Analysis
-
max time kernel
179s -
max time network
185s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2022 18:55
Static task
static1
Behavioral task
behavioral1
Sample
99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe
Resource
win10v2004-20220812-en
General
-
Target
99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe
-
Size
998KB
-
MD5
177a34ddb5abf1506e41085974c5dfa8
-
SHA1
bc80d8a2c9acde2440acac32e9bfeacedb9cdea0
-
SHA256
99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85
-
SHA512
479a826c36c49d942f000de6625691fcdf7d081fc8062d5075459a7a1bca4a47b9a4b66d302af24a76e4c363a388eb7d0ab94a502a7794070faab7a2dbecbd6a
-
SSDEEP
24576:R157SnKT9x6tvsrhITbmK0pySuFOzuEh1MyC7h:RfmnKT9xyv6hi5VF1I1v4h
Malware Config
Signatures
-
NirSoft MailPassView 5 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/2944-135-0x0000000000400000-0x00000000004F0000-memory.dmp MailPassView behavioral2/memory/4392-173-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral2/memory/4392-172-0x0000000000000000-mapping.dmp MailPassView behavioral2/memory/4392-175-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral2/memory/4392-176-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 6 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral2/memory/2944-135-0x0000000000400000-0x00000000004F0000-memory.dmp WebBrowserPassView behavioral2/memory/4452-178-0x0000000000000000-mapping.dmp WebBrowserPassView behavioral2/memory/4452-179-0x0000000000400000-0x0000000000459000-memory.dmp WebBrowserPassView behavioral2/memory/4452-181-0x0000000000400000-0x0000000000459000-memory.dmp WebBrowserPassView behavioral2/memory/4452-182-0x0000000000400000-0x0000000000459000-memory.dmp WebBrowserPassView behavioral2/memory/4452-184-0x0000000000400000-0x0000000000459000-memory.dmp WebBrowserPassView -
Nirsoft 18 IoCs
Processes:
resource yara_rule behavioral2/memory/2944-135-0x0000000000400000-0x00000000004F0000-memory.dmp Nirsoft behavioral2/memory/4392-173-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/4392-172-0x0000000000000000-mapping.dmp Nirsoft behavioral2/memory/4392-175-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/4392-176-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral2/memory/4452-178-0x0000000000000000-mapping.dmp Nirsoft behavioral2/memory/4452-179-0x0000000000400000-0x0000000000459000-memory.dmp Nirsoft behavioral2/memory/4452-181-0x0000000000400000-0x0000000000459000-memory.dmp Nirsoft behavioral2/memory/4452-182-0x0000000000400000-0x0000000000459000-memory.dmp Nirsoft behavioral2/memory/4452-184-0x0000000000400000-0x0000000000459000-memory.dmp Nirsoft behavioral2/memory/3588-188-0x0000000000000000-mapping.dmp Nirsoft behavioral2/memory/3588-189-0x0000000000400000-0x0000000000415000-memory.dmp Nirsoft behavioral2/memory/3588-191-0x0000000000400000-0x0000000000415000-memory.dmp Nirsoft behavioral2/memory/3588-193-0x0000000000400000-0x0000000000415000-memory.dmp Nirsoft behavioral2/memory/1672-203-0x0000000000000000-mapping.dmp Nirsoft behavioral2/memory/1672-204-0x0000000000400000-0x000000000044F000-memory.dmp Nirsoft behavioral2/memory/1672-206-0x0000000000400000-0x000000000044F000-memory.dmp Nirsoft behavioral2/memory/1672-208-0x0000000000400000-0x000000000044F000-memory.dmp Nirsoft -
Executes dropped EXE 7 IoCs
Processes:
LookupSvi.exesecdrv.exesecdrv.exeLookupSvi.exesecdrv.exesecdrv.exeLookupSvi.exepid process 1016 LookupSvi.exe 3892 secdrv.exe 4848 secdrv.exe 4136 LookupSvi.exe 2512 secdrv.exe 2548 secdrv.exe 4052 LookupSvi.exe -
Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
LookupSvi.exesecdrv.exeLookupSvi.exesecdrv.exe99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation LookupSvi.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation secdrv.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation LookupSvi.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation secdrv.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
LookupSvi.exeLookupSvi.exeLookupSvi.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Macrovision Security = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\LookupSvi.exe" LookupSvi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Macrovision Security = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\LookupSvi.exe" LookupSvi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Macrovision Security = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\LookupSvi.exe" LookupSvi.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 36 whatismyipaddress.com -
Suspicious use of SetThreadContext 8 IoCs
Processes:
99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exesecdrv.exetakshost.exe99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exesecdrv.exedescription pid process target process PID 3076 set thread context of 2944 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe PID 3892 set thread context of 4848 3892 secdrv.exe secdrv.exe PID 968 set thread context of 2404 968 takshost.exe takshost.exe PID 2944 set thread context of 4392 2944 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 2944 set thread context of 4452 2944 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 2944 set thread context of 3588 2944 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 2512 set thread context of 2548 2512 secdrv.exe secdrv.exe PID 2944 set thread context of 1672 2944 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exepid process 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exepid process 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exeLookupSvi.exesecdrv.exe99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exetakshost.exeLookupSvi.exesecdrv.exeLookupSvi.exedescription pid process Token: SeDebugPrivilege 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe Token: SeDebugPrivilege 1016 LookupSvi.exe Token: SeDebugPrivilege 3892 secdrv.exe Token: SeDebugPrivilege 2944 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe Token: SeDebugPrivilege 968 takshost.exe Token: SeDebugPrivilege 4136 LookupSvi.exe Token: SeDebugPrivilege 2512 secdrv.exe Token: SeDebugPrivilege 4052 LookupSvi.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exepid process 2944 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exeLookupSvi.exesecdrv.exeLookupSvi.exetakshost.exe99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exedescription pid process target process PID 3076 wrote to memory of 2944 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe PID 3076 wrote to memory of 2944 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe PID 3076 wrote to memory of 2944 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe PID 3076 wrote to memory of 2944 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe PID 3076 wrote to memory of 2944 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe PID 3076 wrote to memory of 2944 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe PID 3076 wrote to memory of 2944 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe PID 3076 wrote to memory of 2944 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe PID 3076 wrote to memory of 1016 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe LookupSvi.exe PID 3076 wrote to memory of 1016 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe LookupSvi.exe PID 3076 wrote to memory of 1016 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe LookupSvi.exe PID 1016 wrote to memory of 3892 1016 LookupSvi.exe secdrv.exe PID 1016 wrote to memory of 3892 1016 LookupSvi.exe secdrv.exe PID 1016 wrote to memory of 3892 1016 LookupSvi.exe secdrv.exe PID 3076 wrote to memory of 968 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe takshost.exe PID 3076 wrote to memory of 968 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe takshost.exe PID 3076 wrote to memory of 968 3076 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe takshost.exe PID 3892 wrote to memory of 4848 3892 secdrv.exe secdrv.exe PID 3892 wrote to memory of 4848 3892 secdrv.exe secdrv.exe PID 3892 wrote to memory of 4848 3892 secdrv.exe secdrv.exe PID 3892 wrote to memory of 4848 3892 secdrv.exe secdrv.exe PID 3892 wrote to memory of 4848 3892 secdrv.exe secdrv.exe PID 3892 wrote to memory of 4848 3892 secdrv.exe secdrv.exe PID 3892 wrote to memory of 4848 3892 secdrv.exe secdrv.exe PID 3892 wrote to memory of 4848 3892 secdrv.exe secdrv.exe PID 3892 wrote to memory of 4136 3892 secdrv.exe LookupSvi.exe PID 3892 wrote to memory of 4136 3892 secdrv.exe LookupSvi.exe PID 3892 wrote to memory of 4136 3892 secdrv.exe LookupSvi.exe PID 4136 wrote to memory of 2512 4136 LookupSvi.exe secdrv.exe PID 4136 wrote to memory of 2512 4136 LookupSvi.exe secdrv.exe PID 4136 wrote to memory of 2512 4136 LookupSvi.exe secdrv.exe PID 968 wrote to memory of 2404 968 takshost.exe takshost.exe PID 968 wrote to memory of 2404 968 takshost.exe takshost.exe PID 968 wrote to memory of 2404 968 takshost.exe takshost.exe PID 968 wrote to memory of 2404 968 takshost.exe takshost.exe PID 968 wrote to memory of 2404 968 takshost.exe takshost.exe PID 968 wrote to memory of 2404 968 takshost.exe takshost.exe PID 968 wrote to memory of 2404 968 takshost.exe takshost.exe PID 968 wrote to memory of 2404 968 takshost.exe takshost.exe PID 2944 wrote to memory of 4392 2944 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 2944 wrote to memory of 4392 2944 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 2944 wrote to memory of 4392 2944 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 2944 wrote to memory of 4392 2944 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 2944 wrote to memory of 4392 2944 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 2944 wrote to memory of 4392 2944 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 2944 wrote to memory of 4392 2944 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 2944 wrote to memory of 4392 2944 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 2944 wrote to memory of 4392 2944 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 2944 wrote to memory of 4452 2944 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 2944 wrote to memory of 4452 2944 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 2944 wrote to memory of 4452 2944 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 2944 wrote to memory of 4452 2944 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 2944 wrote to memory of 4452 2944 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 2944 wrote to memory of 4452 2944 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 2944 wrote to memory of 4452 2944 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 2944 wrote to memory of 4452 2944 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 2944 wrote to memory of 4452 2944 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 2944 wrote to memory of 3588 2944 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 2944 wrote to memory of 3588 2944 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 2944 wrote to memory of 3588 2944 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 2944 wrote to memory of 3588 2944 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 2944 wrote to memory of 3588 2944 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 2944 wrote to memory of 3588 2944 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe PID 2944 wrote to memory of 3588 2944 99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe"C:\Users\Admin\AppData\Local\Temp\99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe"C:\Users\Admin\AppData\Local\Temp\99ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"3⤵
- Accesses Microsoft Outlook accounts
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderprodkey.txt"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderskypeview.txt"3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\LookupSvi.exe"C:\Users\Admin\AppData\Roaming\Microsoft\LookupSvi.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe"C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe"C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\LookupSvi.exe"C:\Users\Admin\AppData\Roaming\Microsoft\LookupSvi.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe"C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe"5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe"C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\LookupSvi.exe"C:\Users\Admin\AppData\Roaming\Microsoft\LookupSvi.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\LookupSvi.exe.logFilesize
128B
MD5a5dcc7c9c08af7dddd82be5b036a4416
SHA14f998ca1526d199e355ffb435bae111a2779b994
SHA256e24033ceec97fd03402b03acaaabd1d1e378e83bb1683afbccac760e00f8ead5
SHA51256035de734836c0c39f0b48641c51c26adb6e79c6c65e23ca96603f71c95b8673e2ef853146e87efc899dd1878d0bbc2c82d91fbf0fce81c552048e986f9bb5a
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\secdrv.exe.logFilesize
774B
MD5049b2c7e274ebb68f3ada1961c982a22
SHA1796b9f03c8cd94617ea26aaf861af9fb2a5731db
SHA2565c69c41dceda1bb32d4054d6b483bb3e3af84c8cf0a6191c79068168a1d506b3
SHA512fb2ee642e1401772d514e86b0b8dd117659335066242e85c158b40e8912572f2bd7b9a0f63f9b9f4d7a2e051579345215f6b1f147881f3d1e78f335c45d78ebf
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\takshost.exe.logFilesize
774B
MD5049b2c7e274ebb68f3ada1961c982a22
SHA1796b9f03c8cd94617ea26aaf861af9fb2a5731db
SHA2565c69c41dceda1bb32d4054d6b483bb3e3af84c8cf0a6191c79068168a1d506b3
SHA512fb2ee642e1401772d514e86b0b8dd117659335066242e85c158b40e8912572f2bd7b9a0f63f9b9f4d7a2e051579345215f6b1f147881f3d1e78f335c45d78ebf
-
C:\Users\Admin\AppData\Local\Temp\holderprodkey.txtFilesize
725B
MD5fa7040dbf78413efcbea5037bb596a6e
SHA187177e6a75b5b3540665c7d2c95d3230a342e0b5
SHA25622021e1d6b3541dac4778c072d567c4ad2435a8756e3234ae00b45249520305d
SHA51224db7b976cacf92dfd36a4932f9723821d50bf0386014187ff30df726650c38d4165abf4b1bf8accfd79ace88634634da2f8d4fa47e515a8d756724387f0dca7
-
C:\Users\Admin\AppData\Local\Temp\holderskypeview.txtFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Local\Temp\holderwb.txtFilesize
3KB
MD5f94dc819ca773f1e3cb27abbc9e7fa27
SHA19a7700efadc5ea09ab288544ef1e3cd876255086
SHA256a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92
SHA51272a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196
-
C:\Users\Admin\AppData\Roaming\Microsoft\LookupSvi.exeFilesize
7KB
MD5c283efa34a736e2e98e64da9b1f927ae
SHA153c991156979b3a7ecdcdb799fb33440cb73ed55
SHA2562a11fd8fdb1108cdac9c38d9b3fee701ece885e9de4766ab26779c4a994aabfa
SHA5129b7c433a2f0362d82af4d31000b108962ca2d6090f5d3aaaae4dd4be41c9cde3c27cf2869193755da8bd0880732f815b9875cbbb2d44f30b64d55659a38c90ec
-
C:\Users\Admin\AppData\Roaming\Microsoft\LookupSvi.exeFilesize
7KB
MD5c283efa34a736e2e98e64da9b1f927ae
SHA153c991156979b3a7ecdcdb799fb33440cb73ed55
SHA2562a11fd8fdb1108cdac9c38d9b3fee701ece885e9de4766ab26779c4a994aabfa
SHA5129b7c433a2f0362d82af4d31000b108962ca2d6090f5d3aaaae4dd4be41c9cde3c27cf2869193755da8bd0880732f815b9875cbbb2d44f30b64d55659a38c90ec
-
C:\Users\Admin\AppData\Roaming\Microsoft\LookupSvi.exeFilesize
7KB
MD5c283efa34a736e2e98e64da9b1f927ae
SHA153c991156979b3a7ecdcdb799fb33440cb73ed55
SHA2562a11fd8fdb1108cdac9c38d9b3fee701ece885e9de4766ab26779c4a994aabfa
SHA5129b7c433a2f0362d82af4d31000b108962ca2d6090f5d3aaaae4dd4be41c9cde3c27cf2869193755da8bd0880732f815b9875cbbb2d44f30b64d55659a38c90ec
-
C:\Users\Admin\AppData\Roaming\Microsoft\LookupSvi.exeFilesize
7KB
MD5c283efa34a736e2e98e64da9b1f927ae
SHA153c991156979b3a7ecdcdb799fb33440cb73ed55
SHA2562a11fd8fdb1108cdac9c38d9b3fee701ece885e9de4766ab26779c4a994aabfa
SHA5129b7c433a2f0362d82af4d31000b108962ca2d6090f5d3aaaae4dd4be41c9cde3c27cf2869193755da8bd0880732f815b9875cbbb2d44f30b64d55659a38c90ec
-
C:\Users\Admin\AppData\Roaming\Microsoft\LookupSvi.exeFilesize
7KB
MD5c283efa34a736e2e98e64da9b1f927ae
SHA153c991156979b3a7ecdcdb799fb33440cb73ed55
SHA2562a11fd8fdb1108cdac9c38d9b3fee701ece885e9de4766ab26779c4a994aabfa
SHA5129b7c433a2f0362d82af4d31000b108962ca2d6090f5d3aaaae4dd4be41c9cde3c27cf2869193755da8bd0880732f815b9875cbbb2d44f30b64d55659a38c90ec
-
C:\Users\Admin\AppData\Roaming\Microsoft\LookupSvi.exeFilesize
7KB
MD5c283efa34a736e2e98e64da9b1f927ae
SHA153c991156979b3a7ecdcdb799fb33440cb73ed55
SHA2562a11fd8fdb1108cdac9c38d9b3fee701ece885e9de4766ab26779c4a994aabfa
SHA5129b7c433a2f0362d82af4d31000b108962ca2d6090f5d3aaaae4dd4be41c9cde3c27cf2869193755da8bd0880732f815b9875cbbb2d44f30b64d55659a38c90ec
-
C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exeFilesize
998KB
MD5177a34ddb5abf1506e41085974c5dfa8
SHA1bc80d8a2c9acde2440acac32e9bfeacedb9cdea0
SHA25699ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85
SHA512479a826c36c49d942f000de6625691fcdf7d081fc8062d5075459a7a1bca4a47b9a4b66d302af24a76e4c363a388eb7d0ab94a502a7794070faab7a2dbecbd6a
-
C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exeFilesize
998KB
MD5177a34ddb5abf1506e41085974c5dfa8
SHA1bc80d8a2c9acde2440acac32e9bfeacedb9cdea0
SHA25699ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85
SHA512479a826c36c49d942f000de6625691fcdf7d081fc8062d5075459a7a1bca4a47b9a4b66d302af24a76e4c363a388eb7d0ab94a502a7794070faab7a2dbecbd6a
-
C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exeFilesize
998KB
MD5177a34ddb5abf1506e41085974c5dfa8
SHA1bc80d8a2c9acde2440acac32e9bfeacedb9cdea0
SHA25699ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85
SHA512479a826c36c49d942f000de6625691fcdf7d081fc8062d5075459a7a1bca4a47b9a4b66d302af24a76e4c363a388eb7d0ab94a502a7794070faab7a2dbecbd6a
-
C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exeFilesize
998KB
MD5177a34ddb5abf1506e41085974c5dfa8
SHA1bc80d8a2c9acde2440acac32e9bfeacedb9cdea0
SHA25699ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85
SHA512479a826c36c49d942f000de6625691fcdf7d081fc8062d5075459a7a1bca4a47b9a4b66d302af24a76e4c363a388eb7d0ab94a502a7794070faab7a2dbecbd6a
-
C:\Users\Admin\AppData\Roaming\Microsoft\secdrv.exeFilesize
998KB
MD5177a34ddb5abf1506e41085974c5dfa8
SHA1bc80d8a2c9acde2440acac32e9bfeacedb9cdea0
SHA25699ef2102d80673d61ef75c75e90e9749572e46abd3aecebc90fc430a42afbf85
SHA512479a826c36c49d942f000de6625691fcdf7d081fc8062d5075459a7a1bca4a47b9a4b66d302af24a76e4c363a388eb7d0ab94a502a7794070faab7a2dbecbd6a
-
memory/968-187-0x00000000750D0000-0x0000000075681000-memory.dmpFilesize
5.7MB
-
memory/968-150-0x00000000750D0000-0x0000000075681000-memory.dmpFilesize
5.7MB
-
memory/968-148-0x0000000000000000-mapping.dmp
-
memory/968-162-0x00000000750D0000-0x0000000075681000-memory.dmpFilesize
5.7MB
-
memory/1016-140-0x00000000750D0000-0x0000000075681000-memory.dmpFilesize
5.7MB
-
memory/1016-151-0x00000000750D0000-0x0000000075681000-memory.dmpFilesize
5.7MB
-
memory/1016-137-0x0000000000000000-mapping.dmp
-
memory/1016-142-0x00000000750D0000-0x0000000075681000-memory.dmpFilesize
5.7MB
-
memory/1672-204-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1672-206-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1672-208-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1672-203-0x0000000000000000-mapping.dmp
-
memory/2404-170-0x00000000750D0000-0x0000000075681000-memory.dmpFilesize
5.7MB
-
memory/2404-168-0x0000000000000000-mapping.dmp
-
memory/2512-171-0x00000000750D0000-0x0000000075681000-memory.dmpFilesize
5.7MB
-
memory/2512-177-0x00000000750D0000-0x0000000075681000-memory.dmpFilesize
5.7MB
-
memory/2512-166-0x0000000000000000-mapping.dmp
-
memory/2548-197-0x00000000750D0000-0x0000000075681000-memory.dmpFilesize
5.7MB
-
memory/2548-201-0x00000000750D0000-0x0000000075681000-memory.dmpFilesize
5.7MB
-
memory/2548-194-0x0000000000000000-mapping.dmp
-
memory/2944-136-0x00000000750D0000-0x0000000075681000-memory.dmpFilesize
5.7MB
-
memory/2944-135-0x0000000000400000-0x00000000004F0000-memory.dmpFilesize
960KB
-
memory/2944-134-0x0000000000000000-mapping.dmp
-
memory/2944-141-0x00000000750D0000-0x0000000075681000-memory.dmpFilesize
5.7MB
-
memory/3076-149-0x00000000750D0000-0x0000000075681000-memory.dmpFilesize
5.7MB
-
memory/3076-133-0x00000000750D0000-0x0000000075681000-memory.dmpFilesize
5.7MB
-
memory/3076-132-0x00000000750D0000-0x0000000075681000-memory.dmpFilesize
5.7MB
-
memory/3588-193-0x0000000000400000-0x0000000000415000-memory.dmpFilesize
84KB
-
memory/3588-191-0x0000000000400000-0x0000000000415000-memory.dmpFilesize
84KB
-
memory/3588-189-0x0000000000400000-0x0000000000415000-memory.dmpFilesize
84KB
-
memory/3588-188-0x0000000000000000-mapping.dmp
-
memory/3892-165-0x00000000750D0000-0x0000000075681000-memory.dmpFilesize
5.7MB
-
memory/3892-144-0x0000000000000000-mapping.dmp
-
memory/3892-147-0x00000000750D0000-0x0000000075681000-memory.dmpFilesize
5.7MB
-
memory/3892-146-0x00000000750D0000-0x0000000075681000-memory.dmpFilesize
5.7MB
-
memory/4052-202-0x00000000750D0000-0x0000000075681000-memory.dmpFilesize
5.7MB
-
memory/4052-198-0x0000000000000000-mapping.dmp
-
memory/4052-209-0x00000000750D0000-0x0000000075681000-memory.dmpFilesize
5.7MB
-
memory/4136-155-0x0000000000000000-mapping.dmp
-
memory/4136-185-0x00000000750D0000-0x0000000075681000-memory.dmpFilesize
5.7MB
-
memory/4136-160-0x00000000750D0000-0x0000000075681000-memory.dmpFilesize
5.7MB
-
memory/4136-163-0x00000000750D0000-0x0000000075681000-memory.dmpFilesize
5.7MB
-
memory/4392-172-0x0000000000000000-mapping.dmp
-
memory/4392-173-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4392-175-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4392-176-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4452-181-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/4452-179-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/4452-182-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/4452-184-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/4452-178-0x0000000000000000-mapping.dmp
-
memory/4848-161-0x00000000750D0000-0x0000000075681000-memory.dmpFilesize
5.7MB
-
memory/4848-159-0x00000000750D0000-0x0000000075681000-memory.dmpFilesize
5.7MB
-
memory/4848-152-0x0000000000000000-mapping.dmp