Analysis
-
max time kernel
192s -
max time network
203s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
02-12-2022 12:19
Static task
static1
Behavioral task
behavioral1
Sample
СПЕШНА ПОРЪЧКА ЗА ПОКУПКА.exe
Resource
win7-20220901-en
General
-
Target
СПЕШНА ПОРЪЧКА ЗА ПОКУПКА.exe
-
Size
722KB
-
MD5
0aee1077971fda9cedfc570be5e2c822
-
SHA1
21092ac3f3146688e8bf9b7613c8293b74824970
-
SHA256
97bfd8737b330f409b85e67a43a20edcdc497a63ec9d663692aa8d11e323caf1
-
SHA512
72eb237eb96309d537c70008bbf6fa592e805f6111561ea3370799d14ec61f88743359cd2f614f2ac314d3b625cfe2f32b5119a293dec974783a188f5672265a
-
SSDEEP
12288:kLpeGieN1J53lWwlZ4r+cKkdm2oOJKk1wnjaXBnM33302IgFJN0V3foYcjZnbCkI:6PvN1Nyr+cHm2AMwOBnG30YCoBjZnbCx
Malware Config
Extracted
formbook
4.1
d0a7
ngpjqd.top
provider1.net
themetaverseloyalties.com
tylpp.com
pmjewels.com
87napxxgz8x86a.com
djolobal.com
fmbmaiamelo.com
naijabam.online
networkingbits.com
beesweet.live
sexarab.homes
promptcompete.com
midsouthradio.com
23mk.top
bnhkit.xyz
2ozp56.bond
vehiclesgroups.com
healthycommunitynow.com
cwzmesr.com
qpeqlqb.com
parallelsoundsstudio.com
legacy-lc.com
isedeonline.com
baudtown.com
characting.space
noironclothes.com
pisell.one
comnewcocoffee.com
bitvtag.live
hotelblunt.com
chryslercapitla.com
designrate.art
niacopeland.com
royaltyweb3.com
openai-good.com
mom.rent
brapix.app
pikkwik.com
omilive.com
whdmjse.com
belifprint.com
ncsex6.xyz
vrf70r.online
jbway.com
avtokozmetika.website
info-klar.com
zbk53.com
comfydays.shop
ismagency.biz
shm01.com
horzeplay.com
luxacumen.com
drpathcares.com
steamfulfillmentllc.com
board-evaluations.com
gecreditu.info
aquastarla.net
yjdfw.net
dhjzfs.com
theminco.biz
honeynoel.com
rzkbol.com
anastsy4.tech
botani-yodo1.xyz
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4868-147-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4868-150-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3932-157-0x0000000000880000-0x00000000008AF000-memory.dmp formbook behavioral2/memory/3932-170-0x0000000000880000-0x00000000008AF000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
СПЕШНА ПОРЪЧКА ЗА ПОКУПКА.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation СПЕШНА ПОРЪЧКА ЗА ПОКУПКА.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
СПЕШНА ПОРЪЧКА ЗА ПОКУПКА.exeRegSvcs.exeWWAHost.exedescription pid process target process PID 1044 set thread context of 4868 1044 СПЕШНА ПОРЪЧКА ЗА ПОКУПКА.exe RegSvcs.exe PID 4868 set thread context of 2744 4868 RegSvcs.exe Explorer.EXE PID 3932 set thread context of 2744 3932 WWAHost.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 35 IoCs
Processes:
Explorer.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1" Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0000000001000000ffffffff Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656} Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Rev = "0" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Rev = "0" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616193" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295" Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616209" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616193" Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0" Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202 Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
powershell.exeRegSvcs.exeWWAHost.exepid process 4492 powershell.exe 4492 powershell.exe 4868 RegSvcs.exe 4868 RegSvcs.exe 4868 RegSvcs.exe 4868 RegSvcs.exe 3932 WWAHost.exe 3932 WWAHost.exe 3932 WWAHost.exe 3932 WWAHost.exe 3932 WWAHost.exe 3932 WWAHost.exe 3932 WWAHost.exe 3932 WWAHost.exe 3932 WWAHost.exe 3932 WWAHost.exe 3932 WWAHost.exe 3932 WWAHost.exe 3932 WWAHost.exe 3932 WWAHost.exe 3932 WWAHost.exe 3932 WWAHost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2744 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exeWWAHost.exepid process 4868 RegSvcs.exe 4868 RegSvcs.exe 4868 RegSvcs.exe 3932 WWAHost.exe 3932 WWAHost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exeRegSvcs.exeExplorer.EXEWWAHost.exedescription pid process Token: SeDebugPrivilege 4492 powershell.exe Token: SeDebugPrivilege 4868 RegSvcs.exe Token: SeShutdownPrivilege 2744 Explorer.EXE Token: SeCreatePagefilePrivilege 2744 Explorer.EXE Token: SeShutdownPrivilege 2744 Explorer.EXE Token: SeCreatePagefilePrivilege 2744 Explorer.EXE Token: SeShutdownPrivilege 2744 Explorer.EXE Token: SeCreatePagefilePrivilege 2744 Explorer.EXE Token: SeShutdownPrivilege 2744 Explorer.EXE Token: SeCreatePagefilePrivilege 2744 Explorer.EXE Token: SeShutdownPrivilege 2744 Explorer.EXE Token: SeCreatePagefilePrivilege 2744 Explorer.EXE Token: SeShutdownPrivilege 2744 Explorer.EXE Token: SeCreatePagefilePrivilege 2744 Explorer.EXE Token: SeShutdownPrivilege 2744 Explorer.EXE Token: SeCreatePagefilePrivilege 2744 Explorer.EXE Token: SeShutdownPrivilege 2744 Explorer.EXE Token: SeCreatePagefilePrivilege 2744 Explorer.EXE Token: SeShutdownPrivilege 2744 Explorer.EXE Token: SeCreatePagefilePrivilege 2744 Explorer.EXE Token: SeShutdownPrivilege 2744 Explorer.EXE Token: SeCreatePagefilePrivilege 2744 Explorer.EXE Token: SeShutdownPrivilege 2744 Explorer.EXE Token: SeCreatePagefilePrivilege 2744 Explorer.EXE Token: SeShutdownPrivilege 2744 Explorer.EXE Token: SeCreatePagefilePrivilege 2744 Explorer.EXE Token: SeShutdownPrivilege 2744 Explorer.EXE Token: SeCreatePagefilePrivilege 2744 Explorer.EXE Token: SeShutdownPrivilege 2744 Explorer.EXE Token: SeCreatePagefilePrivilege 2744 Explorer.EXE Token: SeShutdownPrivilege 2744 Explorer.EXE Token: SeCreatePagefilePrivilege 2744 Explorer.EXE Token: SeShutdownPrivilege 2744 Explorer.EXE Token: SeCreatePagefilePrivilege 2744 Explorer.EXE Token: SeDebugPrivilege 3932 WWAHost.exe Token: SeShutdownPrivilege 2744 Explorer.EXE Token: SeCreatePagefilePrivilege 2744 Explorer.EXE Token: SeShutdownPrivilege 2744 Explorer.EXE Token: SeCreatePagefilePrivilege 2744 Explorer.EXE Token: SeShutdownPrivilege 2744 Explorer.EXE Token: SeCreatePagefilePrivilege 2744 Explorer.EXE Token: SeShutdownPrivilege 2744 Explorer.EXE Token: SeCreatePagefilePrivilege 2744 Explorer.EXE Token: SeShutdownPrivilege 2744 Explorer.EXE Token: SeCreatePagefilePrivilege 2744 Explorer.EXE Token: SeShutdownPrivilege 2744 Explorer.EXE Token: SeCreatePagefilePrivilege 2744 Explorer.EXE Token: SeShutdownPrivilege 2744 Explorer.EXE Token: SeCreatePagefilePrivilege 2744 Explorer.EXE Token: SeShutdownPrivilege 2744 Explorer.EXE Token: SeCreatePagefilePrivilege 2744 Explorer.EXE Token: SeShutdownPrivilege 2744 Explorer.EXE Token: SeCreatePagefilePrivilege 2744 Explorer.EXE Token: SeShutdownPrivilege 2744 Explorer.EXE Token: SeCreatePagefilePrivilege 2744 Explorer.EXE Token: SeShutdownPrivilege 2744 Explorer.EXE Token: SeCreatePagefilePrivilege 2744 Explorer.EXE Token: SeShutdownPrivilege 2744 Explorer.EXE Token: SeCreatePagefilePrivilege 2744 Explorer.EXE Token: SeShutdownPrivilege 2744 Explorer.EXE Token: SeCreatePagefilePrivilege 2744 Explorer.EXE Token: SeShutdownPrivilege 2744 Explorer.EXE Token: SeCreatePagefilePrivilege 2744 Explorer.EXE Token: SeShutdownPrivilege 2744 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
СПЕШНА ПОРЪЧКА ЗА ПОКУПКА.exeExplorer.EXEWWAHost.exedescription pid process target process PID 1044 wrote to memory of 4492 1044 СПЕШНА ПОРЪЧКА ЗА ПОКУПКА.exe powershell.exe PID 1044 wrote to memory of 4492 1044 СПЕШНА ПОРЪЧКА ЗА ПОКУПКА.exe powershell.exe PID 1044 wrote to memory of 4492 1044 СПЕШНА ПОРЪЧКА ЗА ПОКУПКА.exe powershell.exe PID 1044 wrote to memory of 3148 1044 СПЕШНА ПОРЪЧКА ЗА ПОКУПКА.exe schtasks.exe PID 1044 wrote to memory of 3148 1044 СПЕШНА ПОРЪЧКА ЗА ПОКУПКА.exe schtasks.exe PID 1044 wrote to memory of 3148 1044 СПЕШНА ПОРЪЧКА ЗА ПОКУПКА.exe schtasks.exe PID 1044 wrote to memory of 4868 1044 СПЕШНА ПОРЪЧКА ЗА ПОКУПКА.exe RegSvcs.exe PID 1044 wrote to memory of 4868 1044 СПЕШНА ПОРЪЧКА ЗА ПОКУПКА.exe RegSvcs.exe PID 1044 wrote to memory of 4868 1044 СПЕШНА ПОРЪЧКА ЗА ПОКУПКА.exe RegSvcs.exe PID 1044 wrote to memory of 4868 1044 СПЕШНА ПОРЪЧКА ЗА ПОКУПКА.exe RegSvcs.exe PID 1044 wrote to memory of 4868 1044 СПЕШНА ПОРЪЧКА ЗА ПОКУПКА.exe RegSvcs.exe PID 1044 wrote to memory of 4868 1044 СПЕШНА ПОРЪЧКА ЗА ПОКУПКА.exe RegSvcs.exe PID 2744 wrote to memory of 3932 2744 Explorer.EXE WWAHost.exe PID 2744 wrote to memory of 3932 2744 Explorer.EXE WWAHost.exe PID 2744 wrote to memory of 3932 2744 Explorer.EXE WWAHost.exe PID 3932 wrote to memory of 4632 3932 WWAHost.exe cmd.exe PID 3932 wrote to memory of 4632 3932 WWAHost.exe cmd.exe PID 3932 wrote to memory of 4632 3932 WWAHost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\СПЕШНА ПОРЪЧКА ЗА ПОКУПКА.exe"C:\Users\Admin\AppData\Local\Temp\СПЕШНА ПОРЪЧКА ЗА ПОКУПКА.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\CFLiKwclbcBo.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CFLiKwclbcBo" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4755.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WWAHost.exe"C:\Windows\SysWOW64\WWAHost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp4755.tmpFilesize
1KB
MD5ee017e792f7b1a3c8a799abe588b0298
SHA14a6e5ffa17684dea4ef807f389177a40efb4dc2d
SHA2563ee9c4a50d4d145d30a43ef13bbf33378c6b61380e52eb7ec539c85e8f4ee16e
SHA512b5e1ddca065083c4af8ec0d35a567e0aa19486be698dc4a26fae8e6d4fec859d21ca1f1d6aea78da9a52c472a0457a7d7a7a334862ccaefa17a696c3342ee894
-
memory/1044-134-0x00000000057A0000-0x0000000005D44000-memory.dmpFilesize
5.6MB
-
memory/1044-135-0x00000000051F0000-0x0000000005282000-memory.dmpFilesize
584KB
-
memory/1044-136-0x0000000005110000-0x000000000511A000-memory.dmpFilesize
40KB
-
memory/1044-137-0x0000000008A30000-0x0000000008ACC000-memory.dmpFilesize
624KB
-
memory/1044-133-0x0000000000800000-0x00000000008BA000-memory.dmpFilesize
744KB
-
memory/2744-172-0x0000000009070000-0x0000000009201000-memory.dmpFilesize
1.6MB
-
memory/2744-171-0x0000000009070000-0x0000000009201000-memory.dmpFilesize
1.6MB
-
memory/2744-153-0x000000000EA50000-0x000000000EBAF000-memory.dmpFilesize
1.4MB
-
memory/3148-141-0x0000000000000000-mapping.dmp
-
memory/3932-169-0x0000000001150000-0x00000000011E4000-memory.dmpFilesize
592KB
-
memory/3932-170-0x0000000000880000-0x00000000008AF000-memory.dmpFilesize
188KB
-
memory/3932-158-0x0000000001410000-0x000000000175A000-memory.dmpFilesize
3.3MB
-
memory/3932-157-0x0000000000880000-0x00000000008AF000-memory.dmpFilesize
188KB
-
memory/3932-155-0x00000000002E0000-0x00000000003BC000-memory.dmpFilesize
880KB
-
memory/3932-154-0x0000000000000000-mapping.dmp
-
memory/4492-161-0x0000000006990000-0x00000000069AE000-memory.dmpFilesize
120KB
-
memory/4492-144-0x0000000005CA0000-0x0000000005D06000-memory.dmpFilesize
408KB
-
memory/4492-138-0x0000000000000000-mapping.dmp
-
memory/4492-139-0x0000000002AD0000-0x0000000002B06000-memory.dmpFilesize
216KB
-
memory/4492-149-0x00000000063E0000-0x00000000063FE000-memory.dmpFilesize
120KB
-
memory/4492-140-0x0000000005670000-0x0000000005C98000-memory.dmpFilesize
6.2MB
-
memory/4492-145-0x0000000005D80000-0x0000000005DE6000-memory.dmpFilesize
408KB
-
memory/4492-143-0x00000000051A0000-0x00000000051C2000-memory.dmpFilesize
136KB
-
memory/4492-168-0x0000000007A10000-0x0000000007A18000-memory.dmpFilesize
32KB
-
memory/4492-159-0x00000000069B0000-0x00000000069E2000-memory.dmpFilesize
200KB
-
memory/4492-160-0x00000000753C0000-0x000000007540C000-memory.dmpFilesize
304KB
-
memory/4492-167-0x0000000007A30000-0x0000000007A4A000-memory.dmpFilesize
104KB
-
memory/4492-162-0x0000000007D30000-0x00000000083AA000-memory.dmpFilesize
6.5MB
-
memory/4492-163-0x00000000076F0000-0x000000000770A000-memory.dmpFilesize
104KB
-
memory/4492-164-0x0000000007760000-0x000000000776A000-memory.dmpFilesize
40KB
-
memory/4492-165-0x0000000007970000-0x0000000007A06000-memory.dmpFilesize
600KB
-
memory/4492-166-0x0000000007920000-0x000000000792E000-memory.dmpFilesize
56KB
-
memory/4632-156-0x0000000000000000-mapping.dmp
-
memory/4868-151-0x0000000001830000-0x0000000001B7A000-memory.dmpFilesize
3.3MB
-
memory/4868-146-0x0000000000000000-mapping.dmp
-
memory/4868-147-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4868-150-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4868-152-0x0000000001CE0000-0x0000000001CF5000-memory.dmpFilesize
84KB