Analysis
-
max time kernel
87s -
max time network
92s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 21:15
Static task
static1
Behavioral task
behavioral1
Sample
bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe
Resource
win10v2004-20221111-en
General
-
Target
bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe
-
Size
254KB
-
MD5
8c89b6d5c462d5acf263595847ec4b73
-
SHA1
4470bc92f00abc47253bdfa44bc31c7ae7caa45f
-
SHA256
bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce
-
SHA512
8b6e4406be7a7e22ca5029e74fe9c24ef9d6a384098ed047d847297f578ab8d5601708c403f168a0c990763b61ae945e44ef07419896f7fd6f2f4c5162fb37c1
-
SSDEEP
3072:QQorU9oV62DZCVKxHvhNmQtsZv2Wbacl7U6TxnwXPq2vAlywrKft4ZZf3FPkAXvt:TorU9oV6oxHpLtS72cBfwC240mF
Malware Config
Extracted
pony
http://shoptoolgtav.craym.eu/gate.php
Signatures
-
Accesses Microsoft Outlook accounts 1 TTPs 2 IoCs
Processes:
AppLaunch.exeAppLaunch.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts AppLaunch.exe -
Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
Processes:
AppLaunch.exeAppLaunch.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook AppLaunch.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\sidebar = "C:\\Users\\Admin\\AppData\\Roaming\\Sample.lnk" bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exedescription pid process target process PID 1784 set thread context of 524 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe AppLaunch.exe PID 1784 set thread context of 1752 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c909000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c01400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e52000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e51d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af33313353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703030f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c92000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 040000000100000010000000cb17e431673ee209fe455793f30afa1c0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c909000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c01400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade372000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exepid process 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exeAppLaunch.exeAppLaunch.exedescription pid process Token: SeDebugPrivilege 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe Token: SeImpersonatePrivilege 524 AppLaunch.exe Token: SeTcbPrivilege 524 AppLaunch.exe Token: SeChangeNotifyPrivilege 524 AppLaunch.exe Token: SeCreateTokenPrivilege 524 AppLaunch.exe Token: SeBackupPrivilege 524 AppLaunch.exe Token: SeRestorePrivilege 524 AppLaunch.exe Token: SeIncreaseQuotaPrivilege 524 AppLaunch.exe Token: SeAssignPrimaryTokenPrivilege 524 AppLaunch.exe Token: SeImpersonatePrivilege 524 AppLaunch.exe Token: SeTcbPrivilege 524 AppLaunch.exe Token: SeChangeNotifyPrivilege 524 AppLaunch.exe Token: SeCreateTokenPrivilege 524 AppLaunch.exe Token: SeBackupPrivilege 524 AppLaunch.exe Token: SeRestorePrivilege 524 AppLaunch.exe Token: SeIncreaseQuotaPrivilege 524 AppLaunch.exe Token: SeAssignPrimaryTokenPrivilege 524 AppLaunch.exe Token: SeImpersonatePrivilege 524 AppLaunch.exe Token: SeTcbPrivilege 524 AppLaunch.exe Token: SeChangeNotifyPrivilege 524 AppLaunch.exe Token: SeCreateTokenPrivilege 524 AppLaunch.exe Token: SeBackupPrivilege 524 AppLaunch.exe Token: SeRestorePrivilege 524 AppLaunch.exe Token: SeIncreaseQuotaPrivilege 524 AppLaunch.exe Token: SeAssignPrimaryTokenPrivilege 524 AppLaunch.exe Token: SeImpersonatePrivilege 524 AppLaunch.exe Token: SeTcbPrivilege 524 AppLaunch.exe Token: SeChangeNotifyPrivilege 524 AppLaunch.exe Token: SeCreateTokenPrivilege 524 AppLaunch.exe Token: SeBackupPrivilege 524 AppLaunch.exe Token: SeRestorePrivilege 524 AppLaunch.exe Token: SeIncreaseQuotaPrivilege 524 AppLaunch.exe Token: SeAssignPrimaryTokenPrivilege 524 AppLaunch.exe Token: SeImpersonatePrivilege 1752 AppLaunch.exe Token: SeTcbPrivilege 1752 AppLaunch.exe Token: SeChangeNotifyPrivilege 1752 AppLaunch.exe Token: SeCreateTokenPrivilege 1752 AppLaunch.exe Token: SeBackupPrivilege 1752 AppLaunch.exe Token: SeRestorePrivilege 1752 AppLaunch.exe Token: SeIncreaseQuotaPrivilege 1752 AppLaunch.exe Token: SeAssignPrimaryTokenPrivilege 1752 AppLaunch.exe Token: SeImpersonatePrivilege 1752 AppLaunch.exe Token: SeTcbPrivilege 1752 AppLaunch.exe Token: SeChangeNotifyPrivilege 1752 AppLaunch.exe Token: SeCreateTokenPrivilege 1752 AppLaunch.exe Token: SeBackupPrivilege 1752 AppLaunch.exe Token: SeRestorePrivilege 1752 AppLaunch.exe Token: SeIncreaseQuotaPrivilege 1752 AppLaunch.exe Token: SeAssignPrimaryTokenPrivilege 1752 AppLaunch.exe Token: SeImpersonatePrivilege 1752 AppLaunch.exe Token: SeTcbPrivilege 1752 AppLaunch.exe Token: SeChangeNotifyPrivilege 1752 AppLaunch.exe Token: SeCreateTokenPrivilege 1752 AppLaunch.exe Token: SeBackupPrivilege 1752 AppLaunch.exe Token: SeRestorePrivilege 1752 AppLaunch.exe Token: SeIncreaseQuotaPrivilege 1752 AppLaunch.exe Token: SeAssignPrimaryTokenPrivilege 1752 AppLaunch.exe Token: SeImpersonatePrivilege 1752 AppLaunch.exe Token: SeTcbPrivilege 1752 AppLaunch.exe Token: SeChangeNotifyPrivilege 1752 AppLaunch.exe Token: SeCreateTokenPrivilege 1752 AppLaunch.exe Token: SeBackupPrivilege 1752 AppLaunch.exe Token: SeRestorePrivilege 1752 AppLaunch.exe Token: SeIncreaseQuotaPrivilege 1752 AppLaunch.exe -
Suspicious use of WriteProcessMemory 46 IoCs
Processes:
bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exeAppLaunch.exeAppLaunch.exedescription pid process target process PID 1784 wrote to memory of 1008 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe CMD.exe PID 1784 wrote to memory of 1008 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe CMD.exe PID 1784 wrote to memory of 1008 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe CMD.exe PID 1784 wrote to memory of 1008 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe CMD.exe PID 1784 wrote to memory of 320 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe CMD.exe PID 1784 wrote to memory of 320 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe CMD.exe PID 1784 wrote to memory of 320 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe CMD.exe PID 1784 wrote to memory of 320 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe CMD.exe PID 1784 wrote to memory of 524 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe AppLaunch.exe PID 1784 wrote to memory of 524 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe AppLaunch.exe PID 1784 wrote to memory of 524 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe AppLaunch.exe PID 1784 wrote to memory of 524 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe AppLaunch.exe PID 1784 wrote to memory of 524 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe AppLaunch.exe PID 1784 wrote to memory of 524 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe AppLaunch.exe PID 1784 wrote to memory of 524 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe AppLaunch.exe PID 1784 wrote to memory of 524 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe AppLaunch.exe PID 1784 wrote to memory of 524 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe AppLaunch.exe PID 1784 wrote to memory of 524 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe AppLaunch.exe PID 1784 wrote to memory of 524 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe AppLaunch.exe PID 1784 wrote to memory of 524 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe AppLaunch.exe PID 524 wrote to memory of 872 524 AppLaunch.exe cmd.exe PID 524 wrote to memory of 872 524 AppLaunch.exe cmd.exe PID 524 wrote to memory of 872 524 AppLaunch.exe cmd.exe PID 524 wrote to memory of 872 524 AppLaunch.exe cmd.exe PID 524 wrote to memory of 872 524 AppLaunch.exe cmd.exe PID 524 wrote to memory of 872 524 AppLaunch.exe cmd.exe PID 524 wrote to memory of 872 524 AppLaunch.exe cmd.exe PID 1784 wrote to memory of 1752 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe AppLaunch.exe PID 1784 wrote to memory of 1752 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe AppLaunch.exe PID 1784 wrote to memory of 1752 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe AppLaunch.exe PID 1784 wrote to memory of 1752 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe AppLaunch.exe PID 1784 wrote to memory of 1752 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe AppLaunch.exe PID 1784 wrote to memory of 1752 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe AppLaunch.exe PID 1784 wrote to memory of 1752 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe AppLaunch.exe PID 1784 wrote to memory of 1752 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe AppLaunch.exe PID 1784 wrote to memory of 1752 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe AppLaunch.exe PID 1784 wrote to memory of 1752 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe AppLaunch.exe PID 1784 wrote to memory of 1752 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe AppLaunch.exe PID 1784 wrote to memory of 1752 1784 bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe AppLaunch.exe PID 1752 wrote to memory of 1244 1752 AppLaunch.exe cmd.exe PID 1752 wrote to memory of 1244 1752 AppLaunch.exe cmd.exe PID 1752 wrote to memory of 1244 1752 AppLaunch.exe cmd.exe PID 1752 wrote to memory of 1244 1752 AppLaunch.exe cmd.exe PID 1752 wrote to memory of 1244 1752 AppLaunch.exe cmd.exe PID 1752 wrote to memory of 1244 1752 AppLaunch.exe cmd.exe PID 1752 wrote to memory of 1244 1752 AppLaunch.exe cmd.exe -
outlook_win_path 1 IoCs
Processes:
AppLaunch.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe"C:\Users\Admin\AppData\Local\Temp\bff27f8e21892803695b2b5fbcb7e21378244fbde4c44fa611c5e5fa98b549ce.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\CMD.exe"CMD"2⤵
-
C:\Windows\SysWOW64\CMD.exe"CMD"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\\AppLaunch.exe"2⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\7125127.bat" "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" "3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\\AppLaunch.exe"2⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_win_path
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\7157388.bat" "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" "3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7125127.batFilesize
94B
MD53880eeb1c736d853eb13b44898b718ab
SHA14eec9d50360cd815211e3c4e6bdd08271b6ec8e6
SHA256936d9411d5226b7c5a150ecaf422987590a8870c8e095e1caa072273041a86e7
SHA5123eaa3dddd7a11942e75acd44208fbe3d3ff8f4006951cd970fb9ab748c160739409803450d28037e577443504707fc310c634e9dc54d0c25e8cfe6094f017c6b
-
C:\Users\Admin\AppData\Local\Temp\7157388.batFilesize
94B
MD53880eeb1c736d853eb13b44898b718ab
SHA14eec9d50360cd815211e3c4e6bdd08271b6ec8e6
SHA256936d9411d5226b7c5a150ecaf422987590a8870c8e095e1caa072273041a86e7
SHA5123eaa3dddd7a11942e75acd44208fbe3d3ff8f4006951cd970fb9ab748c160739409803450d28037e577443504707fc310c634e9dc54d0c25e8cfe6094f017c6b
-
C:\Users\Admin\AppData\Local\Temp\out.binFilesize
199B
MD58ccdb2db9e967e668aff0d57f70fd689
SHA1e487e779b99fc699ede39289b4cf9eaa39213ff5
SHA2563973be8d663877721e7eada399898ddfbefe9f452a8ad2cc78aa8b2a209cc3fa
SHA512c3d04daba30dfec28f50208d04a5d9d1db76a912cfd42f4debadc65a369b7024cc7b911440077ee12df5298fe729185058bf14cd6c3625a2955f2230a9c4d1ec
-
memory/320-57-0x0000000000000000-mapping.dmp
-
memory/524-61-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/524-58-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/524-59-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/524-62-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/524-65-0x000000000041029F-mapping.dmp
-
memory/524-64-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/524-67-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/524-70-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/524-73-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/872-72-0x0000000000000000-mapping.dmp
-
memory/1008-56-0x0000000000000000-mapping.dmp
-
memory/1244-91-0x0000000000000000-mapping.dmp
-
memory/1752-83-0x000000000041029F-mapping.dmp
-
memory/1752-85-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/1752-89-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/1752-90-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/1752-92-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/1784-71-0x00000000742E0000-0x000000007488B000-memory.dmpFilesize
5.7MB
-
memory/1784-54-0x00000000753C1000-0x00000000753C3000-memory.dmpFilesize
8KB
-
memory/1784-55-0x00000000742E0000-0x000000007488B000-memory.dmpFilesize
5.7MB
-
memory/1784-95-0x00000000742E0000-0x000000007488B000-memory.dmpFilesize
5.7MB