a85295f452462a75a350c1d2b821b784d940c3a10ede030d4f9e36d773e5e5cf

Analysis

max time kernel
186s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 03:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a85295f452462a75a350c1d2b821b784d940c3a10ede030d4f9e36d773e5e5cf.exe
Size 279KB
Sample221129-eaam9sfe6y
SHA256 a85295f452462a75a350c1d2b821b784d940c3a10ede030d4f9e36d773e5e5cf
MD5 27b5602ba7fd9fca5224b01908a2ff95
SHA1 c8b9ea476005c1f23dc2bccab16fb36b00416ab9
SHA512 49e2fdf2abc6fc909b0852f1af24cfdcf59e02fc7754b6e55c926d291d611869879e68ab519cdf20be6f63d2892db900489826d43e237660c61b3cb32f2ed4dd
SSDEEP 6144:jQlkWPsKAjeqRmqstN2spxjq+FrRZYT9hhp8l6CqEPbzWIYBw7Vb:8l2KAjeZqst1pFrREHhWj1VYBKN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fichier.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Security.exe

Blocklisted process makes network request 6 IoCs

flow	pid	Process
30	1860	wscript.exe
37	1860	wscript.exe
56	1860	wscript.exe
66	1860	wscript.exe
84	1860	wscript.exe
87	1860	wscript.exe

Executes dropped EXE 2 IoCs

pid	Process
1812	fichier.exe
960	Security.exe

Modifies Windows Firewall 1 TTPs 2 IoCs

evasion

Modify Existing Service

T1031

pid	Process
3168	netsh.exe
4332	netsh.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	a85295f452462a75a350c1d2b821b784d940c3a10ede030d4f9e36d773e5e5cf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	fichier.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	Security.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\11b07949034f18fb99951822f750155d.exe	Security.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\11b07949034f18fb99951822f750155d.exe	Security.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\11b07949034f18fb99951822f750155d.exe	wscript.exe

Loads dropped DLL 2 IoCs

pid	Process
1860	wscript.exe
1860	wscript.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\11b07949034f18fb99951822f750155d = "\"C:\\Users\\Admin\\AppData\\Roaming\\Security.exe\" .."	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\11b07949034f18fb99951822f750155d = "\"C:\\Users\\Admin\\AppData\\Roaming\\Security.exe\" .."	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\11b07949034f18fb99951822f750155d = "\"C:\\Users\\Admin\\AppData\\Roaming\\Security.exe\" .."	Security.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\11b07949034f18fb99951822f750155d = "\"C:\\Users\\Admin\\AppData\\Roaming\\Security.exe\" .."	Security.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fichier.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fichier.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Security.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Security.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 61 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF2FBBBA-8746-380E-8999-7BD02D3338FF}	Security.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C4CE534-5F63-3457-B8C1-0712B7B8EE29}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	Security.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C4CE534-5F63-3457-B8C1-0712B7B8EE29}\InprocServer32\CodeBase = "file:///C:/Users/Admin/AppData/Roaming/Security.exe"	Security.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF2FBBBA-8746-380E-8999-7BD02D3338FF}\InprocServer32\0.0.0.0\Class = "vebknlfchun.A"	Security.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\vebknlfchun.vebknlfchun\ = "vebknlfchun.vebknlfchun"	Security.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C4CE534-5F63-3457-B8C1-0712B7B8EE29}\ = "vebknlfchun.vebknlfchun"	Security.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C4CE534-5F63-3457-B8C1-0712B7B8EE29}\InprocServer32\0.0.0.0\Assembly = "vebknlfchun, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null"	Security.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C4CE534-5F63-3457-B8C1-0712B7B8EE29}\InprocServer32\0.0.0.0\RuntimeVersion = "v2.0.50727"	Security.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C4CE534-5F63-3457-B8C1-0712B7B8EE29}\InprocServer32\0.0.0.0\CodeBase = "file:///C:/Users/Admin/AppData/Roaming/Security.exe"	Security.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF2FBBBA-8746-380E-8999-7BD02D3338FF}\InprocServer32\Assembly = "vebknlfchun, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null"	Security.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF2FBBBA-8746-380E-8999-7BD02D3338FF}\InprocServer32	Security.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C4CE534-5F63-3457-B8C1-0712B7B8EE29}\InprocServer32	Security.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{62C8FE65-4EBB-45E7-B440-6E39B2CDBF29}\0 = ".NET Category"	Security.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C4CE534-5F63-3457-B8C1-0712B7B8EE29}\InprocServer32\RuntimeVersion = "v2.0.50727"	Security.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\vebknlfchun.A\CLSID	Security.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF2FBBBA-8746-380E-8999-7BD02D3338FF}\InprocServer32\0.0.0.0\RuntimeVersion = "v2.0.50727"	Security.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF2FBBBA-8746-380E-8999-7BD02D3338FF}\InprocServer32	Security.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\vebknlfchun.vebknlfchun\CLSID\ = "{7C4CE534-5F63-3457-B8C1-0712B7B8EE29}"	Security.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF2FBBBA-8746-380E-8999-7BD02D3338FF}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	Security.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\vebknlfchun.A	Security.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C4CE534-5F63-3457-B8C1-0712B7B8EE29}\Implemented Categories	Security.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF2FBBBA-8746-380E-8999-7BD02D3338FF}\Implemented Categories	Security.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF2FBBBA-8746-380E-8999-7BD02D3338FF}\InprocServer32\0.0.0.0	Security.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF2FBBBA-8746-380E-8999-7BD02D3338FF}\Implemented Categories	Security.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF2FBBBA-8746-380E-8999-7BD02D3338FF}\InprocServer32\0.0.0.0	Security.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C4CE534-5F63-3457-B8C1-0712B7B8EE29}\InprocServer32	Security.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C4CE534-5F63-3457-B8C1-0712B7B8EE29}\ProgId	Security.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C4CE534-5F63-3457-B8C1-0712B7B8EE29}	Security.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\vebknlfchun.vebknlfchun\CLSID	Security.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF2FBBBA-8746-380E-8999-7BD02D3338FF}\InprocServer32\RuntimeVersion = "v2.0.50727"	Security.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF2FBBBA-8746-380E-8999-7BD02D3338FF}\InprocServer32\ThreadingModel = "Both"	Security.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF2FBBBA-8746-380E-8999-7BD02D3338FF}\InprocServer32\0.0.0.0\CodeBase = "file:///C:/Users/Admin/AppData/Roaming/Security.exe"	Security.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF2FBBBA-8746-380E-8999-7BD02D3338FF}\ProgId\ = "vebknlfchun.A"	Security.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C4CE534-5F63-3457-B8C1-0712B7B8EE29}\InprocServer32\ = "mscoree.dll"	Security.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\vebknlfchun.vebknlfchun	Security.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\vebknlfchun.A\CLSID\ = "{CF2FBBBA-8746-380E-8999-7BD02D3338FF}"	Security.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\vebknlfchun.A\CLSID	Security.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF2FBBBA-8746-380E-8999-7BD02D3338FF}\ = "vebknlfchun.A"	Security.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C4CE534-5F63-3457-B8C1-0712B7B8EE29}\InprocServer32\Class = "vebknlfchun.vebknlfchun"	Security.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\vebknlfchun.A\ = "vebknlfchun.A"	Security.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C4CE534-5F63-3457-B8C1-0712B7B8EE29}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	Security.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF2FBBBA-8746-380E-8999-7BD02D3338FF}\ProgId	Security.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C4CE534-5F63-3457-B8C1-0712B7B8EE29}\InprocServer32\0.0.0.0\Class = "vebknlfchun.vebknlfchun"	Security.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF2FBBBA-8746-380E-8999-7BD02D3338FF}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	Security.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\vebknlfchun.vebknlfchun	Security.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C4CE534-5F63-3457-B8C1-0712B7B8EE29}\ProgId	Security.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF2FBBBA-8746-380E-8999-7BD02D3338FF}\InprocServer32\ = "mscoree.dll"	Security.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF2FBBBA-8746-380E-8999-7BD02D3338FF}\InprocServer32\CodeBase = "file:///C:/Users/Admin/AppData/Roaming/Security.exe"	Security.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C4CE534-5F63-3457-B8C1-0712B7B8EE29}\ProgId\ = "vebknlfchun.vebknlfchun"	Security.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF2FBBBA-8746-380E-8999-7BD02D3338FF}\InprocServer32\Class = "vebknlfchun.A"	Security.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C4CE534-5F63-3457-B8C1-0712B7B8EE29}\InprocServer32\ThreadingModel = "Both"	Security.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C4CE534-5F63-3457-B8C1-0712B7B8EE29}\InprocServer32\Assembly = "vebknlfchun, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null"	Security.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C4CE534-5F63-3457-B8C1-0712B7B8EE29}\InprocServer32\0.0.0.0	Security.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C4CE534-5F63-3457-B8C1-0712B7B8EE29}\Implemented Categories	Security.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF2FBBBA-8746-380E-8999-7BD02D3338FF}\InprocServer32\0.0.0.0\Assembly = "vebknlfchun, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null"	Security.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\vebknlfchun.A	Security.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C4CE534-5F63-3457-B8C1-0712B7B8EE29}\InprocServer32\0.0.0.0	Security.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF2FBBBA-8746-380E-8999-7BD02D3338FF}	Security.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C4CE534-5F63-3457-B8C1-0712B7B8EE29}	Security.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\vebknlfchun.vebknlfchun\CLSID	Security.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF2FBBBA-8746-380E-8999-7BD02D3338FF}\ProgId	Security.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1860	wscript.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1860	wscript.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 1812	4300	a85295f452462a75a350c1d2b821b784d940c3a10ede030d4f9e36d773e5e5cf.exe	82
PID 4300 wrote to memory of 1812	4300	a85295f452462a75a350c1d2b821b784d940c3a10ede030d4f9e36d773e5e5cf.exe	82
PID 4300 wrote to memory of 1812	4300	a85295f452462a75a350c1d2b821b784d940c3a10ede030d4f9e36d773e5e5cf.exe	82
PID 1812 wrote to memory of 960	1812	fichier.exe	83
PID 1812 wrote to memory of 960	1812	fichier.exe	83
PID 1812 wrote to memory of 960	1812	fichier.exe	83
PID 960 wrote to memory of 3168	960	Security.exe	84
PID 960 wrote to memory of 3168	960	Security.exe	84
PID 960 wrote to memory of 3168	960	Security.exe	84
PID 960 wrote to memory of 4332	960	Security.exe	85
PID 960 wrote to memory of 4332	960	Security.exe	85
PID 960 wrote to memory of 4332	960	Security.exe	85
PID 960 wrote to memory of 1860	960	Security.exe	88
PID 960 wrote to memory of 1860	960	Security.exe	88
PID 960 wrote to memory of 1860	960	Security.exe	88

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fichier.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Security.exe

C:\Users\Admin\AppData\Local\Temp\a85295f452462a75a350c1d2b821b784d940c3a10ede030d4f9e36d773e5e5cf.exe
"C:\Users\Admin\AppData\Local\Temp\a85295f452462a75a350c1d2b821b784d940c3a10ede030d4f9e36d773e5e5cf.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Users\Admin\AppData\Local\Temp\fichier.exe
  "C:\Users\Admin\AppData\Local\Temp\fichier.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks computer location settings
  - Checks whether UAC is enabled
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1812
- - C:\Users\Admin\AppData\Roaming\Security.exe
    "C:\Users\Admin\AppData\Roaming\Security.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks computer location settings
    - Drops startup file
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:960
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Security.exe" "Security.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      PID:3168
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Windows\SysWOW64\wscript.exe" "wscript.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      PID:4332
  - - C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\SysWOW64\wscript.exe" "C:\Users\Admin\AppData\Roaming\Security.vbe"
      4⤵
      Blocklisted process makes network request
      Drops startup file
      Loads dropped DLL
      Adds Run key to start application
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fichier.exe

Path C:\Users\Admin\AppData\Local\Temp\fichier.exe
Size 256KB
SHA256 956e6b0c6fbc449f93c823b1424e480ffae5b3c7287c8ff86d39ca3989f592fd
MD5 bc29f17b34ff3a5a84a972d7bfdd8335
SHA1 d07d23b6674802da90b146cbd9b5328e0eb843e0
SHA512 4ad0be3f10526eb02cbda64998aa7f0e9e80c6ce941277b59e618e211b65b8e99e9ec4b7b1494da0d0e9548eb1820fda3294ac273d45720e77ce6bdd845b995f
SSDEEP 6144:qHna1tT5K3JvqeCnxPGKFc/KThnsJblcg:ynaLQJvjGsJblcg
MD5 SHA1 SHA512 SSDEEP

Submit Download

fichier.exe

Path C:\Users\Admin\AppData\Local\Temp\fichier.exe
Size 256KB
SHA256 956e6b0c6fbc449f93c823b1424e480ffae5b3c7287c8ff86d39ca3989f592fd
MD5 bc29f17b34ff3a5a84a972d7bfdd8335
SHA1 d07d23b6674802da90b146cbd9b5328e0eb843e0
SHA512 4ad0be3f10526eb02cbda64998aa7f0e9e80c6ce941277b59e618e211b65b8e99e9ec4b7b1494da0d0e9548eb1820fda3294ac273d45720e77ce6bdd845b995f
SSDEEP 6144:qHna1tT5K3JvqeCnxPGKFc/KThnsJblcg:ynaLQJvjGsJblcg
MD5 SHA1 SHA512 SSDEEP

Submit Download

11b07949034f18fb99951822f750155d.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\11b07949034f18fb99951822f750155d.exe
Size 256KB
SHA256 956e6b0c6fbc449f93c823b1424e480ffae5b3c7287c8ff86d39ca3989f592fd
MD5 bc29f17b34ff3a5a84a972d7bfdd8335
SHA1 d07d23b6674802da90b146cbd9b5328e0eb843e0
SHA512 4ad0be3f10526eb02cbda64998aa7f0e9e80c6ce941277b59e618e211b65b8e99e9ec4b7b1494da0d0e9548eb1820fda3294ac273d45720e77ce6bdd845b995f
SSDEEP 6144:qHna1tT5K3JvqeCnxPGKFc/KThnsJblcg:ynaLQJvjGsJblcg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Security.exe

Path C:\Users\Admin\AppData\Roaming\Security.exe
Size 256KB
SHA256 956e6b0c6fbc449f93c823b1424e480ffae5b3c7287c8ff86d39ca3989f592fd
MD5 bc29f17b34ff3a5a84a972d7bfdd8335
SHA1 d07d23b6674802da90b146cbd9b5328e0eb843e0
SHA512 4ad0be3f10526eb02cbda64998aa7f0e9e80c6ce941277b59e618e211b65b8e99e9ec4b7b1494da0d0e9548eb1820fda3294ac273d45720e77ce6bdd845b995f
SSDEEP 6144:qHna1tT5K3JvqeCnxPGKFc/KThnsJblcg:ynaLQJvjGsJblcg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Security.exe

Path C:\Users\Admin\AppData\Roaming\Security.exe
Size 256KB
SHA256 956e6b0c6fbc449f93c823b1424e480ffae5b3c7287c8ff86d39ca3989f592fd
MD5 bc29f17b34ff3a5a84a972d7bfdd8335
SHA1 d07d23b6674802da90b146cbd9b5328e0eb843e0
SHA512 4ad0be3f10526eb02cbda64998aa7f0e9e80c6ce941277b59e618e211b65b8e99e9ec4b7b1494da0d0e9548eb1820fda3294ac273d45720e77ce6bdd845b995f
SSDEEP 6144:qHna1tT5K3JvqeCnxPGKFc/KThnsJblcg:ynaLQJvjGsJblcg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Security.exe

Path C:\Users\Admin\AppData\Roaming\Security.exe
Size 256KB
SHA256 956e6b0c6fbc449f93c823b1424e480ffae5b3c7287c8ff86d39ca3989f592fd
MD5 bc29f17b34ff3a5a84a972d7bfdd8335
SHA1 d07d23b6674802da90b146cbd9b5328e0eb843e0
SHA512 4ad0be3f10526eb02cbda64998aa7f0e9e80c6ce941277b59e618e211b65b8e99e9ec4b7b1494da0d0e9548eb1820fda3294ac273d45720e77ce6bdd845b995f
SSDEEP 6144:qHna1tT5K3JvqeCnxPGKFc/KThnsJblcg:ynaLQJvjGsJblcg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Security.exe

Path C:\Users\Admin\AppData\Roaming\Security.exe
Size 256KB
SHA256 956e6b0c6fbc449f93c823b1424e480ffae5b3c7287c8ff86d39ca3989f592fd
MD5 bc29f17b34ff3a5a84a972d7bfdd8335
SHA1 d07d23b6674802da90b146cbd9b5328e0eb843e0
SHA512 4ad0be3f10526eb02cbda64998aa7f0e9e80c6ce941277b59e618e211b65b8e99e9ec4b7b1494da0d0e9548eb1820fda3294ac273d45720e77ce6bdd845b995f
SSDEEP 6144:qHna1tT5K3JvqeCnxPGKFc/KThnsJblcg:ynaLQJvjGsJblcg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Security.vbe

Path C:\Users\Admin\AppData\Roaming\Security.vbe
Size 54B
SHA256 dba7ef45a2eee2e644812afffaeb1693619ce14efe0e9dff28375c5947f9b502
MD5 edd2a4d47a30adacb3dc0bd91e0d3317
SHA1 552cee9c5fa037636e72a86f4a4acf6b5a2d3549
SHA512 be3c7f36afed2674d0d19a1162b70c5d1c79bd3a2594a7951fc86484102fbad92b63c72810d85dca4ffb9109c017201791c98819bfd011dbb7d963565b1d357e
MD5 SHA1 SHA512

Submit Download

memory/960-144-0x0000000074E40000-0x00000000753F1000-memory.dmp

Download

memory/960-152-0x0000000074E40000-0x00000000753F1000-memory.dmp

Download

memory/1812-143-0x0000000074E40000-0x00000000753F1000-memory.dmp

Download

memory/1812-139-0x0000000074E40000-0x00000000753F1000-memory.dmp

Download

memory/1812-138-0x0000000074E40000-0x00000000753F1000-memory.dmp

Download

memory/1860-151-0x0000000074E40000-0x00000000753F1000-memory.dmp

Download

memory/1860-154-0x0000000074E40000-0x00000000753F1000-memory.dmp

Download

memory/4300-132-0x00000000001B0000-0x00000000001BC000-memory.dmp

Download

memory/4300-136-0x00007FF883FC0000-0x00007FF884A81000-memory.dmp

Download

memory/4300-133-0x00007FF883FC0000-0x00007FF884A81000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads