Analysis
-
max time kernel
166s -
max time network
196s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2022 15:04
Static task
static1
Behavioral task
behavioral1
Sample
8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe
Resource
win7-20221111-en
General
-
Target
8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe
-
Size
701KB
-
MD5
b25024975e6b107aefb174749379b971
-
SHA1
efa76167a48f3568fa26771bfe373647b715b348
-
SHA256
8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1
-
SHA512
36a0f69820def5cca466f580195bf89d13c6b43c8d87015a1e11f398bf81d14cade6b51c03243980c086d170a32c2db91ad198c82af563c008bf8c31ac6fad43
-
SSDEEP
12288:x2BIlTNevFZO7DXDRb1egPRGGDmQmgS0/VGcwph889cuhx7k6:gaT8DO7Hp1BQGiQPS0di88aug6
Malware Config
Extracted
darkcomet
Bios
blazeros.zapto.org:3175
DC_MUTEX-GS0NEC8
-
InstallPath
AdobeFlashUpdater\flashplayer16x32_mssd_aaa_aih.exe
-
gencode
o4BdAqVuGTLH
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
AdobeFlashPlayerUpdateSvc
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\AdobeFlashUpdater\\flashplayer16x32_mssd_aaa_aih.exe" 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe -
Executes dropped EXE 2 IoCs
Processes:
flashplayer16x32_mssd_aaa_aih.exeflashplayer16x32_mssd_aaa_aih.exepid process 4592 flashplayer16x32_mssd_aaa_aih.exe 4028 flashplayer16x32_mssd_aaa_aih.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 1188 attrib.exe 4852 attrib.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdobeFlashPlayerUpdateSvc = "C:\\Windows\\system32\\AdobeFlashUpdater\\flashplayer16x32_mssd_aaa_aih.exe" 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe -
Drops file in System32 directory 4 IoCs
Processes:
8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exeflashplayer16x32_mssd_aaa_aih.exedescription ioc process File created C:\Windows\SysWOW64\AdobeFlashUpdater\flashplayer16x32_mssd_aaa_aih.exe 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe File opened for modification C:\Windows\SysWOW64\AdobeFlashUpdater\flashplayer16x32_mssd_aaa_aih.exe 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe File opened for modification C:\Windows\SysWOW64\AdobeFlashUpdater\ 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe File opened for modification C:\Windows\SysWOW64\AdobeFlashUpdater\flashplayer16x32_mssd_aaa_aih.exe flashplayer16x32_mssd_aaa_aih.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exeflashplayer16x32_mssd_aaa_aih.exedescription pid process target process PID 4784 set thread context of 4224 4784 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe PID 4592 set thread context of 4028 4592 flashplayer16x32_mssd_aaa_aih.exe flashplayer16x32_mssd_aaa_aih.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
flashplayer16x32_mssd_aaa_aih.exepid process 4028 flashplayer16x32_mssd_aaa_aih.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exeflashplayer16x32_mssd_aaa_aih.exedescription pid process Token: SeIncreaseQuotaPrivilege 4224 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe Token: SeSecurityPrivilege 4224 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe Token: SeTakeOwnershipPrivilege 4224 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe Token: SeLoadDriverPrivilege 4224 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe Token: SeSystemProfilePrivilege 4224 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe Token: SeSystemtimePrivilege 4224 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe Token: SeProfSingleProcessPrivilege 4224 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe Token: SeIncBasePriorityPrivilege 4224 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe Token: SeCreatePagefilePrivilege 4224 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe Token: SeBackupPrivilege 4224 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe Token: SeRestorePrivilege 4224 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe Token: SeShutdownPrivilege 4224 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe Token: SeDebugPrivilege 4224 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe Token: SeSystemEnvironmentPrivilege 4224 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe Token: SeChangeNotifyPrivilege 4224 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe Token: SeRemoteShutdownPrivilege 4224 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe Token: SeUndockPrivilege 4224 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe Token: SeManageVolumePrivilege 4224 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe Token: SeImpersonatePrivilege 4224 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe Token: SeCreateGlobalPrivilege 4224 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe Token: 33 4224 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe Token: 34 4224 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe Token: 35 4224 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe Token: 36 4224 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe Token: SeIncreaseQuotaPrivilege 4028 flashplayer16x32_mssd_aaa_aih.exe Token: SeSecurityPrivilege 4028 flashplayer16x32_mssd_aaa_aih.exe Token: SeTakeOwnershipPrivilege 4028 flashplayer16x32_mssd_aaa_aih.exe Token: SeLoadDriverPrivilege 4028 flashplayer16x32_mssd_aaa_aih.exe Token: SeSystemProfilePrivilege 4028 flashplayer16x32_mssd_aaa_aih.exe Token: SeSystemtimePrivilege 4028 flashplayer16x32_mssd_aaa_aih.exe Token: SeProfSingleProcessPrivilege 4028 flashplayer16x32_mssd_aaa_aih.exe Token: SeIncBasePriorityPrivilege 4028 flashplayer16x32_mssd_aaa_aih.exe Token: SeCreatePagefilePrivilege 4028 flashplayer16x32_mssd_aaa_aih.exe Token: SeBackupPrivilege 4028 flashplayer16x32_mssd_aaa_aih.exe Token: SeRestorePrivilege 4028 flashplayer16x32_mssd_aaa_aih.exe Token: SeShutdownPrivilege 4028 flashplayer16x32_mssd_aaa_aih.exe Token: SeDebugPrivilege 4028 flashplayer16x32_mssd_aaa_aih.exe Token: SeSystemEnvironmentPrivilege 4028 flashplayer16x32_mssd_aaa_aih.exe Token: SeChangeNotifyPrivilege 4028 flashplayer16x32_mssd_aaa_aih.exe Token: SeRemoteShutdownPrivilege 4028 flashplayer16x32_mssd_aaa_aih.exe Token: SeUndockPrivilege 4028 flashplayer16x32_mssd_aaa_aih.exe Token: SeManageVolumePrivilege 4028 flashplayer16x32_mssd_aaa_aih.exe Token: SeImpersonatePrivilege 4028 flashplayer16x32_mssd_aaa_aih.exe Token: SeCreateGlobalPrivilege 4028 flashplayer16x32_mssd_aaa_aih.exe Token: 33 4028 flashplayer16x32_mssd_aaa_aih.exe Token: 34 4028 flashplayer16x32_mssd_aaa_aih.exe Token: 35 4028 flashplayer16x32_mssd_aaa_aih.exe Token: 36 4028 flashplayer16x32_mssd_aaa_aih.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exeflashplayer16x32_mssd_aaa_aih.exeflashplayer16x32_mssd_aaa_aih.exepid process 4784 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe 4592 flashplayer16x32_mssd_aaa_aih.exe 4028 flashplayer16x32_mssd_aaa_aih.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.execmd.execmd.exeflashplayer16x32_mssd_aaa_aih.exeflashplayer16x32_mssd_aaa_aih.exedescription pid process target process PID 4784 wrote to memory of 4224 4784 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe PID 4784 wrote to memory of 4224 4784 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe PID 4784 wrote to memory of 4224 4784 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe PID 4784 wrote to memory of 4224 4784 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe PID 4784 wrote to memory of 4224 4784 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe PID 4784 wrote to memory of 4224 4784 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe PID 4784 wrote to memory of 4224 4784 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe PID 4784 wrote to memory of 4224 4784 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe PID 4784 wrote to memory of 4224 4784 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe PID 4784 wrote to memory of 4224 4784 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe PID 4784 wrote to memory of 4224 4784 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe PID 4784 wrote to memory of 4224 4784 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe PID 4784 wrote to memory of 4224 4784 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe PID 4784 wrote to memory of 4224 4784 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe PID 4224 wrote to memory of 2356 4224 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe cmd.exe PID 4224 wrote to memory of 2356 4224 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe cmd.exe PID 4224 wrote to memory of 2356 4224 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe cmd.exe PID 4224 wrote to memory of 4292 4224 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe cmd.exe PID 4224 wrote to memory of 4292 4224 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe cmd.exe PID 4224 wrote to memory of 4292 4224 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe cmd.exe PID 4292 wrote to memory of 1188 4292 cmd.exe attrib.exe PID 4292 wrote to memory of 1188 4292 cmd.exe attrib.exe PID 4292 wrote to memory of 1188 4292 cmd.exe attrib.exe PID 2356 wrote to memory of 4852 2356 cmd.exe attrib.exe PID 2356 wrote to memory of 4852 2356 cmd.exe attrib.exe PID 2356 wrote to memory of 4852 2356 cmd.exe attrib.exe PID 4224 wrote to memory of 4592 4224 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe flashplayer16x32_mssd_aaa_aih.exe PID 4224 wrote to memory of 4592 4224 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe flashplayer16x32_mssd_aaa_aih.exe PID 4224 wrote to memory of 4592 4224 8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe flashplayer16x32_mssd_aaa_aih.exe PID 4592 wrote to memory of 4028 4592 flashplayer16x32_mssd_aaa_aih.exe flashplayer16x32_mssd_aaa_aih.exe PID 4592 wrote to memory of 4028 4592 flashplayer16x32_mssd_aaa_aih.exe flashplayer16x32_mssd_aaa_aih.exe PID 4592 wrote to memory of 4028 4592 flashplayer16x32_mssd_aaa_aih.exe flashplayer16x32_mssd_aaa_aih.exe PID 4592 wrote to memory of 4028 4592 flashplayer16x32_mssd_aaa_aih.exe flashplayer16x32_mssd_aaa_aih.exe PID 4592 wrote to memory of 4028 4592 flashplayer16x32_mssd_aaa_aih.exe flashplayer16x32_mssd_aaa_aih.exe PID 4592 wrote to memory of 4028 4592 flashplayer16x32_mssd_aaa_aih.exe flashplayer16x32_mssd_aaa_aih.exe PID 4592 wrote to memory of 4028 4592 flashplayer16x32_mssd_aaa_aih.exe flashplayer16x32_mssd_aaa_aih.exe PID 4592 wrote to memory of 4028 4592 flashplayer16x32_mssd_aaa_aih.exe flashplayer16x32_mssd_aaa_aih.exe PID 4592 wrote to memory of 4028 4592 flashplayer16x32_mssd_aaa_aih.exe flashplayer16x32_mssd_aaa_aih.exe PID 4592 wrote to memory of 4028 4592 flashplayer16x32_mssd_aaa_aih.exe flashplayer16x32_mssd_aaa_aih.exe PID 4592 wrote to memory of 4028 4592 flashplayer16x32_mssd_aaa_aih.exe flashplayer16x32_mssd_aaa_aih.exe PID 4592 wrote to memory of 4028 4592 flashplayer16x32_mssd_aaa_aih.exe flashplayer16x32_mssd_aaa_aih.exe PID 4592 wrote to memory of 4028 4592 flashplayer16x32_mssd_aaa_aih.exe flashplayer16x32_mssd_aaa_aih.exe PID 4592 wrote to memory of 4028 4592 flashplayer16x32_mssd_aaa_aih.exe flashplayer16x32_mssd_aaa_aih.exe PID 4028 wrote to memory of 4480 4028 flashplayer16x32_mssd_aaa_aih.exe notepad.exe PID 4028 wrote to memory of 4480 4028 flashplayer16x32_mssd_aaa_aih.exe notepad.exe PID 4028 wrote to memory of 4480 4028 flashplayer16x32_mssd_aaa_aih.exe notepad.exe PID 4028 wrote to memory of 4480 4028 flashplayer16x32_mssd_aaa_aih.exe notepad.exe PID 4028 wrote to memory of 4480 4028 flashplayer16x32_mssd_aaa_aih.exe notepad.exe PID 4028 wrote to memory of 4480 4028 flashplayer16x32_mssd_aaa_aih.exe notepad.exe PID 4028 wrote to memory of 4480 4028 flashplayer16x32_mssd_aaa_aih.exe notepad.exe PID 4028 wrote to memory of 4480 4028 flashplayer16x32_mssd_aaa_aih.exe notepad.exe PID 4028 wrote to memory of 4480 4028 flashplayer16x32_mssd_aaa_aih.exe notepad.exe PID 4028 wrote to memory of 4480 4028 flashplayer16x32_mssd_aaa_aih.exe notepad.exe PID 4028 wrote to memory of 4480 4028 flashplayer16x32_mssd_aaa_aih.exe notepad.exe PID 4028 wrote to memory of 4480 4028 flashplayer16x32_mssd_aaa_aih.exe notepad.exe PID 4028 wrote to memory of 4480 4028 flashplayer16x32_mssd_aaa_aih.exe notepad.exe PID 4028 wrote to memory of 4480 4028 flashplayer16x32_mssd_aaa_aih.exe notepad.exe PID 4028 wrote to memory of 4480 4028 flashplayer16x32_mssd_aaa_aih.exe notepad.exe PID 4028 wrote to memory of 4480 4028 flashplayer16x32_mssd_aaa_aih.exe notepad.exe PID 4028 wrote to memory of 4480 4028 flashplayer16x32_mssd_aaa_aih.exe notepad.exe PID 4028 wrote to memory of 4480 4028 flashplayer16x32_mssd_aaa_aih.exe notepad.exe PID 4028 wrote to memory of 4480 4028 flashplayer16x32_mssd_aaa_aih.exe notepad.exe PID 4028 wrote to memory of 4480 4028 flashplayer16x32_mssd_aaa_aih.exe notepad.exe PID 4028 wrote to memory of 4480 4028 flashplayer16x32_mssd_aaa_aih.exe notepad.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1188 attrib.exe 4852 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe"C:\Users\Admin\AppData\Local\Temp\8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe"C:\Users\Admin\AppData\Local\Temp\8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe"2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\8d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1.exe" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\AdobeFlashUpdater\flashplayer16x32_mssd_aaa_aih.exe"C:\Windows\system32\AdobeFlashUpdater\flashplayer16x32_mssd_aaa_aih.exe"3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\AdobeFlashUpdater\flashplayer16x32_mssd_aaa_aih.exe"C:\Windows\SysWOW64\AdobeFlashUpdater\flashplayer16x32_mssd_aaa_aih.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\AdobeFlashUpdater\flashplayer16x32_mssd_aaa_aih.exeFilesize
701KB
MD5b25024975e6b107aefb174749379b971
SHA1efa76167a48f3568fa26771bfe373647b715b348
SHA2568d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1
SHA51236a0f69820def5cca466f580195bf89d13c6b43c8d87015a1e11f398bf81d14cade6b51c03243980c086d170a32c2db91ad198c82af563c008bf8c31ac6fad43
-
C:\Windows\SysWOW64\AdobeFlashUpdater\flashplayer16x32_mssd_aaa_aih.exeFilesize
701KB
MD5b25024975e6b107aefb174749379b971
SHA1efa76167a48f3568fa26771bfe373647b715b348
SHA2568d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1
SHA51236a0f69820def5cca466f580195bf89d13c6b43c8d87015a1e11f398bf81d14cade6b51c03243980c086d170a32c2db91ad198c82af563c008bf8c31ac6fad43
-
C:\Windows\SysWOW64\AdobeFlashUpdater\flashplayer16x32_mssd_aaa_aih.exeFilesize
701KB
MD5b25024975e6b107aefb174749379b971
SHA1efa76167a48f3568fa26771bfe373647b715b348
SHA2568d562009530552d38f5144f202ec0fcbe90f129469d42e78c16098088e3ad0b1
SHA51236a0f69820def5cca466f580195bf89d13c6b43c8d87015a1e11f398bf81d14cade6b51c03243980c086d170a32c2db91ad198c82af563c008bf8c31ac6fad43
-
memory/1188-145-0x0000000000000000-mapping.dmp
-
memory/2356-143-0x0000000000000000-mapping.dmp
-
memory/4028-163-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/4028-161-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/4028-155-0x0000000000000000-mapping.dmp
-
memory/4224-147-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/4224-137-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/4224-142-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/4224-136-0x0000000000000000-mapping.dmp
-
memory/4224-140-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/4292-144-0x0000000000000000-mapping.dmp
-
memory/4480-162-0x0000000000000000-mapping.dmp
-
memory/4592-148-0x0000000000000000-mapping.dmp
-
memory/4592-153-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/4592-154-0x0000000000030000-0x0000000000033000-memory.dmpFilesize
12KB
-
memory/4592-159-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/4784-132-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/4784-139-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/4784-141-0x0000000000030000-0x0000000000033000-memory.dmpFilesize
12KB
-
memory/4784-133-0x0000000000030000-0x0000000000033000-memory.dmpFilesize
12KB
-
memory/4852-146-0x0000000000000000-mapping.dmp