Analysis
-
max time kernel
153s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2022 05:41
Static task
static1
Behavioral task
behavioral1
Sample
eaceefa415070bbdd2c0f66d51e3161ac6cf9039f284199f6b610f83ce2f24d8.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
eaceefa415070bbdd2c0f66d51e3161ac6cf9039f284199f6b610f83ce2f24d8.exe
Resource
win10v2004-20220812-en
General
-
Target
eaceefa415070bbdd2c0f66d51e3161ac6cf9039f284199f6b610f83ce2f24d8.exe
-
Size
184KB
-
MD5
17255f13e6914fbc1dd9dec40a0f05cd
-
SHA1
69142df7d8539ceec58cd37b5b2ed4197de709ed
-
SHA256
eaceefa415070bbdd2c0f66d51e3161ac6cf9039f284199f6b610f83ce2f24d8
-
SHA512
fde2cf558b3dea7bd8b7bc6afe9931fe7c7051834405196067965a53ebdd5865fe46927b57b3857e21546ff8d673628f06981bd4787057b5c1df5216287659f6
-
SSDEEP
3072:+yXt9mTrJfPB6y0TwqjoL0sMjHicmDJij4X0PQgyrkEp92QObfOCLn2O:D4FfZ6zTwhmjsO4XcQ1F9pObp2O
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 2 IoCs
Processes:
broxidy.exebroxidy.exepid process 4936 broxidy.exe 1220 broxidy.exe -
Modifies Installed Components in the registry 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
broxidy.exedescription ioc process File renamed C:\Users\Admin\Pictures\OptimizeRestart.raw => C:\Users\Admin\Pictures\OptimizeRestart.raw.ecc broxidy.exe File renamed C:\Users\Admin\Pictures\ResetRevoke.png => C:\Users\Admin\Pictures\ResetRevoke.png.ecc broxidy.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
eaceefa415070bbdd2c0f66d51e3161ac6cf9039f284199f6b610f83ce2f24d8.exebroxidy.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation eaceefa415070bbdd2c0f66d51e3161ac6cf9039f284199f6b610f83ce2f24d8.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation broxidy.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
broxidy.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\*svv_e = "C:\\Users\\Admin\\AppData\\Roaming\\broxidy.exe" broxidy.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run broxidy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svv_e = "C:\\Users\\Admin\\AppData\\Roaming\\broxidy.exe" broxidy.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce broxidy.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 5 ipinfo.io -
Suspicious use of SetThreadContext 2 IoCs
Processes:
eaceefa415070bbdd2c0f66d51e3161ac6cf9039f284199f6b610f83ce2f24d8.exebroxidy.exedescription pid process target process PID 5072 set thread context of 4928 5072 eaceefa415070bbdd2c0f66d51e3161ac6cf9039f284199f6b610f83ce2f24d8.exe eaceefa415070bbdd2c0f66d51e3161ac6cf9039f284199f6b610f83ce2f24d8.exe PID 4936 set thread context of 1220 4936 broxidy.exe broxidy.exe -
Drops file in Program Files directory 64 IoCs
Processes:
broxidy.exedescription ioc process File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\AppWord32x32.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-64.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Advanced-Dark.scale-150.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\16.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-16_contrast-white.png broxidy.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\ja-JP\PackageManagementDscUtilities.strings.psd1 broxidy.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-black_scale-125.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-100_contrast-black.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-80_altform-unplated_contrast-white.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\MoviesAnywhereLogoWithTextLight.scale-100.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\LinkedInboxBadge.scale-200.png broxidy.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BOLDSTRI\THMBNAIL.PNG broxidy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square44x44\PaintAppList.targetsize-32_altform-unplated.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-60_altform-unplated_contrast-black.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosMedTile.contrast-black_scale-200.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square310x310\PaintLargeTile.scale-100.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\node_modules\reactxp-experimental-navigation\NavigationExperimental\assets\back-icon@2x.png broxidy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer2019_eula.txt broxidy.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeMediumTile.scale-125.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\music_offline_demo_page2.jpg broxidy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\StoreLogo.scale-125_contrast-black.png broxidy.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBluTSFrame.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\WideTile.scale-100.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-64_altform-unplated.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\OrientationControlMiddleCircleHover.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageBadgeLogo.scale-125_contrast-black.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-48_altform-unplated_contrast-black_devicefamily-colorfulunplated.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\skype-to-phone-tiny.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-96_altform-unplated.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Config\DarkTheme.json broxidy.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailWideTile.scale-125.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-40_altform-lightunplated.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\ImmersiveControl_Slider_Click_Sound.wma broxidy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageBadgeLogo.scale-125.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNewNoteWideTile.scale-150.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionSmallTile.scale-150.png broxidy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\HintBarEllipses.16.GrayF@2x.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AlarmsSplashScreen.contrast-black_scale-125.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNotePageSmallTile.scale-150.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-80_altform-unplated.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GameBar_LargeTile.scale-125.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookWideTile.scale-150.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\InsiderHubAppList.scale-100.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MedTile.scale-100_contrast-black.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-32.png broxidy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewCommentRTL@3x.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\PhotosWideTile.scale-100.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WorldClockLargeTile.contrast-white_scale-125.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\W0.png broxidy.exe File opened for modification C:\Program Files\PushRename.docx broxidy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\WorldClockWideTile.contrast-white_scale-200.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-36.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleAppAssets\Videos\people_fre_motionAsset_p1.mp4 broxidy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-72_altform-lightunplated.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Scientific.targetsize-32_contrast-white.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-64_contrast-black.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-32_altform-colorize.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Google.scale-200.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Google.scale-300.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\SmallTile.scale-150.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageSplashScreen.scale-125.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteMediumTile.scale-150.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-125.png broxidy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-32_altform-lightunplated.png broxidy.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4360 2864 WerFault.exe 3016 2816 WerFault.exe explorer.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 4552 vssadmin.exe -
Modifies registry class 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2891029575-1462575-1165213807-1000\{36EE5EA7-A4F8-4919-966B-1FD26EEB090C} explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
broxidy.exepid process 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe 1220 broxidy.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
Processes:
eaceefa415070bbdd2c0f66d51e3161ac6cf9039f284199f6b610f83ce2f24d8.exebroxidy.exevssvc.exeexplorer.exedescription pid process Token: SeDebugPrivilege 4928 eaceefa415070bbdd2c0f66d51e3161ac6cf9039f284199f6b610f83ce2f24d8.exe Token: SeDebugPrivilege 1220 broxidy.exe Token: SeBackupPrivilege 4660 vssvc.exe Token: SeRestorePrivilege 4660 vssvc.exe Token: SeAuditPrivilege 4660 vssvc.exe Token: SeShutdownPrivilege 2816 explorer.exe Token: SeCreatePagefilePrivilege 2816 explorer.exe Token: SeShutdownPrivilege 2816 explorer.exe Token: SeCreatePagefilePrivilege 2816 explorer.exe Token: SeShutdownPrivilege 2816 explorer.exe Token: SeCreatePagefilePrivilege 2816 explorer.exe Token: SeShutdownPrivilege 2816 explorer.exe Token: SeCreatePagefilePrivilege 2816 explorer.exe Token: SeShutdownPrivilege 2816 explorer.exe Token: SeCreatePagefilePrivilege 2816 explorer.exe Token: SeShutdownPrivilege 2816 explorer.exe Token: SeCreatePagefilePrivilege 2816 explorer.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
Processes:
explorer.exepid process 2816 explorer.exe 2816 explorer.exe 2816 explorer.exe 2816 explorer.exe 2816 explorer.exe 2816 explorer.exe -
Suspicious use of SendNotifyMessage 8 IoCs
Processes:
explorer.exepid process 2816 explorer.exe 2816 explorer.exe 2816 explorer.exe 2816 explorer.exe 2816 explorer.exe 2816 explorer.exe 2816 explorer.exe 2816 explorer.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
eaceefa415070bbdd2c0f66d51e3161ac6cf9039f284199f6b610f83ce2f24d8.exeeaceefa415070bbdd2c0f66d51e3161ac6cf9039f284199f6b610f83ce2f24d8.exebroxidy.exebroxidy.exedescription pid process target process PID 5072 wrote to memory of 4928 5072 eaceefa415070bbdd2c0f66d51e3161ac6cf9039f284199f6b610f83ce2f24d8.exe eaceefa415070bbdd2c0f66d51e3161ac6cf9039f284199f6b610f83ce2f24d8.exe PID 5072 wrote to memory of 4928 5072 eaceefa415070bbdd2c0f66d51e3161ac6cf9039f284199f6b610f83ce2f24d8.exe eaceefa415070bbdd2c0f66d51e3161ac6cf9039f284199f6b610f83ce2f24d8.exe PID 5072 wrote to memory of 4928 5072 eaceefa415070bbdd2c0f66d51e3161ac6cf9039f284199f6b610f83ce2f24d8.exe eaceefa415070bbdd2c0f66d51e3161ac6cf9039f284199f6b610f83ce2f24d8.exe PID 5072 wrote to memory of 4928 5072 eaceefa415070bbdd2c0f66d51e3161ac6cf9039f284199f6b610f83ce2f24d8.exe eaceefa415070bbdd2c0f66d51e3161ac6cf9039f284199f6b610f83ce2f24d8.exe PID 5072 wrote to memory of 4928 5072 eaceefa415070bbdd2c0f66d51e3161ac6cf9039f284199f6b610f83ce2f24d8.exe eaceefa415070bbdd2c0f66d51e3161ac6cf9039f284199f6b610f83ce2f24d8.exe PID 5072 wrote to memory of 4928 5072 eaceefa415070bbdd2c0f66d51e3161ac6cf9039f284199f6b610f83ce2f24d8.exe eaceefa415070bbdd2c0f66d51e3161ac6cf9039f284199f6b610f83ce2f24d8.exe PID 5072 wrote to memory of 4928 5072 eaceefa415070bbdd2c0f66d51e3161ac6cf9039f284199f6b610f83ce2f24d8.exe eaceefa415070bbdd2c0f66d51e3161ac6cf9039f284199f6b610f83ce2f24d8.exe PID 5072 wrote to memory of 4928 5072 eaceefa415070bbdd2c0f66d51e3161ac6cf9039f284199f6b610f83ce2f24d8.exe eaceefa415070bbdd2c0f66d51e3161ac6cf9039f284199f6b610f83ce2f24d8.exe PID 5072 wrote to memory of 4928 5072 eaceefa415070bbdd2c0f66d51e3161ac6cf9039f284199f6b610f83ce2f24d8.exe eaceefa415070bbdd2c0f66d51e3161ac6cf9039f284199f6b610f83ce2f24d8.exe PID 4928 wrote to memory of 4936 4928 eaceefa415070bbdd2c0f66d51e3161ac6cf9039f284199f6b610f83ce2f24d8.exe broxidy.exe PID 4928 wrote to memory of 4936 4928 eaceefa415070bbdd2c0f66d51e3161ac6cf9039f284199f6b610f83ce2f24d8.exe broxidy.exe PID 4928 wrote to memory of 4936 4928 eaceefa415070bbdd2c0f66d51e3161ac6cf9039f284199f6b610f83ce2f24d8.exe broxidy.exe PID 4936 wrote to memory of 1220 4936 broxidy.exe broxidy.exe PID 4936 wrote to memory of 1220 4936 broxidy.exe broxidy.exe PID 4936 wrote to memory of 1220 4936 broxidy.exe broxidy.exe PID 4936 wrote to memory of 1220 4936 broxidy.exe broxidy.exe PID 4936 wrote to memory of 1220 4936 broxidy.exe broxidy.exe PID 4936 wrote to memory of 1220 4936 broxidy.exe broxidy.exe PID 4936 wrote to memory of 1220 4936 broxidy.exe broxidy.exe PID 4936 wrote to memory of 1220 4936 broxidy.exe broxidy.exe PID 4936 wrote to memory of 1220 4936 broxidy.exe broxidy.exe PID 1220 wrote to memory of 4552 1220 broxidy.exe vssadmin.exe PID 1220 wrote to memory of 4552 1220 broxidy.exe vssadmin.exe PID 4928 wrote to memory of 1648 4928 eaceefa415070bbdd2c0f66d51e3161ac6cf9039f284199f6b610f83ce2f24d8.exe cmd.exe PID 4928 wrote to memory of 1648 4928 eaceefa415070bbdd2c0f66d51e3161ac6cf9039f284199f6b610f83ce2f24d8.exe cmd.exe PID 4928 wrote to memory of 1648 4928 eaceefa415070bbdd2c0f66d51e3161ac6cf9039f284199f6b610f83ce2f24d8.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eaceefa415070bbdd2c0f66d51e3161ac6cf9039f284199f6b610f83ce2f24d8.exe"C:\Users\Admin\AppData\Local\Temp\eaceefa415070bbdd2c0f66d51e3161ac6cf9039f284199f6b610f83ce2f24d8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\eaceefa415070bbdd2c0f66d51e3161ac6cf9039f284199f6b610f83ce2f24d8.exeC:\Users\Admin\AppData\Local\Temp\eaceefa415070bbdd2c0f66d51e3161ac6cf9039f284199f6b610f83ce2f24d8.exe2⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\broxidy.exeC:\Users\Admin\AppData\Roaming\broxidy.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\broxidy.exeC:\Users\Admin\AppData\Roaming\broxidy.exe4⤵
- Executes dropped EXE
- Modifies extensions of user files
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet5⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\EACEEF~1.EXE >> NUL3⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 432 -p 2864 -ip 28641⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2864 -s 76521⤵
- Program crash
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2816 -s 22242⤵
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 204 -p 2816 -ip 28161⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.eccFilesize
622KB
MD57e3a9be077588d581b2adc4071689411
SHA193820d7582f2580a35e67970e6318349e6ce7e3d
SHA256d478b5fcab7ba6c89b9e73d2f04d1e58ffae22d93c61ac86e7c44f3bf9bb7259
SHA512e2f9fa8df522c37e70ec7528dd6ff20011946b98c9384776999ac0d21599ceb14c06d2f02c7285a223566b162ba701a5e9bdba5b0a9900fb5e02d50c251f0b49
-
C:\Users\Admin\AppData\Roaming\broxidy.exeFilesize
184KB
MD517255f13e6914fbc1dd9dec40a0f05cd
SHA169142df7d8539ceec58cd37b5b2ed4197de709ed
SHA256eaceefa415070bbdd2c0f66d51e3161ac6cf9039f284199f6b610f83ce2f24d8
SHA512fde2cf558b3dea7bd8b7bc6afe9931fe7c7051834405196067965a53ebdd5865fe46927b57b3857e21546ff8d673628f06981bd4787057b5c1df5216287659f6
-
C:\Users\Admin\AppData\Roaming\broxidy.exeFilesize
184KB
MD517255f13e6914fbc1dd9dec40a0f05cd
SHA169142df7d8539ceec58cd37b5b2ed4197de709ed
SHA256eaceefa415070bbdd2c0f66d51e3161ac6cf9039f284199f6b610f83ce2f24d8
SHA512fde2cf558b3dea7bd8b7bc6afe9931fe7c7051834405196067965a53ebdd5865fe46927b57b3857e21546ff8d673628f06981bd4787057b5c1df5216287659f6
-
C:\Users\Admin\AppData\Roaming\broxidy.exeFilesize
184KB
MD517255f13e6914fbc1dd9dec40a0f05cd
SHA169142df7d8539ceec58cd37b5b2ed4197de709ed
SHA256eaceefa415070bbdd2c0f66d51e3161ac6cf9039f284199f6b610f83ce2f24d8
SHA512fde2cf558b3dea7bd8b7bc6afe9931fe7c7051834405196067965a53ebdd5865fe46927b57b3857e21546ff8d673628f06981bd4787057b5c1df5216287659f6
-
memory/1220-150-0x0000000074C50000-0x0000000074C89000-memory.dmpFilesize
228KB
-
memory/1220-149-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/1220-146-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/1220-155-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/1220-141-0x0000000000000000-mapping.dmp
-
memory/1220-145-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/1648-151-0x0000000000000000-mapping.dmp
-
memory/4552-154-0x0000000000000000-mapping.dmp
-
memory/4928-137-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/4928-152-0x0000000074C50000-0x0000000074C89000-memory.dmpFilesize
228KB
-
memory/4928-147-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/4928-148-0x0000000074C50000-0x0000000074C89000-memory.dmpFilesize
228KB
-
memory/4928-135-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/4928-134-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/4928-133-0x0000000000000000-mapping.dmp
-
memory/4928-153-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/4936-138-0x0000000000000000-mapping.dmp
-
memory/4936-144-0x0000000074C50000-0x0000000074C89000-memory.dmpFilesize
228KB
-
memory/5072-132-0x0000000075030000-0x0000000075069000-memory.dmpFilesize
228KB
-
memory/5072-136-0x0000000075030000-0x0000000075069000-memory.dmpFilesize
228KB