Analysis
- max time kernel
155s - max time network
160s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system - submitted
30/11/2022, 00:32
Behavioral task
behavioral1
Sample
821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe
Resource
win7-20220812-en
windows7-x64
25 signatures
150 seconds
General
- Target 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe
- Size 563KB
- Sample221130-avsblaff4w
- SHA256 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5
- MD5 d7148e66f7d7d2f0be5d4a6edcc002d8
- SHA1 1933aa95f827f27f0ae8cf9fd0790ab0d1050dc2
- SHA512 e035439bedecf0a191939acf5778d9a2312a589b93ce666ca1f1aa57963005d53973bc59187e15e7055478656c87d583f03d92cdd3b23e61ad21288b1fb74f5c
- SSDEEP 12288:isBRjSLvxZqWPo3jTza+YoH34kc9dtj5vHNHXoLLxfBGFP4J:i4iloja+Yp9dtj5vHNHMoJS
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
-
http://www.klkjwre9fqwieluoi.info/
-
http://kukutrustnet777888.info/
Signatures
- Detect Neshta payload 1 IoCs
resource yara_rule behavioral2/files/0x0004000000009f75-139.dat family_neshta - Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe - Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe - Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe - Executes dropped EXE 1 IoCs
pid Process 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe -
resource yara_rule behavioral2/files/0x0001000000022dea-133.dat upx behavioral2/files/0x0001000000022dea-134.dat upx behavioral2/memory/1220-135-0x0000000002410000-0x000000000349E000-memory.dmp upx behavioral2/memory/1220-136-0x0000000000400000-0x000000000051E000-memory.dmp upx behavioral2/memory/1220-137-0x0000000000400000-0x000000000051E000-memory.dmp upx behavioral2/memory/1220-138-0x0000000002410000-0x000000000349E000-memory.dmp upx - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe - Enumerates connected drives 3 TTPs 20 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened (read-only) \??\R: 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened (read-only) \??\G: 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened (read-only) \??\L: 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened (read-only) \??\P: 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened (read-only) \??\Z: 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened (read-only) \??\H: 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened (read-only) \??\O: 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened (read-only) \??\S: 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened (read-only) \??\T: 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened (read-only) \??\U: 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened (read-only) \??\X: 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened (read-only) \??\Y: 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened (read-only) \??\E: 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened (read-only) \??\F: 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened (read-only) \??\K: 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened (read-only) \??\W: 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened (read-only) \??\M: 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened (read-only) \??\N: 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened (read-only) \??\V: 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe - Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13167~1.21\MI9C33~1.EXE 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13167~1.21\MICROS~1.EXE 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13167~1.21\MIA062~1.EXE 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13167~1.21\MICROS~1.EXE 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13167~1.21\MICROS~4.EXE 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13167~1.21\MICROS~3.EXE 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe File opened for modification C:\Windows\svchost.com 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe Token: SeDebugPrivilege 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 644 wrote to memory of 1220 644 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 80 PID 644 wrote to memory of 1220 644 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 80 PID 644 wrote to memory of 1220 644 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 80 PID 1220 wrote to memory of 792 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 9 PID 1220 wrote to memory of 800 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 21 PID 1220 wrote to memory of 372 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 11 PID 1220 wrote to memory of 2292 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 34 PID 1220 wrote to memory of 2320 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 33 PID 1220 wrote to memory of 2400 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 32 PID 1220 wrote to memory of 3064 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 41 PID 1220 wrote to memory of 1328 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 40 PID 1220 wrote to memory of 3216 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 39 PID 1220 wrote to memory of 3316 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 38 PID 1220 wrote to memory of 3380 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 37 PID 1220 wrote to memory of 3520 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 64 PID 1220 wrote to memory of 3820 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 63 PID 1220 wrote to memory of 4692 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 61 PID 1220 wrote to memory of 644 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 79 PID 1220 wrote to memory of 644 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 79 PID 1220 wrote to memory of 792 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 9 PID 1220 wrote to memory of 800 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 21 PID 1220 wrote to memory of 372 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 11 PID 1220 wrote to memory of 2292 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 34 PID 1220 wrote to memory of 2320 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 33 PID 1220 wrote to memory of 2400 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 32 PID 1220 wrote to memory of 3064 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 41 PID 1220 wrote to memory of 1328 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 40 PID 1220 wrote to memory of 3216 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 39 PID 1220 wrote to memory of 3316 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 38 PID 1220 wrote to memory of 3380 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 37 PID 1220 wrote to memory of 3520 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 64 PID 1220 wrote to memory of 3820 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 63 PID 1220 wrote to memory of 4692 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 61 PID 1220 wrote to memory of 792 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 9 PID 1220 wrote to memory of 800 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 21 PID 1220 wrote to memory of 372 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 11 PID 1220 wrote to memory of 2292 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 34 PID 1220 wrote to memory of 2320 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 33 PID 1220 wrote to memory of 2400 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 32 PID 1220 wrote to memory of 3064 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 41 PID 1220 wrote to memory of 1328 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 40 PID 1220 wrote to memory of 3216 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 39 PID 1220 wrote to memory of 3316 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 38 PID 1220 wrote to memory of 3380 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 37 PID 1220 wrote to memory of 3520 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 64 PID 1220 wrote to memory of 3820 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 63 PID 1220 wrote to memory of 4692 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 61 PID 1220 wrote to memory of 792 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 9 PID 1220 wrote to memory of 800 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 21 PID 1220 wrote to memory of 372 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 11 PID 1220 wrote to memory of 2292 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 34 PID 1220 wrote to memory of 2320 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 33 PID 1220 wrote to memory of 2400 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 32 PID 1220 wrote to memory of 3064 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 41 PID 1220 wrote to memory of 1328 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 40 PID 1220 wrote to memory of 3216 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 39 PID 1220 wrote to memory of 3316 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 38 PID 1220 wrote to memory of 3380 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 37 PID 1220 wrote to memory of 3520 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 64 PID 1220 wrote to memory of 3820 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 63 PID 1220 wrote to memory of 4692 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 61 PID 1220 wrote to memory of 792 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 9 PID 1220 wrote to memory of 800 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 21 PID 1220 wrote to memory of 372 1220 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe 11 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:372
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:800
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2400
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2320
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2292
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3380
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3316
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3216
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:1328
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe"C:\Users\Admin\AppData\Local\Temp\821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe"2⤵
- Modifies system executable filetype association
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Users\Admin\AppData\Local\Temp\3582-490\821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe"3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1220
-
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4692
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3820
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3520
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ODT\office2016setup.exe
- Size 5.1MB
- SHA256 2a1ed24be7e3859b46ec3ebc316789ead5f12055853f86a9656e04b4bb771842
- MD5 02c3d242fe142b0eabec69211b34bc55
- SHA1 ea0a4a6d6078b362f7b3a4ad1505ce49957dc16e
- SHA512 0efb08492eaaa2e923beddc21566e98fbbef3a102f9415ff310ec616f5c84fd2ba3a7025b05e01c0bdf37e5e2f64dfd845f9254a376144cc7d827e7577dbb099
- SSDEEP 98304:57M701RgX4iuSl1DtlEq81xZPGnzURnBh6gGS/QmvD/cTwY2h3F+S:dM7pTXexZPGzURnBh6gGSF+W3US
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\3582-490\821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe
- Size 523KB
- SHA256 43ac46a4569aa70fb22067c9675ef814f619c98d5869bf72fd68940f834aad00
- MD5 1d89233d28ea0b6870620770e2758468
- SHA1 613a0b4bfcc52bd36c1475946f5d60643777b19f
- SHA512 9f2a71a8a6989383fff559902a06ded72f373db3c74b9f24cd279b830f308580f00f3714cc5035cb7f6382bc0ebc439546e67d6e3b8913e6de8404bbdfc1c042
- SSDEEP 12288:tGFP4rsBRjSLvxZqWPo3jTza+YoH34kc9dtj5vHNHXoLLxO:8Jw4iloja+Yp9dtj5vHNHN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\3582-490\821ac143dd07ba21d1a7546d2b386d6ae9a5472798a1311870d1608b880407a5.exe
- Size 523KB
- SHA256 43ac46a4569aa70fb22067c9675ef814f619c98d5869bf72fd68940f834aad00
- MD5 1d89233d28ea0b6870620770e2758468
- SHA1 613a0b4bfcc52bd36c1475946f5d60643777b19f
- SHA512 9f2a71a8a6989383fff559902a06ded72f373db3c74b9f24cd279b830f308580f00f3714cc5035cb7f6382bc0ebc439546e67d6e3b8913e6de8404bbdfc1c042
- SSDEEP 12288:tGFP4rsBRjSLvxZqWPo3jTza+YoH34kc9dtj5vHNHXoLLxO:8Jw4iloja+Yp9dtj5vHNHN
- MD5 SHA1 SHA512 SSDEEP