Analysis
-
max time kernel
147s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27-11-2022 10:12
Static task
static1
Behavioral task
behavioral1
Sample
f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52.exe
Resource
win10v2004-20220812-en
General
-
Target
f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52.exe
-
Size
1.2MB
-
MD5
6966f74e9d8f1a376ea379f9fcc206a2
-
SHA1
3686d3a9a07ed9f9bda256df9cd2e5604c84de2f
-
SHA256
f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52
-
SHA512
0cf914ae8cf954000a526584c01028409188a19ed4b2910618ed458fa76e3fcf5f0df6fb32b8e9b256535f2d07ebee834c7e5357fd3e597b6803bbd0dd1e0336
-
SSDEEP
12288:C+0Qo6Vv9vkeeP2d+1bmXlZeGB3EHPiiyPP+Mxb1:C+0Z6Vdkeea+1i0iiyPFxZ
Malware Config
Extracted
darkcomet
Infected
dcnew.ddns.net:1604
DC_MUTEX-R5E5D6N
-
InstallPath
WindowsDefencler\WindowsDefencler.exe
-
gencode
J8TDDtLHxoYC
-
install
true
-
offline_keylogger
true
-
password
00000
-
persistence
true
-
reg_key
WindowsDefencler
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
Processes:
FB_197D.tmp.exeWScript.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\WindowsDefencler\\WindowsDefencler.exe" FB_197D.tmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\System\\Windows Defencler-DoOoMs.vbs\"" WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\System\\Windows Defencler-DoOoMs.vbs\"" WScript.exe -
Executes dropped EXE 4 IoCs
Processes:
FB_197D.tmp.exeFB_197D.tmp.exeWindowsDefencler.exeWindowsDefencler.exepid process 976 FB_197D.tmp.exe 568 FB_197D.tmp.exe 1756 WindowsDefencler.exe 1544 WindowsDefencler.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 848 attrib.exe 1840 attrib.exe -
Drops startup file 5 IoCs
Processes:
WScript.exeWScript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FB_18EF.tmp.vbs WScript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FB_18EF.tmp.vbs WScript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Defencler-DoOoM.lnk WScript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Defencler-DoOoMs.lnk WScript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Defencler-DoOoM.url WScript.exe -
Loads dropped DLL 6 IoCs
Processes:
f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52.exeFB_197D.tmp.exeFB_197D.tmp.exeWindowsDefencler.exepid process 1660 f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52.exe 1660 f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52.exe 976 FB_197D.tmp.exe 568 FB_197D.tmp.exe 568 FB_197D.tmp.exe 1756 WindowsDefencler.exe -
Adds Run key to start application 2 TTPs 11 IoCs
Processes:
WScript.exeFB_197D.tmp.exeWScript.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Defencler-DoOoM = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft Office\\Windows Defencler-DoOoM.lnk\"" WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefencler = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WindowsDefencler\\WindowsDefencler.exe" FB_197D.tmp.exe Key created \REGISTRY\MACHINE\software\Wow6432Node\microsoft\windows\currentversion\run WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Defencler-DoOoM = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft Office\\Windows Defencler-DoOoM.lnk\"" WScript.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Defencler-DoOoMs = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft Office\\Windows Defencler-DoOoMp.lnk\"" WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Defencler-DoOoMs = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft Office\\Windows Defencler-DoOoMp.lnk\"" WScript.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\software\microsoft\windows\currentversion\run WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\FB_18EF = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\FB_18EF.tmp.vbs\"" WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FB_18EF = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\FB_18EF.tmp.vbs\"" WScript.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run WScript.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
FB_197D.tmp.exeWindowsDefencler.exedescription pid process target process PID 976 set thread context of 568 976 FB_197D.tmp.exe FB_197D.tmp.exe PID 1756 set thread context of 1544 1756 WindowsDefencler.exe WindowsDefencler.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 1084 schtasks.exe 1580 schtasks.exe 1812 schtasks.exe 1580 schtasks.exe 456 schtasks.exe 1788 schtasks.exe -
Kills process with taskkill 3 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exepid process 1104 taskkill.exe 1580 taskkill.exe 1604 taskkill.exe -
Modifies registry class 10 IoCs
Processes:
WScript.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command = "%SystemRoot%\\regedit.EXE, wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\System\\Windows Defencler-DoOoMs.vbs\"" WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hlpfile\shell\open WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hlpfile\shell\open\command = "%SystemRoot%\\SysWow64\\winhlp32.exe, wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\System\\Windows Defencler-DoOoMs.vbs\"" WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\open WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\open\command = "%SystemRoot%\\SysWow64\\NOTEPAD.EXE, wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\System\\Windows Defencler-DoOoMs.vbs\"" WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} WScript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell WScript.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
Processes:
FB_197D.tmp.exeFB_197D.tmp.exeWindowsDefencler.exetaskkill.exetaskkill.exetaskkill.exedescription pid process Token: SeDebugPrivilege 976 FB_197D.tmp.exe Token: SeIncreaseQuotaPrivilege 568 FB_197D.tmp.exe Token: SeSecurityPrivilege 568 FB_197D.tmp.exe Token: SeTakeOwnershipPrivilege 568 FB_197D.tmp.exe Token: SeLoadDriverPrivilege 568 FB_197D.tmp.exe Token: SeSystemProfilePrivilege 568 FB_197D.tmp.exe Token: SeSystemtimePrivilege 568 FB_197D.tmp.exe Token: SeProfSingleProcessPrivilege 568 FB_197D.tmp.exe Token: SeIncBasePriorityPrivilege 568 FB_197D.tmp.exe Token: SeCreatePagefilePrivilege 568 FB_197D.tmp.exe Token: SeBackupPrivilege 568 FB_197D.tmp.exe Token: SeRestorePrivilege 568 FB_197D.tmp.exe Token: SeShutdownPrivilege 568 FB_197D.tmp.exe Token: SeDebugPrivilege 568 FB_197D.tmp.exe Token: SeSystemEnvironmentPrivilege 568 FB_197D.tmp.exe Token: SeChangeNotifyPrivilege 568 FB_197D.tmp.exe Token: SeRemoteShutdownPrivilege 568 FB_197D.tmp.exe Token: SeUndockPrivilege 568 FB_197D.tmp.exe Token: SeManageVolumePrivilege 568 FB_197D.tmp.exe Token: SeImpersonatePrivilege 568 FB_197D.tmp.exe Token: SeCreateGlobalPrivilege 568 FB_197D.tmp.exe Token: 33 568 FB_197D.tmp.exe Token: 34 568 FB_197D.tmp.exe Token: 35 568 FB_197D.tmp.exe Token: SeDebugPrivilege 1756 WindowsDefencler.exe Token: SeDebugPrivilege 1104 taskkill.exe Token: SeDebugPrivilege 1580 taskkill.exe Token: SeDebugPrivilege 1604 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52.exeFB_197D.tmp.exeFB_197D.tmp.execmd.execmd.exedescription pid process target process PID 1660 wrote to memory of 1828 1660 f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52.exe WScript.exe PID 1660 wrote to memory of 1828 1660 f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52.exe WScript.exe PID 1660 wrote to memory of 1828 1660 f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52.exe WScript.exe PID 1660 wrote to memory of 1828 1660 f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52.exe WScript.exe PID 1660 wrote to memory of 1076 1660 f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52.exe WScript.exe PID 1660 wrote to memory of 1076 1660 f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52.exe WScript.exe PID 1660 wrote to memory of 1076 1660 f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52.exe WScript.exe PID 1660 wrote to memory of 1076 1660 f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52.exe WScript.exe PID 1660 wrote to memory of 976 1660 f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52.exe FB_197D.tmp.exe PID 1660 wrote to memory of 976 1660 f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52.exe FB_197D.tmp.exe PID 1660 wrote to memory of 976 1660 f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52.exe FB_197D.tmp.exe PID 1660 wrote to memory of 976 1660 f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52.exe FB_197D.tmp.exe PID 976 wrote to memory of 568 976 FB_197D.tmp.exe FB_197D.tmp.exe PID 976 wrote to memory of 568 976 FB_197D.tmp.exe FB_197D.tmp.exe PID 976 wrote to memory of 568 976 FB_197D.tmp.exe FB_197D.tmp.exe PID 976 wrote to memory of 568 976 FB_197D.tmp.exe FB_197D.tmp.exe PID 976 wrote to memory of 568 976 FB_197D.tmp.exe FB_197D.tmp.exe PID 976 wrote to memory of 568 976 FB_197D.tmp.exe FB_197D.tmp.exe PID 976 wrote to memory of 568 976 FB_197D.tmp.exe FB_197D.tmp.exe PID 976 wrote to memory of 568 976 FB_197D.tmp.exe FB_197D.tmp.exe PID 976 wrote to memory of 568 976 FB_197D.tmp.exe FB_197D.tmp.exe PID 976 wrote to memory of 568 976 FB_197D.tmp.exe FB_197D.tmp.exe PID 976 wrote to memory of 568 976 FB_197D.tmp.exe FB_197D.tmp.exe PID 976 wrote to memory of 568 976 FB_197D.tmp.exe FB_197D.tmp.exe PID 976 wrote to memory of 568 976 FB_197D.tmp.exe FB_197D.tmp.exe PID 976 wrote to memory of 568 976 FB_197D.tmp.exe FB_197D.tmp.exe PID 976 wrote to memory of 568 976 FB_197D.tmp.exe FB_197D.tmp.exe PID 568 wrote to memory of 1168 568 FB_197D.tmp.exe cmd.exe PID 568 wrote to memory of 1168 568 FB_197D.tmp.exe cmd.exe PID 568 wrote to memory of 1168 568 FB_197D.tmp.exe cmd.exe PID 568 wrote to memory of 1168 568 FB_197D.tmp.exe cmd.exe PID 568 wrote to memory of 1336 568 FB_197D.tmp.exe cmd.exe PID 568 wrote to memory of 1336 568 FB_197D.tmp.exe cmd.exe PID 568 wrote to memory of 1336 568 FB_197D.tmp.exe cmd.exe PID 568 wrote to memory of 1336 568 FB_197D.tmp.exe cmd.exe PID 1168 wrote to memory of 848 1168 cmd.exe attrib.exe PID 1168 wrote to memory of 848 1168 cmd.exe attrib.exe PID 1168 wrote to memory of 848 1168 cmd.exe attrib.exe PID 1168 wrote to memory of 848 1168 cmd.exe attrib.exe PID 1336 wrote to memory of 1840 1336 cmd.exe attrib.exe PID 1336 wrote to memory of 1840 1336 cmd.exe attrib.exe PID 1336 wrote to memory of 1840 1336 cmd.exe attrib.exe PID 1336 wrote to memory of 1840 1336 cmd.exe attrib.exe PID 568 wrote to memory of 612 568 FB_197D.tmp.exe notepad.exe PID 568 wrote to memory of 612 568 FB_197D.tmp.exe notepad.exe PID 568 wrote to memory of 612 568 FB_197D.tmp.exe notepad.exe PID 568 wrote to memory of 612 568 FB_197D.tmp.exe notepad.exe PID 568 wrote to memory of 612 568 FB_197D.tmp.exe notepad.exe PID 568 wrote to memory of 612 568 FB_197D.tmp.exe notepad.exe PID 568 wrote to memory of 612 568 FB_197D.tmp.exe notepad.exe PID 568 wrote to memory of 612 568 FB_197D.tmp.exe notepad.exe PID 568 wrote to memory of 612 568 FB_197D.tmp.exe notepad.exe PID 568 wrote to memory of 612 568 FB_197D.tmp.exe notepad.exe PID 568 wrote to memory of 612 568 FB_197D.tmp.exe notepad.exe PID 568 wrote to memory of 612 568 FB_197D.tmp.exe notepad.exe PID 568 wrote to memory of 612 568 FB_197D.tmp.exe notepad.exe PID 568 wrote to memory of 612 568 FB_197D.tmp.exe notepad.exe PID 568 wrote to memory of 612 568 FB_197D.tmp.exe notepad.exe PID 568 wrote to memory of 612 568 FB_197D.tmp.exe notepad.exe PID 568 wrote to memory of 612 568 FB_197D.tmp.exe notepad.exe PID 568 wrote to memory of 612 568 FB_197D.tmp.exe notepad.exe PID 568 wrote to memory of 1756 568 FB_197D.tmp.exe WindowsDefencler.exe PID 568 wrote to memory of 1756 568 FB_197D.tmp.exe WindowsDefencler.exe PID 568 wrote to memory of 1756 568 FB_197D.tmp.exe WindowsDefencler.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 848 attrib.exe 1840 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52.exe"C:\Users\Admin\AppData\Local\Temp\f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\FB_14AA.tmp.vbs"2⤵
- Modifies WinLogon for persistence
- Drops startup file
- Adds Run key to start application
- Modifies registry class
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /F /IM SpyTheSpy.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /F /IM TiGeR-Firewall.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /F /IM bavtray.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc ONLOGON /RL HIGHEST /tn Windows Defencler-DoOoM.vbe /tr "C:\Users\Admin\AppData\Roaming\System\Windows Defencler-DoOoMs.vbs"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc ONLOGON /RL HIGHEST /tn Windows Defencler-DoOoM.vbe /tr "C:\Users\Admin\AppData\Roaming\System\Windows Defencler-DoOoMs.vbs"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc ONLOGON /RL HIGHEST /tn Windows Defencler-DoOoM.vbe /tr "C:\Users\Admin\AppData\Roaming\System\Windows Defencler-DoOoMs.vbs"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc ONLOGON /RL HIGHEST /tn Windows Defencler-DoOoM.vbe /tr "C:\Users\Admin\AppData\Roaming\System\Windows Defencler-DoOoMs.vbs"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc ONLOGON /RL HIGHEST /tn Windows Defencler-DoOoM.vbe /tr "C:\Users\Admin\AppData\Roaming\System\Windows Defencler-DoOoMs.vbs"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc ONLOGON /RL HIGHEST /tn Windows Defencler-DoOoM.vbe /tr "C:\Users\Admin\AppData\Roaming\System\Windows Defencler-DoOoMs.vbs"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\FB_18EF.tmp.vbs"2⤵
- Drops startup file
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\FB_197D.tmp.exe"C:\Users\Admin\AppData\Local\Temp\FB_197D.tmp.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FB_197D.tmp.exeC:\Users\Admin\AppData\Local\Temp\FB_197D.tmp.exe3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\FB_197D.tmp.exe" +s +h4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\FB_197D.tmp.exe" +s +h5⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h5⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad4⤵
-
C:\Users\Admin\AppData\Local\Temp\WindowsDefencler\WindowsDefencler.exe"C:\Users\Admin\AppData\Local\Temp\WindowsDefencler\WindowsDefencler.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\WindowsDefencler\WindowsDefencler.exeC:\Users\Admin\AppData\Local\Temp\WindowsDefencler\WindowsDefencler.exe5⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\FB_14AA.tmp.vbsFilesize
535KB
MD5c192fc4bc4e0fbd5aeb10a6dd1352d51
SHA1753144fbb384f7245ffb769d3bb35e0aa800d27d
SHA2564d1105930217a87b178d5d116b54d3bd94c1d8e61d258022e41232307c88c3fd
SHA5121dbae48badfb7d073b47d27f3dd953bb3b11f88b9517eb92c46499d5ec59a8f9c116689cede68966f39d366a85513bf109de8cfabacf7697f3f0a67b044a030e
-
C:\Users\Admin\AppData\Local\Temp\FB_18EF.tmp.vbsFilesize
208KB
MD5d5ede071cdc5b5ff7fad809976515ad0
SHA1f1141aefa5de1572442b66c14ce33448a3658017
SHA2565f9e6543647483d66f53e6ce296321e4ca649d806c26700fbd2da828f2788850
SHA512cc617f626bde4ce30d7639752c63e26b10ee2b4feb05c627d0b963e3d392f1546cedf2d508bec764f95f7e49158a55844d7c56a7c34f18c13ff27b2834facbd4
-
C:\Users\Admin\AppData\Local\Temp\FB_197D.tmp.exeFilesize
479KB
MD5b529c526c39d32ee04e26e1769b2797f
SHA1236584b8cbcba90c1b331863725d028c3bfea2c2
SHA256e186527d9b0a7c37e045bc021b59b4283330d7ba0196a598d27aa2601be9ad62
SHA5120b1511640daa85fa19688225d12e46f45ea94bc4771c7b44044666e47b022dd633d8f0da1f7fd6788cf048c94897bfa884b7e847375d538c4fbe66b41f1421db
-
C:\Users\Admin\AppData\Local\Temp\FB_197D.tmp.exeFilesize
479KB
MD5b529c526c39d32ee04e26e1769b2797f
SHA1236584b8cbcba90c1b331863725d028c3bfea2c2
SHA256e186527d9b0a7c37e045bc021b59b4283330d7ba0196a598d27aa2601be9ad62
SHA5120b1511640daa85fa19688225d12e46f45ea94bc4771c7b44044666e47b022dd633d8f0da1f7fd6788cf048c94897bfa884b7e847375d538c4fbe66b41f1421db
-
C:\Users\Admin\AppData\Local\Temp\FB_197D.tmp.exeFilesize
479KB
MD5b529c526c39d32ee04e26e1769b2797f
SHA1236584b8cbcba90c1b331863725d028c3bfea2c2
SHA256e186527d9b0a7c37e045bc021b59b4283330d7ba0196a598d27aa2601be9ad62
SHA5120b1511640daa85fa19688225d12e46f45ea94bc4771c7b44044666e47b022dd633d8f0da1f7fd6788cf048c94897bfa884b7e847375d538c4fbe66b41f1421db
-
C:\Users\Admin\AppData\Local\Temp\WindowsDefencler\WindowsDefencler.exeFilesize
479KB
MD5b529c526c39d32ee04e26e1769b2797f
SHA1236584b8cbcba90c1b331863725d028c3bfea2c2
SHA256e186527d9b0a7c37e045bc021b59b4283330d7ba0196a598d27aa2601be9ad62
SHA5120b1511640daa85fa19688225d12e46f45ea94bc4771c7b44044666e47b022dd633d8f0da1f7fd6788cf048c94897bfa884b7e847375d538c4fbe66b41f1421db
-
C:\Users\Admin\AppData\Local\Temp\WindowsDefencler\WindowsDefencler.exeFilesize
479KB
MD5b529c526c39d32ee04e26e1769b2797f
SHA1236584b8cbcba90c1b331863725d028c3bfea2c2
SHA256e186527d9b0a7c37e045bc021b59b4283330d7ba0196a598d27aa2601be9ad62
SHA5120b1511640daa85fa19688225d12e46f45ea94bc4771c7b44044666e47b022dd633d8f0da1f7fd6788cf048c94897bfa884b7e847375d538c4fbe66b41f1421db
-
C:\Users\Admin\AppData\Local\Temp\WindowsDefencler\WindowsDefencler.exeFilesize
479KB
MD5b529c526c39d32ee04e26e1769b2797f
SHA1236584b8cbcba90c1b331863725d028c3bfea2c2
SHA256e186527d9b0a7c37e045bc021b59b4283330d7ba0196a598d27aa2601be9ad62
SHA5120b1511640daa85fa19688225d12e46f45ea94bc4771c7b44044666e47b022dd633d8f0da1f7fd6788cf048c94897bfa884b7e847375d538c4fbe66b41f1421db
-
C:\Users\Admin\AppData\Roaming\svchost.exeFilesize
479KB
MD5b529c526c39d32ee04e26e1769b2797f
SHA1236584b8cbcba90c1b331863725d028c3bfea2c2
SHA256e186527d9b0a7c37e045bc021b59b4283330d7ba0196a598d27aa2601be9ad62
SHA5120b1511640daa85fa19688225d12e46f45ea94bc4771c7b44044666e47b022dd633d8f0da1f7fd6788cf048c94897bfa884b7e847375d538c4fbe66b41f1421db
-
\Users\Admin\AppData\Local\Temp\FB_197D.tmp.exeFilesize
479KB
MD5b529c526c39d32ee04e26e1769b2797f
SHA1236584b8cbcba90c1b331863725d028c3bfea2c2
SHA256e186527d9b0a7c37e045bc021b59b4283330d7ba0196a598d27aa2601be9ad62
SHA5120b1511640daa85fa19688225d12e46f45ea94bc4771c7b44044666e47b022dd633d8f0da1f7fd6788cf048c94897bfa884b7e847375d538c4fbe66b41f1421db
-
\Users\Admin\AppData\Local\Temp\FB_197D.tmp.exeFilesize
479KB
MD5b529c526c39d32ee04e26e1769b2797f
SHA1236584b8cbcba90c1b331863725d028c3bfea2c2
SHA256e186527d9b0a7c37e045bc021b59b4283330d7ba0196a598d27aa2601be9ad62
SHA5120b1511640daa85fa19688225d12e46f45ea94bc4771c7b44044666e47b022dd633d8f0da1f7fd6788cf048c94897bfa884b7e847375d538c4fbe66b41f1421db
-
\Users\Admin\AppData\Local\Temp\FB_197D.tmp.exeFilesize
479KB
MD5b529c526c39d32ee04e26e1769b2797f
SHA1236584b8cbcba90c1b331863725d028c3bfea2c2
SHA256e186527d9b0a7c37e045bc021b59b4283330d7ba0196a598d27aa2601be9ad62
SHA5120b1511640daa85fa19688225d12e46f45ea94bc4771c7b44044666e47b022dd633d8f0da1f7fd6788cf048c94897bfa884b7e847375d538c4fbe66b41f1421db
-
\Users\Admin\AppData\Local\Temp\WindowsDefencler\WindowsDefencler.exeFilesize
479KB
MD5b529c526c39d32ee04e26e1769b2797f
SHA1236584b8cbcba90c1b331863725d028c3bfea2c2
SHA256e186527d9b0a7c37e045bc021b59b4283330d7ba0196a598d27aa2601be9ad62
SHA5120b1511640daa85fa19688225d12e46f45ea94bc4771c7b44044666e47b022dd633d8f0da1f7fd6788cf048c94897bfa884b7e847375d538c4fbe66b41f1421db
-
\Users\Admin\AppData\Local\Temp\WindowsDefencler\WindowsDefencler.exeFilesize
479KB
MD5b529c526c39d32ee04e26e1769b2797f
SHA1236584b8cbcba90c1b331863725d028c3bfea2c2
SHA256e186527d9b0a7c37e045bc021b59b4283330d7ba0196a598d27aa2601be9ad62
SHA5120b1511640daa85fa19688225d12e46f45ea94bc4771c7b44044666e47b022dd633d8f0da1f7fd6788cf048c94897bfa884b7e847375d538c4fbe66b41f1421db
-
\Users\Admin\AppData\Local\Temp\WindowsDefencler\WindowsDefencler.exeFilesize
479KB
MD5b529c526c39d32ee04e26e1769b2797f
SHA1236584b8cbcba90c1b331863725d028c3bfea2c2
SHA256e186527d9b0a7c37e045bc021b59b4283330d7ba0196a598d27aa2601be9ad62
SHA5120b1511640daa85fa19688225d12e46f45ea94bc4771c7b44044666e47b022dd633d8f0da1f7fd6788cf048c94897bfa884b7e847375d538c4fbe66b41f1421db
-
memory/456-104-0x0000000000000000-mapping.dmp
-
memory/568-82-0x0000000000400000-0x000000000050C000-memory.dmpFilesize
1.0MB
-
memory/568-69-0x0000000000400000-0x000000000050C000-memory.dmpFilesize
1.0MB
-
memory/568-72-0x0000000000400000-0x000000000050C000-memory.dmpFilesize
1.0MB
-
memory/568-75-0x0000000000400000-0x000000000050C000-memory.dmpFilesize
1.0MB
-
memory/568-70-0x000000000048F888-mapping.dmp
-
memory/612-80-0x0000000000000000-mapping.dmp
-
memory/848-78-0x0000000000000000-mapping.dmp
-
memory/976-61-0x0000000000000000-mapping.dmp
-
memory/976-67-0x0000000073CD0000-0x000000007427B000-memory.dmpFilesize
5.7MB
-
memory/976-73-0x0000000073CD0000-0x000000007427B000-memory.dmpFilesize
5.7MB
-
memory/1076-56-0x0000000000000000-mapping.dmp
-
memory/1084-100-0x0000000000000000-mapping.dmp
-
memory/1104-96-0x0000000000000000-mapping.dmp
-
memory/1168-76-0x0000000000000000-mapping.dmp
-
memory/1336-77-0x0000000000000000-mapping.dmp
-
memory/1544-93-0x000000000048F888-mapping.dmp
-
memory/1580-103-0x0000000000000000-mapping.dmp
-
memory/1580-101-0x0000000000000000-mapping.dmp
-
memory/1580-97-0x0000000000000000-mapping.dmp
-
memory/1604-98-0x0000000000000000-mapping.dmp
-
memory/1660-54-0x0000000075F51000-0x0000000075F53000-memory.dmpFilesize
8KB
-
memory/1756-89-0x0000000071910000-0x0000000071EBB000-memory.dmpFilesize
5.7MB
-
memory/1756-95-0x0000000071910000-0x0000000071EBB000-memory.dmpFilesize
5.7MB
-
memory/1756-85-0x0000000000000000-mapping.dmp
-
memory/1788-99-0x0000000000000000-mapping.dmp
-
memory/1812-102-0x0000000000000000-mapping.dmp
-
memory/1828-55-0x0000000000000000-mapping.dmp
-
memory/1840-79-0x0000000000000000-mapping.dmp