Analysis
-
max time kernel
69s -
max time network
115s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 18:42
Static task
static1
Behavioral task
behavioral1
Sample
4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe
Resource
win7-20221111-en
General
-
Target
4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe
-
Size
648KB
-
MD5
763dd9b7f2a5183a1380bee36889f936
-
SHA1
cdc7f9911a853973fc83d0e1a51ee5e82da347c9
-
SHA256
4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039
-
SHA512
7ce621d758a7e12d026d669a5a9827e4dbec130baf05c51e8937227b9f35f5ef7ecfc4e60202f1e3d2f7aa67d665f612bfa0db92cd1ec3d2420a8207b152e37c
-
SSDEEP
12288:Z8iNlD5ZS/1WEJOAqRSEM3Sy21LVbK89elrrJ56:vKIDAEQSy2TbKuKN
Malware Config
Extracted
quasar
2.1.0.0
ajith
23.105.131.178:7812
VNM_MUTEX_NdVd2sPSSqFdo7I35g
-
encryption_key
jyerms3KOWmt3C9DBFuq
-
install_name
Windows Defender Security.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows Update
-
subdirectory
SubDir
Signatures
-
Contains code to disable Windows Defender 6 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Processes:
resource yara_rule behavioral1/memory/1744-60-0x0000000000400000-0x000000000048C000-memory.dmp disable_win_def behavioral1/memory/1744-61-0x0000000000400000-0x000000000048C000-memory.dmp disable_win_def behavioral1/memory/1744-62-0x0000000000400000-0x000000000048C000-memory.dmp disable_win_def behavioral1/memory/1744-63-0x0000000000486C4E-mapping.dmp disable_win_def behavioral1/memory/1744-65-0x0000000000400000-0x000000000048C000-memory.dmp disable_win_def behavioral1/memory/1744-67-0x0000000000400000-0x000000000048C000-memory.dmp disable_win_def -
Processes:
4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe -
Quasar payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1744-60-0x0000000000400000-0x000000000048C000-memory.dmp family_quasar behavioral1/memory/1744-61-0x0000000000400000-0x000000000048C000-memory.dmp family_quasar behavioral1/memory/1744-62-0x0000000000400000-0x000000000048C000-memory.dmp family_quasar behavioral1/memory/1744-63-0x0000000000486C4E-mapping.dmp family_quasar behavioral1/memory/1744-65-0x0000000000400000-0x000000000048C000-memory.dmp family_quasar behavioral1/memory/1744-67-0x0000000000400000-0x000000000048C000-memory.dmp family_quasar -
Executes dropped EXE 6 IoCs
Processes:
Windows Defender Security.exeWindows Defender Security.exeWindows Defender Security.exeWindows Defender Security.exeWindows Defender Security.exeWindows Defender Security.exepid process 292 Windows Defender Security.exe 2044 Windows Defender Security.exe 1068 Windows Defender Security.exe 1288 Windows Defender Security.exe 2020 Windows Defender Security.exe 1788 Windows Defender Security.exe -
Loads dropped DLL 2 IoCs
Processes:
4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exeWindows Defender Security.exepid process 1744 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe 292 Windows Defender Security.exe -
Processes:
4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Update Folder\\Windows Update.exe" 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe\"" 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 2 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exedescription pid process target process PID 1380 set thread context of 1744 1380 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1620 1744 WerFault.exe 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Processes:
4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
Windows Defender Security.exepowershell.exe4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exepid process 292 Windows Defender Security.exe 292 Windows Defender Security.exe 292 Windows Defender Security.exe 292 Windows Defender Security.exe 292 Windows Defender Security.exe 292 Windows Defender Security.exe 292 Windows Defender Security.exe 292 Windows Defender Security.exe 292 Windows Defender Security.exe 292 Windows Defender Security.exe 1872 powershell.exe 1744 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe 1744 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe 1744 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe 1744 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe 1744 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe 1744 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe 1744 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exeWindows Defender Security.exepowershell.exedescription pid process Token: SeDebugPrivilege 1744 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe Token: SeDebugPrivilege 292 Windows Defender Security.exe Token: SeDebugPrivilege 1872 powershell.exe -
Suspicious use of WriteProcessMemory 53 IoCs
Processes:
4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exeWindows Defender Security.execmd.exedescription pid process target process PID 1380 wrote to memory of 1744 1380 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe PID 1380 wrote to memory of 1744 1380 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe PID 1380 wrote to memory of 1744 1380 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe PID 1380 wrote to memory of 1744 1380 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe PID 1380 wrote to memory of 1744 1380 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe PID 1380 wrote to memory of 1744 1380 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe PID 1380 wrote to memory of 1744 1380 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe PID 1380 wrote to memory of 1744 1380 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe PID 1380 wrote to memory of 1744 1380 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe PID 1744 wrote to memory of 1768 1744 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe schtasks.exe PID 1744 wrote to memory of 1768 1744 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe schtasks.exe PID 1744 wrote to memory of 1768 1744 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe schtasks.exe PID 1744 wrote to memory of 1768 1744 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe schtasks.exe PID 1744 wrote to memory of 292 1744 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe Windows Defender Security.exe PID 1744 wrote to memory of 292 1744 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe Windows Defender Security.exe PID 1744 wrote to memory of 292 1744 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe Windows Defender Security.exe PID 1744 wrote to memory of 292 1744 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe Windows Defender Security.exe PID 1744 wrote to memory of 1872 1744 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe powershell.exe PID 1744 wrote to memory of 1872 1744 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe powershell.exe PID 1744 wrote to memory of 1872 1744 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe powershell.exe PID 1744 wrote to memory of 1872 1744 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe powershell.exe PID 292 wrote to memory of 2044 292 Windows Defender Security.exe Windows Defender Security.exe PID 292 wrote to memory of 2044 292 Windows Defender Security.exe Windows Defender Security.exe PID 292 wrote to memory of 2044 292 Windows Defender Security.exe Windows Defender Security.exe PID 292 wrote to memory of 2044 292 Windows Defender Security.exe Windows Defender Security.exe PID 292 wrote to memory of 1068 292 Windows Defender Security.exe Windows Defender Security.exe PID 292 wrote to memory of 1068 292 Windows Defender Security.exe Windows Defender Security.exe PID 292 wrote to memory of 1068 292 Windows Defender Security.exe Windows Defender Security.exe PID 292 wrote to memory of 1068 292 Windows Defender Security.exe Windows Defender Security.exe PID 292 wrote to memory of 1288 292 Windows Defender Security.exe Windows Defender Security.exe PID 292 wrote to memory of 1288 292 Windows Defender Security.exe Windows Defender Security.exe PID 292 wrote to memory of 1288 292 Windows Defender Security.exe Windows Defender Security.exe PID 292 wrote to memory of 1288 292 Windows Defender Security.exe Windows Defender Security.exe PID 292 wrote to memory of 1788 292 Windows Defender Security.exe Windows Defender Security.exe PID 292 wrote to memory of 1788 292 Windows Defender Security.exe Windows Defender Security.exe PID 292 wrote to memory of 1788 292 Windows Defender Security.exe Windows Defender Security.exe PID 292 wrote to memory of 1788 292 Windows Defender Security.exe Windows Defender Security.exe PID 292 wrote to memory of 2020 292 Windows Defender Security.exe Windows Defender Security.exe PID 292 wrote to memory of 2020 292 Windows Defender Security.exe Windows Defender Security.exe PID 292 wrote to memory of 2020 292 Windows Defender Security.exe Windows Defender Security.exe PID 292 wrote to memory of 2020 292 Windows Defender Security.exe Windows Defender Security.exe PID 1744 wrote to memory of 1600 1744 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe cmd.exe PID 1744 wrote to memory of 1600 1744 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe cmd.exe PID 1744 wrote to memory of 1600 1744 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe cmd.exe PID 1744 wrote to memory of 1600 1744 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe cmd.exe PID 1600 wrote to memory of 1824 1600 cmd.exe cmd.exe PID 1600 wrote to memory of 1824 1600 cmd.exe cmd.exe PID 1600 wrote to memory of 1824 1600 cmd.exe cmd.exe PID 1600 wrote to memory of 1824 1600 cmd.exe cmd.exe PID 1744 wrote to memory of 1620 1744 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe WerFault.exe PID 1744 wrote to memory of 1620 1744 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe WerFault.exe PID 1744 wrote to memory of 1620 1744 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe WerFault.exe PID 1744 wrote to memory of 1620 1744 4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe"C:\Users\Admin\AppData\Local\Temp\4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe"C:\Users\Admin\AppData\Local\Temp\4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe"2⤵
- Modifies Windows Defender Real-time Protection settings
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\4be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe"C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe"C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe"C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe"C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe"C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe"C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k start /b del /q/f/s %TEMP%\* & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K del /q/f/s C:\Users\Admin\AppData\Local\Temp\*4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 19763⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\8nZo2TEUooVe.batFilesize
261B
MD587b94ee26957f101f227442746bcb477
SHA1b33b92cb6c12e6469359f06a216dfdb8f65dafb3
SHA256a73f50a37f560192356cb6910ba3c57a53ed91f10b703b5a9eb267504e8ce1e9
SHA51210f47882c3b291d0229b975bd378df0be3b736d4f93d61cbb12f813252c4cd96d6fec781452ab86c31a3f15098e5fbfddc04cfa908d31131b90d875f31ae53a2
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exeFilesize
648KB
MD5763dd9b7f2a5183a1380bee36889f936
SHA1cdc7f9911a853973fc83d0e1a51ee5e82da347c9
SHA2564be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039
SHA5127ce621d758a7e12d026d669a5a9827e4dbec130baf05c51e8937227b9f35f5ef7ecfc4e60202f1e3d2f7aa67d665f612bfa0db92cd1ec3d2420a8207b152e37c
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exeFilesize
648KB
MD5763dd9b7f2a5183a1380bee36889f936
SHA1cdc7f9911a853973fc83d0e1a51ee5e82da347c9
SHA2564be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039
SHA5127ce621d758a7e12d026d669a5a9827e4dbec130baf05c51e8937227b9f35f5ef7ecfc4e60202f1e3d2f7aa67d665f612bfa0db92cd1ec3d2420a8207b152e37c
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exeFilesize
648KB
MD5763dd9b7f2a5183a1380bee36889f936
SHA1cdc7f9911a853973fc83d0e1a51ee5e82da347c9
SHA2564be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039
SHA5127ce621d758a7e12d026d669a5a9827e4dbec130baf05c51e8937227b9f35f5ef7ecfc4e60202f1e3d2f7aa67d665f612bfa0db92cd1ec3d2420a8207b152e37c
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exeFilesize
648KB
MD5763dd9b7f2a5183a1380bee36889f936
SHA1cdc7f9911a853973fc83d0e1a51ee5e82da347c9
SHA2564be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039
SHA5127ce621d758a7e12d026d669a5a9827e4dbec130baf05c51e8937227b9f35f5ef7ecfc4e60202f1e3d2f7aa67d665f612bfa0db92cd1ec3d2420a8207b152e37c
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exeFilesize
648KB
MD5763dd9b7f2a5183a1380bee36889f936
SHA1cdc7f9911a853973fc83d0e1a51ee5e82da347c9
SHA2564be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039
SHA5127ce621d758a7e12d026d669a5a9827e4dbec130baf05c51e8937227b9f35f5ef7ecfc4e60202f1e3d2f7aa67d665f612bfa0db92cd1ec3d2420a8207b152e37c
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exeFilesize
648KB
MD5763dd9b7f2a5183a1380bee36889f936
SHA1cdc7f9911a853973fc83d0e1a51ee5e82da347c9
SHA2564be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039
SHA5127ce621d758a7e12d026d669a5a9827e4dbec130baf05c51e8937227b9f35f5ef7ecfc4e60202f1e3d2f7aa67d665f612bfa0db92cd1ec3d2420a8207b152e37c
-
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exeFilesize
648KB
MD5763dd9b7f2a5183a1380bee36889f936
SHA1cdc7f9911a853973fc83d0e1a51ee5e82da347c9
SHA2564be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039
SHA5127ce621d758a7e12d026d669a5a9827e4dbec130baf05c51e8937227b9f35f5ef7ecfc4e60202f1e3d2f7aa67d665f612bfa0db92cd1ec3d2420a8207b152e37c
-
\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exeFilesize
648KB
MD5763dd9b7f2a5183a1380bee36889f936
SHA1cdc7f9911a853973fc83d0e1a51ee5e82da347c9
SHA2564be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039
SHA5127ce621d758a7e12d026d669a5a9827e4dbec130baf05c51e8937227b9f35f5ef7ecfc4e60202f1e3d2f7aa67d665f612bfa0db92cd1ec3d2420a8207b152e37c
-
\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exeFilesize
648KB
MD5763dd9b7f2a5183a1380bee36889f936
SHA1cdc7f9911a853973fc83d0e1a51ee5e82da347c9
SHA2564be9a02e54e86920ed2bcaef3d28253ad0f4f3b005a14c656d74966589ca2039
SHA5127ce621d758a7e12d026d669a5a9827e4dbec130baf05c51e8937227b9f35f5ef7ecfc4e60202f1e3d2f7aa67d665f612bfa0db92cd1ec3d2420a8207b152e37c
-
memory/292-75-0x00000000003D0000-0x0000000000478000-memory.dmpFilesize
672KB
-
memory/292-71-0x0000000000000000-mapping.dmp
-
memory/1380-55-0x00000000764C1000-0x00000000764C3000-memory.dmpFilesize
8KB
-
memory/1380-54-0x00000000013C0000-0x0000000001468000-memory.dmpFilesize
672KB
-
memory/1380-56-0x0000000000430000-0x000000000043A000-memory.dmpFilesize
40KB
-
memory/1600-85-0x0000000000000000-mapping.dmp
-
memory/1620-88-0x0000000000000000-mapping.dmp
-
memory/1744-61-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1744-57-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1744-58-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1744-67-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1744-63-0x0000000000486C4E-mapping.dmp
-
memory/1744-62-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1744-60-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1744-65-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1768-69-0x0000000000000000-mapping.dmp
-
memory/1824-86-0x0000000000000000-mapping.dmp
-
memory/1872-74-0x0000000000000000-mapping.dmp
-
memory/1872-84-0x000000006F070000-0x000000006F61B000-memory.dmpFilesize
5.7MB
-
memory/1872-83-0x000000006F070000-0x000000006F61B000-memory.dmpFilesize
5.7MB