Analysis
-
max time kernel
151s -
max time network
77s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
28-11-2022 18:45
Static task
static1
Behavioral task
behavioral1
Sample
5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe
Resource
win10v2004-20221111-en
General
-
Target
5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe
-
Size
1020KB
-
MD5
993bd6d2e46b2da20495aa0cfcf57d15
-
SHA1
165ed6f64873c3e505bf0210269234079aa42ffc
-
SHA256
5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d
-
SHA512
a33751041b518743a206ddee1f3225410db59230288808ba3698f01ba72281925ee798c48a88d644ea7bf597ce3dcaa41d9716b3313d33c777dd60822e98b7de
-
SSDEEP
24576:EgLTUe8B1dWKnCHFra8bYxXjzOcvmzSmWvO/5l:EgXUBzMNqzlvmzR/5
Malware Config
Signatures
-
NirSoft MailPassView 7 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral1/memory/2024-60-0x0000000000400000-0x00000000004F0000-memory.dmp MailPassView behavioral1/memory/2024-61-0x0000000000400000-0x00000000004F0000-memory.dmp MailPassView behavioral1/memory/2024-62-0x0000000000400000-0x00000000004F0000-memory.dmp MailPassView behavioral1/memory/2024-63-0x00000000004EB18E-mapping.dmp MailPassView behavioral1/memory/2024-65-0x0000000000400000-0x00000000004F0000-memory.dmp MailPassView behavioral1/memory/2024-67-0x0000000000400000-0x00000000004F0000-memory.dmp MailPassView behavioral1/memory/1564-97-0x00000000004EB18E-mapping.dmp MailPassView -
NirSoft WebBrowserPassView 7 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral1/memory/2024-60-0x0000000000400000-0x00000000004F0000-memory.dmp WebBrowserPassView behavioral1/memory/2024-61-0x0000000000400000-0x00000000004F0000-memory.dmp WebBrowserPassView behavioral1/memory/2024-62-0x0000000000400000-0x00000000004F0000-memory.dmp WebBrowserPassView behavioral1/memory/2024-63-0x00000000004EB18E-mapping.dmp WebBrowserPassView behavioral1/memory/2024-65-0x0000000000400000-0x00000000004F0000-memory.dmp WebBrowserPassView behavioral1/memory/2024-67-0x0000000000400000-0x00000000004F0000-memory.dmp WebBrowserPassView behavioral1/memory/1564-97-0x00000000004EB18E-mapping.dmp WebBrowserPassView -
Nirsoft 7 IoCs
Processes:
resource yara_rule behavioral1/memory/2024-60-0x0000000000400000-0x00000000004F0000-memory.dmp Nirsoft behavioral1/memory/2024-61-0x0000000000400000-0x00000000004F0000-memory.dmp Nirsoft behavioral1/memory/2024-62-0x0000000000400000-0x00000000004F0000-memory.dmp Nirsoft behavioral1/memory/2024-63-0x00000000004EB18E-mapping.dmp Nirsoft behavioral1/memory/2024-65-0x0000000000400000-0x00000000004F0000-memory.dmp Nirsoft behavioral1/memory/2024-67-0x0000000000400000-0x00000000004F0000-memory.dmp Nirsoft behavioral1/memory/1564-97-0x00000000004EB18E-mapping.dmp Nirsoft -
Executes dropped EXE 4 IoCs
Processes:
BrokerInfrastructure.exeAudioEndpointBuilder.exeBrokerInfrastructure.exeAudioEndpointBuilder.exepid process 952 BrokerInfrastructure.exe 1712 AudioEndpointBuilder.exe 1324 BrokerInfrastructure.exe 1564 AudioEndpointBuilder.exe -
Loads dropped DLL 3 IoCs
Processes:
5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exeBrokerInfrastructure.exeAudioEndpointBuilder.exepid process 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 952 BrokerInfrastructure.exe 1712 AudioEndpointBuilder.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe" 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 whatismyipaddress.com 6 whatismyipaddress.com 7 whatismyipaddress.com -
Suspicious use of SetThreadContext 3 IoCs
Processes:
5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exeAudioEndpointBuilder.exe5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exedescription pid process target process PID 1688 set thread context of 2024 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe PID 1712 set thread context of 1564 1712 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 2024 set thread context of 112 2024 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1768 112 WerFault.exe vbc.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exeBrokerInfrastructure.exe5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exepid process 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 952 BrokerInfrastructure.exe 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 952 BrokerInfrastructure.exe 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 952 BrokerInfrastructure.exe 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 952 BrokerInfrastructure.exe 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 952 BrokerInfrastructure.exe 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 952 BrokerInfrastructure.exe 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 952 BrokerInfrastructure.exe 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 952 BrokerInfrastructure.exe 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 952 BrokerInfrastructure.exe 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 2024 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 2024 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 952 BrokerInfrastructure.exe 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 2024 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 952 BrokerInfrastructure.exe 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 2024 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 952 BrokerInfrastructure.exe 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 2024 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 952 BrokerInfrastructure.exe 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 2024 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 2024 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 952 BrokerInfrastructure.exe 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 952 BrokerInfrastructure.exe 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 2024 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 952 BrokerInfrastructure.exe 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 2024 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 2024 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 952 BrokerInfrastructure.exe 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 2024 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 2024 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exeBrokerInfrastructure.exe5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exeAudioEndpointBuilder.exeBrokerInfrastructure.exedescription pid process Token: SeDebugPrivilege 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe Token: SeDebugPrivilege 952 BrokerInfrastructure.exe Token: SeDebugPrivilege 2024 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe Token: SeDebugPrivilege 1712 AudioEndpointBuilder.exe Token: SeDebugPrivilege 1324 BrokerInfrastructure.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exepid process 2024 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe -
Suspicious use of WriteProcessMemory 48 IoCs
Processes:
5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exeBrokerInfrastructure.exeAudioEndpointBuilder.exe5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exevbc.exedescription pid process target process PID 1688 wrote to memory of 2024 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe PID 1688 wrote to memory of 2024 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe PID 1688 wrote to memory of 2024 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe PID 1688 wrote to memory of 2024 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe PID 1688 wrote to memory of 2024 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe PID 1688 wrote to memory of 2024 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe PID 1688 wrote to memory of 2024 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe PID 1688 wrote to memory of 2024 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe PID 1688 wrote to memory of 2024 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe PID 1688 wrote to memory of 952 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe BrokerInfrastructure.exe PID 1688 wrote to memory of 952 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe BrokerInfrastructure.exe PID 1688 wrote to memory of 952 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe BrokerInfrastructure.exe PID 1688 wrote to memory of 952 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe BrokerInfrastructure.exe PID 952 wrote to memory of 1712 952 BrokerInfrastructure.exe AudioEndpointBuilder.exe PID 952 wrote to memory of 1712 952 BrokerInfrastructure.exe AudioEndpointBuilder.exe PID 952 wrote to memory of 1712 952 BrokerInfrastructure.exe AudioEndpointBuilder.exe PID 952 wrote to memory of 1712 952 BrokerInfrastructure.exe AudioEndpointBuilder.exe PID 1688 wrote to memory of 1324 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe BrokerInfrastructure.exe PID 1688 wrote to memory of 1324 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe BrokerInfrastructure.exe PID 1688 wrote to memory of 1324 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe BrokerInfrastructure.exe PID 1688 wrote to memory of 1324 1688 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe BrokerInfrastructure.exe PID 1712 wrote to memory of 1564 1712 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 1712 wrote to memory of 1564 1712 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 1712 wrote to memory of 1564 1712 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 1712 wrote to memory of 1564 1712 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 1712 wrote to memory of 1564 1712 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 1712 wrote to memory of 1564 1712 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 1712 wrote to memory of 1564 1712 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 1712 wrote to memory of 1564 1712 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 1712 wrote to memory of 1564 1712 AudioEndpointBuilder.exe AudioEndpointBuilder.exe PID 2024 wrote to memory of 112 2024 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe vbc.exe PID 2024 wrote to memory of 112 2024 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe vbc.exe PID 2024 wrote to memory of 112 2024 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe vbc.exe PID 2024 wrote to memory of 112 2024 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe vbc.exe PID 2024 wrote to memory of 112 2024 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe vbc.exe PID 2024 wrote to memory of 112 2024 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe vbc.exe PID 2024 wrote to memory of 112 2024 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe vbc.exe PID 2024 wrote to memory of 112 2024 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe vbc.exe PID 2024 wrote to memory of 112 2024 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe vbc.exe PID 2024 wrote to memory of 112 2024 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe vbc.exe PID 2024 wrote to memory of 1096 2024 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe dw20.exe PID 2024 wrote to memory of 1096 2024 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe dw20.exe PID 2024 wrote to memory of 1096 2024 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe dw20.exe PID 2024 wrote to memory of 1096 2024 5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe dw20.exe PID 112 wrote to memory of 1768 112 vbc.exe WerFault.exe PID 112 wrote to memory of 1768 112 vbc.exe WerFault.exe PID 112 wrote to memory of 1768 112 vbc.exe WerFault.exe PID 112 wrote to memory of 1768 112 vbc.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe"C:\Users\Admin\AppData\Local\Temp\5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe"C:\Users\Admin\AppData\Local\Temp\5041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 112 -s 364⤵
- Program crash
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 5603⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\BrokerInfrastructure.exe"C:\Users\Admin\AppData\Roaming\Microsoft\BrokerInfrastructure.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\BrokerInfrastructure.exe"C:\Users\Admin\AppData\Roaming\Microsoft\BrokerInfrastructure.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1020KB
MD5993bd6d2e46b2da20495aa0cfcf57d15
SHA1165ed6f64873c3e505bf0210269234079aa42ffc
SHA2565041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d
SHA512a33751041b518743a206ddee1f3225410db59230288808ba3698f01ba72281925ee798c48a88d644ea7bf597ce3dcaa41d9716b3313d33c777dd60822e98b7de
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1020KB
MD5993bd6d2e46b2da20495aa0cfcf57d15
SHA1165ed6f64873c3e505bf0210269234079aa42ffc
SHA2565041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d
SHA512a33751041b518743a206ddee1f3225410db59230288808ba3698f01ba72281925ee798c48a88d644ea7bf597ce3dcaa41d9716b3313d33c777dd60822e98b7de
-
C:\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1020KB
MD5993bd6d2e46b2da20495aa0cfcf57d15
SHA1165ed6f64873c3e505bf0210269234079aa42ffc
SHA2565041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d
SHA512a33751041b518743a206ddee1f3225410db59230288808ba3698f01ba72281925ee798c48a88d644ea7bf597ce3dcaa41d9716b3313d33c777dd60822e98b7de
-
C:\Users\Admin\AppData\Roaming\Microsoft\BrokerInfrastructure.exeFilesize
12KB
MD559882082f35cfab34acb407b7e95241c
SHA1caa21d2c0d24e317b48cc6d998e70e863f5a509d
SHA256c92ab4aa356c559b7701747f53b4a09bc0643d96e2a269493eab7b101e31950d
SHA512727f4e41b3c742720e4efc3d734a1fe4fc2d11711cb2874151a4087727db00e437997fec8a54bf46d8e6a5af4e6ea9b12e29f763f8ae30e8d209a4bd64a4cb98
-
C:\Users\Admin\AppData\Roaming\Microsoft\BrokerInfrastructure.exeFilesize
12KB
MD559882082f35cfab34acb407b7e95241c
SHA1caa21d2c0d24e317b48cc6d998e70e863f5a509d
SHA256c92ab4aa356c559b7701747f53b4a09bc0643d96e2a269493eab7b101e31950d
SHA512727f4e41b3c742720e4efc3d734a1fe4fc2d11711cb2874151a4087727db00e437997fec8a54bf46d8e6a5af4e6ea9b12e29f763f8ae30e8d209a4bd64a4cb98
-
C:\Users\Admin\AppData\Roaming\Microsoft\BrokerInfrastructure.exeFilesize
12KB
MD559882082f35cfab34acb407b7e95241c
SHA1caa21d2c0d24e317b48cc6d998e70e863f5a509d
SHA256c92ab4aa356c559b7701747f53b4a09bc0643d96e2a269493eab7b101e31950d
SHA512727f4e41b3c742720e4efc3d734a1fe4fc2d11711cb2874151a4087727db00e437997fec8a54bf46d8e6a5af4e6ea9b12e29f763f8ae30e8d209a4bd64a4cb98
-
\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1020KB
MD5993bd6d2e46b2da20495aa0cfcf57d15
SHA1165ed6f64873c3e505bf0210269234079aa42ffc
SHA2565041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d
SHA512a33751041b518743a206ddee1f3225410db59230288808ba3698f01ba72281925ee798c48a88d644ea7bf597ce3dcaa41d9716b3313d33c777dd60822e98b7de
-
\Users\Admin\AppData\Roaming\Microsoft\AudioEndpointBuilder.exeFilesize
1020KB
MD5993bd6d2e46b2da20495aa0cfcf57d15
SHA1165ed6f64873c3e505bf0210269234079aa42ffc
SHA2565041fb834d7cc499213e8900304fd26d3014b41a32ea05fbb07076f43c0b492d
SHA512a33751041b518743a206ddee1f3225410db59230288808ba3698f01ba72281925ee798c48a88d644ea7bf597ce3dcaa41d9716b3313d33c777dd60822e98b7de
-
\Users\Admin\AppData\Roaming\Microsoft\BrokerInfrastructure.exeFilesize
12KB
MD559882082f35cfab34acb407b7e95241c
SHA1caa21d2c0d24e317b48cc6d998e70e863f5a509d
SHA256c92ab4aa356c559b7701747f53b4a09bc0643d96e2a269493eab7b101e31950d
SHA512727f4e41b3c742720e4efc3d734a1fe4fc2d11711cb2874151a4087727db00e437997fec8a54bf46d8e6a5af4e6ea9b12e29f763f8ae30e8d209a4bd64a4cb98
-
memory/112-105-0x0000000000411714-mapping.dmp
-
memory/112-104-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/952-85-0x00000000741C0000-0x000000007476B000-memory.dmpFilesize
5.7MB
-
memory/952-70-0x0000000000000000-mapping.dmp
-
memory/952-80-0x00000000741C0000-0x000000007476B000-memory.dmpFilesize
5.7MB
-
memory/952-83-0x00000000741C0000-0x000000007476B000-memory.dmpFilesize
5.7MB
-
memory/1096-108-0x0000000000000000-mapping.dmp
-
memory/1324-112-0x00000000741C0000-0x000000007476B000-memory.dmpFilesize
5.7MB
-
memory/1324-89-0x00000000741C0000-0x000000007476B000-memory.dmpFilesize
5.7MB
-
memory/1324-86-0x0000000000000000-mapping.dmp
-
memory/1564-113-0x00000000741C0000-0x000000007476B000-memory.dmpFilesize
5.7MB
-
memory/1564-97-0x00000000004EB18E-mapping.dmp
-
memory/1564-111-0x00000000741C0000-0x000000007476B000-memory.dmpFilesize
5.7MB
-
memory/1688-55-0x00000000741C0000-0x000000007476B000-memory.dmpFilesize
5.7MB
-
memory/1688-56-0x00000000741C0000-0x000000007476B000-memory.dmpFilesize
5.7MB
-
memory/1688-54-0x0000000075601000-0x0000000075603000-memory.dmpFilesize
8KB
-
memory/1712-81-0x00000000741C0000-0x000000007476B000-memory.dmpFilesize
5.7MB
-
memory/1712-84-0x00000000741C0000-0x000000007476B000-memory.dmpFilesize
5.7MB
-
memory/1712-76-0x0000000000000000-mapping.dmp
-
memory/1768-109-0x0000000000000000-mapping.dmp
-
memory/2024-58-0x0000000000400000-0x00000000004F0000-memory.dmpFilesize
960KB
-
memory/2024-82-0x00000000741C0000-0x000000007476B000-memory.dmpFilesize
5.7MB
-
memory/2024-79-0x00000000741C0000-0x000000007476B000-memory.dmpFilesize
5.7MB
-
memory/2024-57-0x0000000000400000-0x00000000004F0000-memory.dmpFilesize
960KB
-
memory/2024-61-0x0000000000400000-0x00000000004F0000-memory.dmpFilesize
960KB
-
memory/2024-60-0x0000000000400000-0x00000000004F0000-memory.dmpFilesize
960KB
-
memory/2024-67-0x0000000000400000-0x00000000004F0000-memory.dmpFilesize
960KB
-
memory/2024-65-0x0000000000400000-0x00000000004F0000-memory.dmpFilesize
960KB
-
memory/2024-63-0x00000000004EB18E-mapping.dmp
-
memory/2024-62-0x0000000000400000-0x00000000004F0000-memory.dmpFilesize
960KB