Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03-12-2022 02:03
Static task
static1
Behavioral task
behavioral1
Sample
c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe
Resource
win7-20220812-en
General
-
Target
c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe
-
Size
317KB
-
MD5
178b94a462503845831cd0a6c3e3b500
-
SHA1
99510e9b7abbfff7cc4097e51196ad801fc1d82d
-
SHA256
c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339
-
SHA512
ee4ee70924bf2221de983527cbc3b6d10c2962d0f0f046efe523088bf51df0da0de0c5a8a56e8c6958167e32052201b789eeff2cc989d2333760e9549e0465cf
-
SSDEEP
6144:hzjAH9agPC3gLzeAyzhsv70s3QS8A7KQGNBZmUF4nHytzcc:xAdag1mAyzMxp8A7KQGNBZm3HOcc
Malware Config
Extracted
darkcomet
24
127.0.0.1:1604
172.162.22.200:1604
remaxcheckings.no-ip.biz:1604
DC_MUTEX-AT9WGLV
-
InstallPath
MSDCSC\remaxcheckings.exe
-
gencode
WN5Nr6wiGseC
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
remaxcheckings
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\MSDCSC\\remaxcheckings.exe" c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe -
Modifies firewall policy service 2 TTPs 9 IoCs
Processes:
iexplore.exeiexplore.exeremaxcheckings.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" iexplore.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" iexplore.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile iexplore.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" remaxcheckings.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile iexplore.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" iexplore.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" iexplore.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile remaxcheckings.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" remaxcheckings.exe -
Modifies security service 2 TTPs 3 IoCs
Processes:
iexplore.exeiexplore.exeremaxcheckings.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" iexplore.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" iexplore.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" remaxcheckings.exe -
Processes:
iexplore.exeiexplore.exeremaxcheckings.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" remaxcheckings.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" remaxcheckings.exe -
Disables RegEdit via registry modification 3 IoCs
Processes:
iexplore.exeiexplore.exeremaxcheckings.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" remaxcheckings.exe -
Disables Task Manager via registry modification
-
Executes dropped EXE 3 IoCs
Processes:
c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exeremaxcheckings.exeremaxcheckings.exepid process 1244 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe 900 remaxcheckings.exe 976 remaxcheckings.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 1600 attrib.exe 316 attrib.exe -
Processes:
resource yara_rule behavioral1/memory/1244-63-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1244-65-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1244-66-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1244-69-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1244-71-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1244-72-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1244-73-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1244-89-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/976-101-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 1352 notepad.exe -
Loads dropped DLL 2 IoCs
Processes:
c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exec4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exepid process 1724 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe 1244 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe -
Processes:
remaxcheckings.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" remaxcheckings.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" remaxcheckings.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
remaxcheckings.exec4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exeiexplore.exec4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exeremaxcheckings.exeiexplore.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\remaxcheckings = "C:\\MSDCSC\\remaxcheckings.exe" remaxcheckings.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe" c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe" c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\remaxcheckings = "C:\\MSDCSC\\remaxcheckings.exe" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\remaxcheckings = "C:\\MSDCSC\\remaxcheckings.exe" c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe" remaxcheckings.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe" remaxcheckings.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\remaxcheckings = "C:\\MSDCSC\\remaxcheckings.exe" iexplore.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exeremaxcheckings.exedescription pid process target process PID 1724 set thread context of 2012 1724 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe iexplore.exe PID 1724 set thread context of 1244 1724 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe PID 900 set thread context of 2040 900 remaxcheckings.exe iexplore.exe PID 900 set thread context of 976 900 remaxcheckings.exe remaxcheckings.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exeremaxcheckings.exepid process 1724 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe 900 remaxcheckings.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 2012 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
iexplore.exec4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exeiexplore.exedescription pid process Token: SeIncreaseQuotaPrivilege 2012 iexplore.exe Token: SeSecurityPrivilege 2012 iexplore.exe Token: SeTakeOwnershipPrivilege 2012 iexplore.exe Token: SeLoadDriverPrivilege 2012 iexplore.exe Token: SeSystemProfilePrivilege 2012 iexplore.exe Token: SeSystemtimePrivilege 2012 iexplore.exe Token: SeProfSingleProcessPrivilege 2012 iexplore.exe Token: SeIncBasePriorityPrivilege 2012 iexplore.exe Token: SeCreatePagefilePrivilege 2012 iexplore.exe Token: SeBackupPrivilege 2012 iexplore.exe Token: SeRestorePrivilege 2012 iexplore.exe Token: SeShutdownPrivilege 2012 iexplore.exe Token: SeDebugPrivilege 2012 iexplore.exe Token: SeSystemEnvironmentPrivilege 2012 iexplore.exe Token: SeChangeNotifyPrivilege 2012 iexplore.exe Token: SeRemoteShutdownPrivilege 2012 iexplore.exe Token: SeUndockPrivilege 2012 iexplore.exe Token: SeManageVolumePrivilege 2012 iexplore.exe Token: SeImpersonatePrivilege 2012 iexplore.exe Token: SeCreateGlobalPrivilege 2012 iexplore.exe Token: 33 2012 iexplore.exe Token: 34 2012 iexplore.exe Token: 35 2012 iexplore.exe Token: SeIncreaseQuotaPrivilege 1244 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: SeSecurityPrivilege 1244 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: SeTakeOwnershipPrivilege 1244 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: SeLoadDriverPrivilege 1244 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: SeSystemProfilePrivilege 1244 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: SeSystemtimePrivilege 1244 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: SeProfSingleProcessPrivilege 1244 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: SeIncBasePriorityPrivilege 1244 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: SeCreatePagefilePrivilege 1244 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: SeBackupPrivilege 1244 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: SeRestorePrivilege 1244 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: SeShutdownPrivilege 1244 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: SeDebugPrivilege 1244 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: SeSystemEnvironmentPrivilege 1244 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: SeChangeNotifyPrivilege 1244 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: SeRemoteShutdownPrivilege 1244 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: SeUndockPrivilege 1244 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: SeManageVolumePrivilege 1244 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: SeImpersonatePrivilege 1244 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: SeCreateGlobalPrivilege 1244 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: 33 1244 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: 34 1244 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: 35 1244 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: SeIncreaseQuotaPrivilege 2040 iexplore.exe Token: SeSecurityPrivilege 2040 iexplore.exe Token: SeTakeOwnershipPrivilege 2040 iexplore.exe Token: SeLoadDriverPrivilege 2040 iexplore.exe Token: SeSystemProfilePrivilege 2040 iexplore.exe Token: SeSystemtimePrivilege 2040 iexplore.exe Token: SeProfSingleProcessPrivilege 2040 iexplore.exe Token: SeIncBasePriorityPrivilege 2040 iexplore.exe Token: SeCreatePagefilePrivilege 2040 iexplore.exe Token: SeBackupPrivilege 2040 iexplore.exe Token: SeRestorePrivilege 2040 iexplore.exe Token: SeShutdownPrivilege 2040 iexplore.exe Token: SeDebugPrivilege 2040 iexplore.exe Token: SeSystemEnvironmentPrivilege 2040 iexplore.exe Token: SeChangeNotifyPrivilege 2040 iexplore.exe Token: SeRemoteShutdownPrivilege 2040 iexplore.exe Token: SeUndockPrivilege 2040 iexplore.exe Token: SeManageVolumePrivilege 2040 iexplore.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
iexplore.exepid process 2012 iexplore.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.execmd.exenet.exeiexplore.exec4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exedescription pid process target process PID 1724 wrote to memory of 1048 1724 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe cmd.exe PID 1724 wrote to memory of 1048 1724 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe cmd.exe PID 1724 wrote to memory of 1048 1724 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe cmd.exe PID 1724 wrote to memory of 1048 1724 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe cmd.exe PID 1724 wrote to memory of 2012 1724 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe iexplore.exe PID 1724 wrote to memory of 2012 1724 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe iexplore.exe PID 1724 wrote to memory of 2012 1724 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe iexplore.exe PID 1724 wrote to memory of 2012 1724 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe iexplore.exe PID 1724 wrote to memory of 2012 1724 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe iexplore.exe PID 1724 wrote to memory of 2012 1724 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe iexplore.exe PID 1724 wrote to memory of 2012 1724 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe iexplore.exe PID 1724 wrote to memory of 2012 1724 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe iexplore.exe PID 1048 wrote to memory of 1328 1048 cmd.exe net.exe PID 1048 wrote to memory of 1328 1048 cmd.exe net.exe PID 1048 wrote to memory of 1328 1048 cmd.exe net.exe PID 1048 wrote to memory of 1328 1048 cmd.exe net.exe PID 1328 wrote to memory of 1164 1328 net.exe net1.exe PID 1328 wrote to memory of 1164 1328 net.exe net1.exe PID 1328 wrote to memory of 1164 1328 net.exe net1.exe PID 1328 wrote to memory of 1164 1328 net.exe net1.exe PID 2012 wrote to memory of 1324 2012 iexplore.exe notepad.exe PID 2012 wrote to memory of 1324 2012 iexplore.exe notepad.exe PID 2012 wrote to memory of 1324 2012 iexplore.exe notepad.exe PID 2012 wrote to memory of 1324 2012 iexplore.exe notepad.exe PID 2012 wrote to memory of 1324 2012 iexplore.exe notepad.exe PID 2012 wrote to memory of 1324 2012 iexplore.exe notepad.exe PID 2012 wrote to memory of 1324 2012 iexplore.exe notepad.exe PID 2012 wrote to memory of 1324 2012 iexplore.exe notepad.exe PID 2012 wrote to memory of 1324 2012 iexplore.exe notepad.exe PID 2012 wrote to memory of 1324 2012 iexplore.exe notepad.exe PID 2012 wrote to memory of 1324 2012 iexplore.exe notepad.exe PID 2012 wrote to memory of 1324 2012 iexplore.exe notepad.exe PID 2012 wrote to memory of 1324 2012 iexplore.exe notepad.exe PID 2012 wrote to memory of 1324 2012 iexplore.exe notepad.exe PID 2012 wrote to memory of 1324 2012 iexplore.exe notepad.exe PID 2012 wrote to memory of 1324 2012 iexplore.exe notepad.exe PID 2012 wrote to memory of 1324 2012 iexplore.exe notepad.exe PID 2012 wrote to memory of 1324 2012 iexplore.exe notepad.exe PID 2012 wrote to memory of 1324 2012 iexplore.exe notepad.exe PID 2012 wrote to memory of 1324 2012 iexplore.exe notepad.exe PID 2012 wrote to memory of 1324 2012 iexplore.exe notepad.exe PID 2012 wrote to memory of 1324 2012 iexplore.exe notepad.exe PID 2012 wrote to memory of 1324 2012 iexplore.exe notepad.exe PID 1724 wrote to memory of 1244 1724 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe PID 1724 wrote to memory of 1244 1724 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe PID 1724 wrote to memory of 1244 1724 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe PID 1724 wrote to memory of 1244 1724 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe PID 1724 wrote to memory of 1244 1724 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe PID 1724 wrote to memory of 1244 1724 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe PID 1724 wrote to memory of 1244 1724 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe PID 1724 wrote to memory of 1244 1724 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe PID 1244 wrote to memory of 1768 1244 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe cmd.exe PID 1244 wrote to memory of 1768 1244 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe cmd.exe PID 1244 wrote to memory of 1768 1244 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe cmd.exe PID 1244 wrote to memory of 1768 1244 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe cmd.exe PID 1244 wrote to memory of 2000 1244 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe cmd.exe PID 1244 wrote to memory of 2000 1244 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe cmd.exe PID 1244 wrote to memory of 2000 1244 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe cmd.exe PID 1244 wrote to memory of 2000 1244 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe cmd.exe PID 1244 wrote to memory of 1352 1244 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe notepad.exe PID 1244 wrote to memory of 1352 1244 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe notepad.exe PID 1244 wrote to memory of 1352 1244 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe notepad.exe PID 1244 wrote to memory of 1352 1244 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe notepad.exe PID 1244 wrote to memory of 1352 1244 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe notepad.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
remaxcheckings.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion remaxcheckings.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern remaxcheckings.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" remaxcheckings.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1600 attrib.exe 316 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe"C:\Users\Admin\AppData\Local\Temp\c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c net stop MpsSvc2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop MpsSvc3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc4⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
-
C:\Users\Admin\AppData\Local\Temp\c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exeC:\Users\Admin\AppData\Local\Temp\c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe" +s +h3⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- Deletes itself
-
C:\MSDCSC\remaxcheckings.exe"C:\MSDCSC\remaxcheckings.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe/c net stop MpsSvc4⤵
-
C:\Windows\SysWOW64\net.exenet stop MpsSvc5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc6⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"4⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\MSDCSC\remaxcheckings.exeC:\MSDCSC\remaxcheckings.exe4⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- System policy modification
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSDCSC\remaxcheckings.exeFilesize
317KB
MD5178b94a462503845831cd0a6c3e3b500
SHA199510e9b7abbfff7cc4097e51196ad801fc1d82d
SHA256c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339
SHA512ee4ee70924bf2221de983527cbc3b6d10c2962d0f0f046efe523088bf51df0da0de0c5a8a56e8c6958167e32052201b789eeff2cc989d2333760e9549e0465cf
-
C:\MSDCSC\remaxcheckings.exeFilesize
317KB
MD5178b94a462503845831cd0a6c3e3b500
SHA199510e9b7abbfff7cc4097e51196ad801fc1d82d
SHA256c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339
SHA512ee4ee70924bf2221de983527cbc3b6d10c2962d0f0f046efe523088bf51df0da0de0c5a8a56e8c6958167e32052201b789eeff2cc989d2333760e9549e0465cf
-
C:\MSDCSC\remaxcheckings.exeFilesize
317KB
MD5178b94a462503845831cd0a6c3e3b500
SHA199510e9b7abbfff7cc4097e51196ad801fc1d82d
SHA256c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339
SHA512ee4ee70924bf2221de983527cbc3b6d10c2962d0f0f046efe523088bf51df0da0de0c5a8a56e8c6958167e32052201b789eeff2cc989d2333760e9549e0465cf
-
C:\Users\Admin\AppData\Local\Temp\c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exeFilesize
317KB
MD5178b94a462503845831cd0a6c3e3b500
SHA199510e9b7abbfff7cc4097e51196ad801fc1d82d
SHA256c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339
SHA512ee4ee70924bf2221de983527cbc3b6d10c2962d0f0f046efe523088bf51df0da0de0c5a8a56e8c6958167e32052201b789eeff2cc989d2333760e9549e0465cf
-
C:\Users\Admin\AppData\Roaming\InstallDir\help.exeFilesize
317KB
MD5178b94a462503845831cd0a6c3e3b500
SHA199510e9b7abbfff7cc4097e51196ad801fc1d82d
SHA256c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339
SHA512ee4ee70924bf2221de983527cbc3b6d10c2962d0f0f046efe523088bf51df0da0de0c5a8a56e8c6958167e32052201b789eeff2cc989d2333760e9549e0465cf
-
\MSDCSC\remaxcheckings.exeFilesize
317KB
MD5178b94a462503845831cd0a6c3e3b500
SHA199510e9b7abbfff7cc4097e51196ad801fc1d82d
SHA256c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339
SHA512ee4ee70924bf2221de983527cbc3b6d10c2962d0f0f046efe523088bf51df0da0de0c5a8a56e8c6958167e32052201b789eeff2cc989d2333760e9549e0465cf
-
\Users\Admin\AppData\Local\Temp\c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exeFilesize
317KB
MD5178b94a462503845831cd0a6c3e3b500
SHA199510e9b7abbfff7cc4097e51196ad801fc1d82d
SHA256c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339
SHA512ee4ee70924bf2221de983527cbc3b6d10c2962d0f0f046efe523088bf51df0da0de0c5a8a56e8c6958167e32052201b789eeff2cc989d2333760e9549e0465cf
-
memory/316-79-0x0000000000000000-mapping.dmp
-
memory/900-81-0x0000000000000000-mapping.dmp
-
memory/976-95-0x00000000004B5900-mapping.dmp
-
memory/976-101-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1048-55-0x0000000000000000-mapping.dmp
-
memory/1164-57-0x0000000000000000-mapping.dmp
-
memory/1244-63-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1244-62-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1244-72-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1244-73-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1244-71-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1244-69-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1244-89-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1244-66-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1244-67-0x00000000004B5900-mapping.dmp
-
memory/1244-65-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1324-58-0x0000000000000000-mapping.dmp
-
memory/1328-56-0x0000000000000000-mapping.dmp
-
memory/1352-76-0x0000000000000000-mapping.dmp
-
memory/1600-78-0x0000000000000000-mapping.dmp
-
memory/1724-54-0x0000000074AD1000-0x0000000074AD3000-memory.dmpFilesize
8KB
-
memory/1724-60-0x0000000000250000-0x0000000000254000-memory.dmpFilesize
16KB
-
memory/1768-74-0x0000000000000000-mapping.dmp
-
memory/1924-86-0x0000000000000000-mapping.dmp
-
memory/1948-87-0x0000000000000000-mapping.dmp
-
memory/1992-88-0x0000000000000000-mapping.dmp
-
memory/2000-75-0x0000000000000000-mapping.dmp