmp cryptone behavioral1/memory/1692-75-0x0000000000400000-0x0000000000429000-memory.dmp cryptone behavioral1/memory/1016-84-0x0000000000080000-0x00000000000A9000-memory.dmp cryptone behavioral1/memory/1016-85-0x0000000000080000-0x00000000000A9000-memory.dmp cryptone behavioral1/memory/1016-83-0x0000000000080000-0x00000000000A9000-memory.dmp cryptone behavioral1/memory/1572-96-0x0000000000080000-0x00000000000A9000-memory.dmp cryptone behavioral1/memory/1692-103-0x0000000000400000-0x0000000000429000-memory.dmp cryptone -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
svchost.exemspaint.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Adobe System Incorporated = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Adobe\\Reader_sl.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Dxeneq = "C:\\Users\\Admin\\AppData\\Roaming\\Identities\\Dxeneq.exe" mspaint.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
svchost.exemspaint.exedescription ioc process File opened (read-only) \??\S: svchost.exe File opened (read-only) \??\V: svchost.exe File opened (read-only) \??\D: mspaint.exe File opened (read-only) \??\E: svchost.exe File opened (read-only) \??\H: svchost.exe File opened (read-only) \??\I: svchost.exe File opened (read-only) \??\L: svchost.exe File opened (read-only) \??\R: svchost.exe File opened (read-only) \??\Y: svchost.exe File opened (read-only) \??\F: svchost.exe File opened (read-only) \??\G: svchost.exe File opened (read-only) \??\M: svchost.exe File opened (read-only) \??\Q: svchost.exe File opened (read-only) \??\U: svchost.exe File opened (read-only) \??\J: svchost.exe File opened (read-only) \??\N: svchost.exe File opened (read-only) \??\X: svchost.exe File opened (read-only) \??\Z: svchost.exe File opened (read-only) \??\W: svchost.exe File opened (read-only) \??\B: svchost.exe File opened (read-only) \??\K: svchost.exe File opened (read-only) \??\O: svchost.exe File opened (read-only) \??\P: svchost.exe File opened (read-only) \??\T: svchost.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exedescription pid process target process PID 856 set thread context of 1692 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe PID 1692 set thread context of 1856 1692 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exesvchost.exe578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exepid process 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe 1572 svchost.exe 1856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exepid process 1692 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exedescription pid process Token: 33 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: SeIncBasePriorityPrivilege 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: 33 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: SeIncBasePriorityPrivilege 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: 33 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: SeIncBasePriorityPrivilege 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: 33 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: SeIncBasePriorityPrivilege 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: 33 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: SeIncBasePriorityPrivilege 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: 33 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: SeIncBasePriorityPrivilege 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: 33 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: SeIncBasePriorityPrivilege 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: 33 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: SeIncBasePriorityPrivilege 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: 33 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: SeIncBasePriorityPrivilege 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: 33 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: SeIncBasePriorityPrivilege 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: 33 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: SeIncBasePriorityPrivilege 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: 33 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: SeIncBasePriorityPrivilege 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: 33 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: SeIncBasePriorityPrivilege 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: 33 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: SeIncBasePriorityPrivilege 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: 33 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: SeIncBasePriorityPrivilege 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: 33 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: SeIncBasePriorityPrivilege 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: 33 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: SeIncBasePriorityPrivilege 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: 33 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: SeIncBasePriorityPrivilege 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: 33 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: SeIncBasePriorityPrivilege 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: 33 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: SeIncBasePriorityPrivilege 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: 33 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: SeIncBasePriorityPrivilege 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: 33 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: SeIncBasePriorityPrivilege 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: 33 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: SeIncBasePriorityPrivilege 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: 33 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: SeIncBasePriorityPrivilege 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: 33 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: SeIncBasePriorityPrivilege 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: 33 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: SeIncBasePriorityPrivilege 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: 33 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: SeIncBasePriorityPrivilege 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: 33 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: SeIncBasePriorityPrivilege 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: 33 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: SeIncBasePriorityPrivilege 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: 33 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: SeIncBasePriorityPrivilege 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: 33 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: SeIncBasePriorityPrivilege 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: 33 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe Token: SeIncBasePriorityPrivilege 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exesvchost.exe578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exedescription pid process target process PID 856 wrote to memory of 1692 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe PID 856 wrote to memory of 1692 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe PID 856 wrote to memory of 1692 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe PID 856 wrote to memory of 1692 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe PID 856 wrote to memory of 1692 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe PID 856 wrote to memory of 1692 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe PID 856 wrote to memory of 1692 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe PID 856 wrote to memory of 1692 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe PID 856 wrote to memory of 1692 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe PID 856 wrote to memory of 1692 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe PID 856 wrote to memory of 1692 856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe PID 1692 wrote to memory of 1572 1692 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe svchost.exe PID 1692 wrote to memory of 1572 1692 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe svchost.exe PID 1692 wrote to memory of 1572 1692 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe svchost.exe PID 1692 wrote to memory of 1572 1692 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe svchost.exe PID 1692 wrote to memory of 436 1692 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe calc.exe PID 1692 wrote to memory of 436 1692 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe calc.exe PID 1692 wrote to memory of 436 1692 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe calc.exe PID 1692 wrote to memory of 436 1692 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe calc.exe PID 1692 wrote to memory of 436 1692 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe calc.exe PID 1692 wrote to memory of 436 1692 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe calc.exe PID 1692 wrote to memory of 1572 1692 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe svchost.exe PID 1572 wrote to memory of 1016 1572 svchost.exe mspaint.exe PID 1572 wrote to memory of 1016 1572 svchost.exe mspaint.exe PID 1572 wrote to memory of 1016 1572 svchost.exe mspaint.exe PID 1572 wrote to memory of 1016 1572 svchost.exe mspaint.exe PID 1572 wrote to memory of 1016 1572 svchost.exe mspaint.exe PID 1692 wrote to memory of 1856 1692 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe PID 1692 wrote to memory of 1856 1692 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe PID 1692 wrote to memory of 1856 1692 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe PID 1692 wrote to memory of 1856 1692 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe PID 1692 wrote to memory of 1856 1692 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe PID 1692 wrote to memory of 1856 1692 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe PID 1692 wrote to memory of 1856 1692 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe PID 1692 wrote to memory of 1856 1692 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe PID 1692 wrote to memory of 1856 1692 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe PID 1692 wrote to memory of 1856 1692 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe PID 1856 wrote to memory of 436 1856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe calc.exe PID 1856 wrote to memory of 436 1856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe calc.exe PID 1856 wrote to memory of 1572 1856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe svchost.exe PID 1856 wrote to memory of 1572 1856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe svchost.exe PID 1856 wrote to memory of 1016 1856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe mspaint.exe PID 1856 wrote to memory of 1016 1856 578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe mspaint.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe"C:\Users\Admin\AppData\Local\Temp\578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe"C:\Users\Admin\AppData\Local\Temp\578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\SysWOW64\calc.exe"3⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"3⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mspaint.exe"C:\Windows\SysWOW64\mspaint.exe"4⤵
- Adds Run key to start application
- Enumerates connected drives
-
C:\Users\Admin\AppData\Local\Temp\578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe"C:\Users\Admin\AppData\Local\Temp\578fa9ea352f78b1443c817ae43ee968fb6d827b8fbb9dd30fab6e23c8c80744.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/436-117-0x00000000001C0000-0x000000000020E000-memory.dmpFilesize
312KB
-
memory/436-109-0x00000000001C0000-0x000000000020E000-memory.dmpFilesize
312KB
-
memory/436-341-0x00000000001F8000-0x00000000001FA000-memory.dmpFilesize
8KB
-
memory/436-338-0x00000000001C0000-0x000000000020E000-memory.dmpFilesize
312KB
-
memory/436-137-0x00000000001C0000-0x000000000020E000-memory.dmpFilesize
312KB
-
memory/436-98-0x0000000000080000-0x0000000000082000-memory.dmpFilesize
8KB
-
memory/436-128-0x00000000001C0000-0x000000000020E000-memory.dmpFilesize
312KB
-
memory/436-73-0x0000000000000000-mapping.dmp
-
memory/436-123-0x00000000001C0000-0x000000000020E000-memory.dmpFilesize
312KB
-
memory/436-112-0x00000000001C0000-0x000000000020E000-memory.dmpFilesize
312KB
-
memory/436-70-0x0000000000080000-0x0000000000082000-memory.dmpFilesize
8KB
-
memory/856-65-0x0000000000220000-0x0000000000234000-memory.dmpFilesize
80KB
-
memory/1016-131-0x0000000000140000-0x000000000018E000-memory.dmpFilesize
312KB
-
memory/1016-126-0x0000000000140000-0x000000000018E000-memory.dmpFilesize
312KB
-
memory/1016-100-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1016-80-0x0000000000000000-mapping.dmp
-
memory/1016-82-0x0000000000411000-0x0000000000413000-memory.dmpFilesize
8KB
-
memory/1016-84-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1016-85-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1016-83-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1016-86-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1016-340-0x0000000000140000-0x000000000018E000-memory.dmpFilesize
312KB
-
memory/1016-144-0x0000000000140000-0x000000000018E000-memory.dmpFilesize
312KB
-
memory/1572-74-0x0000000000000000-mapping.dmp
-
memory/1572-96-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1572-339-0x0000000000160000-0x00000000001AE000-memory.dmpFilesize
312KB
-
memory/1572-141-0x0000000000160000-0x00000000001AE000-memory.dmpFilesize
312KB
-
memory/1572-121-0x0000000000160000-0x00000000001AE000-memory.dmpFilesize
312KB
-
memory/1572-116-0x0000000000160000-0x00000000001AE000-memory.dmpFilesize
312KB
-
memory/1692-54-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1692-67-0x0000000075831000-0x0000000075833000-memory.dmpFilesize
8KB
-
memory/1692-57-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1692-103-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1692-59-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1692-55-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1692-68-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1692-60-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1692-62-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1692-64-0x0000000000404BF0-mapping.dmp
-
memory/1692-63-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1692-75-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1856-99-0x0000000000410910-mapping.dmp
-
memory/1856-127-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1856-94-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1856-92-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1856-87-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1856-90-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1856-105-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1856-88-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1856-97-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1856-104-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB