Analysis
-
max time kernel
147s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29/11/2022, 16:44
Behavioral task
behavioral1
Sample
b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe
Resource
win10v2004-20220901-en
General
-
Target
b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe
-
Size
218KB
-
MD5
00c40ed16d7549561698a57d38de2d27
-
SHA1
53575cb2856fbf438db355a2aee8af7a01e9d38c
-
SHA256
b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c
-
SHA512
aa16fb450c8157366d1cf98c3af19a7970161feaf0920a9fcbb27fe71b96a3e3898b0557ea202b0ff45fd370ce3141c2e39400a45d3add27843b37575b797dee
-
SSDEEP
6144:pvsS3rsWqy7xglOsVAkgHiS1Sg9rYsk+RXSaPeBim:CS3XH7C9AkgBLNtSaP
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 18 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\AuthorizedApplications Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static\System Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\GloballyOpenPorts Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications Process not Found -
Modifies security service 2 TTPs 22 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\DeleteFlag = "1" Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\IPTLSOut Process not Found Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Type = "32" Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\RPC-EPMap Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Security Process not Found Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\DeleteFlag = "1" Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Parameters Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Security b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\TriggerInfo b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Start = "4" Process not Found Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\ErrorControl = "0" Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\IPTLSIn Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Security Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Parameters b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\TriggerInfo\0 b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\Teredo Process not Found Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Type = "32" Process not Found Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" Process not Found Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\ErrorControl = "0" Process not Found -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\etadpug\ImagePath = "\"C:\\Program Files (x86)\\Google\\Desktop\\Install\\{f545a6cb-6387-4d75-375b-4ac5befd06b3}\\ \\...\\\u202eﯹ๛\\{f545a6cb-6387-4d75-375b-4ac5befd06b3}\\GoogleUpdate.exe\" <" b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe -
resource yara_rule behavioral1/memory/1476-54-0x0000000000400000-0x00000000004B2000-memory.dmp upx behavioral1/memory/1476-68-0x0000000000400000-0x00000000004B2000-memory.dmp upx -
Deletes itself 1 IoCs
pid Process 1988 cmd.exe -
Unexpected DNS network traffic destination 11 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 85.114.128.127 Destination IP 85.114.128.127 Destination IP 85.114.128.127 Destination IP 85.114.128.127 Destination IP 85.114.128.127 Destination IP 85.114.128.127 Destination IP 85.114.128.127 Destination IP 85.114.128.127 Destination IP 85.114.128.127 Destination IP 85.114.128.127 Destination IP 85.114.128.127 -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Update = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Desktop\\Install\\{f545a6cb-6387-4d75-375b-4ac5befd06b3}\\❤≸⋙\\Ⱒ☠⍨\\\u202eﯹ๛\\{f545a6cb-6387-4d75-375b-4ac5befd06b3}\\GoogleUpdate.exe\" >" b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created \systemroot\assembly\GAC_32\Desktop.ini Process not Found File created \systemroot\assembly\GAC_64\Desktop.ini Process not Found -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1476 set thread context of 108 1476 b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe 27 PID 108 set thread context of 1988 108 b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe 28 -
Drops file in Program Files directory 22 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Google\Desktop\Install\{f545a6cb-6387-4d75-375b-4ac5befd06b3}\ \...\ﯹ๛\{f545a6cb-6387-4d75-375b-4ac5befd06b3}\@ Process not Found File opened for modification C:\Program Files\Windows Defender\ja-JP:! b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe File opened for modification C:\Program Files\Windows Defender\MpClient.dll:! b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe:! b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe File opened for modification C:\Program Files\Windows Defender\MpCommu.dll:! b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe File opened for modification C:\Program Files\Windows Defender\MsMpLics.dll:! b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe File opened for modification C:\Program Files\Windows Defender\es-ES:! b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe File opened for modification C:\Program Files\Windows Defender\MpOAV.dll:! b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe File opened for modification C:\Program Files\Windows Defender\MpSvc.dll:! b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe:! b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe File opened for modification C:\Program Files\Windows Defender\MsMpRes.dll:! b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe File opened for modification C:\Program Files\Windows Defender\de-DE:! b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe File opened for modification C:\Program Files\Windows Defender\MsMpCom.dll:! b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe File opened for modification C:\Program Files\Windows Defender\MpRTP.dll:! b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe File created C:\Program Files (x86)\Google\Desktop\Install\{f545a6cb-6387-4d75-375b-4ac5befd06b3}\ \...\ﯹ๛\{f545a6cb-6387-4d75-375b-4ac5befd06b3}\GoogleUpdate.exe b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe File created C:\Program Files (x86)\Google\Desktop\Install\{f545a6cb-6387-4d75-375b-4ac5befd06b3}\ \...\ﯹ๛\{f545a6cb-6387-4d75-375b-4ac5befd06b3}\@ b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe File opened for modification C:\Program Files\Windows Defender\en-US:! b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe File opened for modification C:\Program Files\Windows Defender\fr-FR:! b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe File opened for modification C:\Program Files\Windows Defender\it-IT:! b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe File opened for modification C:\Program Files\Windows Defender\MpAsDesc.dll:! b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe File opened for modification C:\Program Files\Windows Defender\MpEvMsg.dll:! b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe File opened for modification C:\Program Files (x86)\Google\Desktop\Install\{f545a6cb-6387-4d75-375b-4ac5befd06b3}\ \...\ﯹ๛\{f545a6cb-6387-4d75-375b-4ac5befd06b3}\@\:@ Process not Found -
NTFS ADS 19 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Defender\MpAsDesc.dll:! b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe File opened for modification C:\Program Files\Windows Defender\MpClient.dll:! b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe File opened for modification C:\Program Files\Windows Defender\MpCommu.dll:! b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe File opened for modification C:\Program Files\Windows Defender\MpOAV.dll:! b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe File opened for modification C:\Program Files\Windows Defender\de-DE:! b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe File opened for modification C:\Program Files\Windows Defender\es-ES:! b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe File opened for modification C:\Program Files\Windows Defender\fr-FR:! b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe File opened for modification C:\Program Files\Windows Defender\ja-JP:! b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe File opened for modification C:\Program Files\Windows Defender\MpRTP.dll:! b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe File opened for modification C:\Program Files\Windows Defender\MsMpLics.dll:! b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe File opened for modification C:\Program Files\Windows Defender\MpEvMsg.dll:! b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe File opened for modification C:\Program Files\Windows Defender\MpSvc.dll:! b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe File opened for modification C:\Program Files\Windows Defender\MsMpCom.dll:! b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe File opened for modification C:\Program Files\Windows Defender\MsMpRes.dll:! b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe File opened for modification C:\Program Files (x86)\Google\Desktop\Install\{f545a6cb-6387-4d75-375b-4ac5befd06b3}\ \...\ﯹ๛\{f545a6cb-6387-4d75-375b-4ac5befd06b3}\@\:@ Process not Found File opened for modification C:\Program Files\Windows Defender\en-US:! b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe File opened for modification C:\Program Files\Windows Defender\it-IT:! b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe:! b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe:! b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 108 b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe 108 b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe 108 b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe 108 b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe 460 Process not Found -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 108 b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe 108 b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeRestorePrivilege 108 b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe Token: SeDebugPrivilege 108 b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe Token: SeDebugPrivilege 108 b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe Token: SeRestorePrivilege 108 b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe Token: SeBackupPrivilege 460 Process not Found Token: SeRestorePrivilege 460 Process not Found Token: SeSecurityPrivilege 460 Process not Found Token: SeTakeOwnershipPrivilege 460 Process not Found Token: SeBackupPrivilege 460 Process not Found Token: SeRestorePrivilege 460 Process not Found Token: SeSecurityPrivilege 460 Process not Found Token: SeTakeOwnershipPrivilege 460 Process not Found Token: SeBackupPrivilege 460 Process not Found Token: SeRestorePrivilege 460 Process not Found Token: SeSecurityPrivilege 460 Process not Found Token: SeTakeOwnershipPrivilege 460 Process not Found Token: SeBackupPrivilege 460 Process not Found Token: SeRestorePrivilege 460 Process not Found Token: SeSecurityPrivilege 460 Process not Found Token: SeTakeOwnershipPrivilege 460 Process not Found Token: SeBackupPrivilege 460 Process not Found Token: SeRestorePrivilege 460 Process not Found Token: SeSecurityPrivilege 460 Process not Found Token: SeTakeOwnershipPrivilege 460 Process not Found Token: SeBackupPrivilege 460 Process not Found Token: SeRestorePrivilege 460 Process not Found Token: SeSecurityPrivilege 460 Process not Found Token: SeTakeOwnershipPrivilege 460 Process not Found Token: SeBackupPrivilege 460 Process not Found Token: SeRestorePrivilege 460 Process not Found Token: SeSecurityPrivilege 460 Process not Found Token: SeTakeOwnershipPrivilege 460 Process not Found Token: SeBackupPrivilege 460 Process not Found Token: SeRestorePrivilege 460 Process not Found Token: SeSecurityPrivilege 460 Process not Found Token: SeTakeOwnershipPrivilege 460 Process not Found Token: SeDebugPrivilege 460 Process not Found -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1248 Process not Found 1248 Process not Found -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1248 Process not Found 1248 Process not Found -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1476 wrote to memory of 108 1476 b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe 27 PID 1476 wrote to memory of 108 1476 b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe 27 PID 1476 wrote to memory of 108 1476 b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe 27 PID 1476 wrote to memory of 108 1476 b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe 27 PID 1476 wrote to memory of 108 1476 b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe 27 PID 1476 wrote to memory of 108 1476 b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe 27 PID 1476 wrote to memory of 108 1476 b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe 27 PID 1476 wrote to memory of 108 1476 b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe 27 PID 1476 wrote to memory of 108 1476 b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe 27 PID 1476 wrote to memory of 108 1476 b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe 27 PID 1476 wrote to memory of 108 1476 b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe 27 PID 108 wrote to memory of 1988 108 b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe 28 PID 108 wrote to memory of 1988 108 b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe 28 PID 108 wrote to memory of 1988 108 b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe 28 PID 108 wrote to memory of 1988 108 b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe 28 PID 108 wrote to memory of 1988 108 b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe"C:\Users\Admin\AppData\Local\Temp\b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe"C:\Users\Admin\AppData\Local\Temp\b99a7d37978877e1736243030dfe0c4a3da1ad1ca7edf296bc513c57e683575c.exe"2⤵
- Modifies security service
- Sets service image path in registry
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:108 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Deletes itself
PID:1988
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Google\Desktop\Install\{f545a6cb-6387-4d75-375b-4ac5befd06b3}\ \...\ﯹ๛\{f545a6cb-6387-4d75-375b-4ac5befd06b3}\@
Filesize2KB
MD58d976ffa2a2928f759bca98acd375bdd
SHA10be05b797a7ec5345f65d9c7f790f4bbffb583cf
SHA256ffb00e26de6ada38dd0746c5ea0dee2f656fb4e1f3b55453ec62aa0022934ea1
SHA5123597e78cb3b4bd729d362e90af97b2236fb26e6ac3587ef82751409341aca7072130e1b9f15668c569dd12160ea899976a85b22b9aaece223671ea9a6de08829