Analysis
-
max time kernel
156s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2022 02:03
Static task
static1
Behavioral task
behavioral1
Sample
c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe
Resource
win7-20220812-en
General
-
Target
c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe
-
Size
317KB
-
MD5
178b94a462503845831cd0a6c3e3b500
-
SHA1
99510e9b7abbfff7cc4097e51196ad801fc1d82d
-
SHA256
c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339
-
SHA512
ee4ee70924bf2221de983527cbc3b6d10c2962d0f0f046efe523088bf51df0da0de0c5a8a56e8c6958167e32052201b789eeff2cc989d2333760e9549e0465cf
-
SSDEEP
6144:hzjAH9agPC3gLzeAyzhsv70s3QS8A7KQGNBZmUF4nHytzcc:xAdag1mAyzMxp8A7KQGNBZm3HOcc
Malware Config
Extracted
darkcomet
24
127.0.0.1:1604
172.162.22.200:1604
remaxcheckings.no-ip.biz:1604
DC_MUTEX-AT9WGLV
-
InstallPath
MSDCSC\remaxcheckings.exe
-
gencode
WN5Nr6wiGseC
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
remaxcheckings
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\MSDCSC\\remaxcheckings.exe" c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe -
Modifies firewall policy service 2 TTPs 9 IoCs
Processes:
iexplore.exeremaxcheckings.exeiexplore.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile iexplore.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" iexplore.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" remaxcheckings.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile remaxcheckings.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" remaxcheckings.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" iexplore.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile iexplore.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" iexplore.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" iexplore.exe -
Modifies security service 2 TTPs 3 IoCs
Processes:
iexplore.exeiexplore.exeremaxcheckings.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" iexplore.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" iexplore.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" remaxcheckings.exe -
Processes:
iexplore.exeiexplore.exeremaxcheckings.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" remaxcheckings.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" remaxcheckings.exe -
Disables RegEdit via registry modification 3 IoCs
Processes:
iexplore.exeiexplore.exeremaxcheckings.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" remaxcheckings.exe -
Disables Task Manager via registry modification
-
Executes dropped EXE 3 IoCs
Processes:
c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exeremaxcheckings.exeremaxcheckings.exepid process 3972 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe 628 remaxcheckings.exe 1800 remaxcheckings.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 3596 attrib.exe 1908 attrib.exe -
Processes:
resource yara_rule behavioral2/memory/3972-137-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/3972-139-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/3972-140-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/3972-141-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/3972-143-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/3972-156-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/1800-163-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe -
Processes:
remaxcheckings.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" remaxcheckings.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" remaxcheckings.exe -
Adds Run key to start application 2 TTPs 7 IoCs
Processes:
c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exec4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exeiexplore.exeremaxcheckings.exeremaxcheckings.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe" c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remaxcheckings = "C:\\MSDCSC\\remaxcheckings.exe" c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remaxcheckings = "C:\\MSDCSC\\remaxcheckings.exe" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe" remaxcheckings.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe" remaxcheckings.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remaxcheckings = "C:\\MSDCSC\\remaxcheckings.exe" remaxcheckings.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe" c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exeremaxcheckings.exedescription pid process target process PID 2180 set thread context of 4108 2180 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe iexplore.exe PID 2180 set thread context of 3972 2180 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe PID 628 set thread context of 3960 628 remaxcheckings.exe iexplore.exe PID 628 set thread context of 1800 628 remaxcheckings.exe remaxcheckings.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exeremaxcheckings.exepid process 2180 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe 2180 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe 628 remaxcheckings.exe 628 remaxcheckings.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 4108 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exeiexplore.exeiexplore.exedescription pid process Token: SeIncreaseQuotaPrivilege 3972 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: SeIncreaseQuotaPrivilege 4108 iexplore.exe Token: SeSecurityPrivilege 3972 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: SeSecurityPrivilege 4108 iexplore.exe Token: SeTakeOwnershipPrivilege 3972 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: SeTakeOwnershipPrivilege 4108 iexplore.exe Token: SeLoadDriverPrivilege 3972 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: SeLoadDriverPrivilege 4108 iexplore.exe Token: SeSystemProfilePrivilege 3972 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: SeSystemProfilePrivilege 4108 iexplore.exe Token: SeSystemtimePrivilege 3972 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: SeSystemtimePrivilege 4108 iexplore.exe Token: SeProfSingleProcessPrivilege 3972 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: SeProfSingleProcessPrivilege 4108 iexplore.exe Token: SeIncBasePriorityPrivilege 3972 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: SeIncBasePriorityPrivilege 4108 iexplore.exe Token: SeCreatePagefilePrivilege 3972 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: SeCreatePagefilePrivilege 4108 iexplore.exe Token: SeBackupPrivilege 3972 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: SeBackupPrivilege 4108 iexplore.exe Token: SeRestorePrivilege 3972 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: SeRestorePrivilege 4108 iexplore.exe Token: SeShutdownPrivilege 3972 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: SeShutdownPrivilege 4108 iexplore.exe Token: SeDebugPrivilege 4108 iexplore.exe Token: SeDebugPrivilege 3972 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: SeSystemEnvironmentPrivilege 4108 iexplore.exe Token: SeSystemEnvironmentPrivilege 3972 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: SeChangeNotifyPrivilege 4108 iexplore.exe Token: SeChangeNotifyPrivilege 3972 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: SeRemoteShutdownPrivilege 4108 iexplore.exe Token: SeRemoteShutdownPrivilege 3972 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: SeUndockPrivilege 4108 iexplore.exe Token: SeUndockPrivilege 3972 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: SeManageVolumePrivilege 4108 iexplore.exe Token: SeManageVolumePrivilege 3972 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: SeImpersonatePrivilege 4108 iexplore.exe Token: SeImpersonatePrivilege 3972 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: SeCreateGlobalPrivilege 4108 iexplore.exe Token: SeCreateGlobalPrivilege 3972 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: 33 4108 iexplore.exe Token: 33 3972 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: 34 4108 iexplore.exe Token: 34 3972 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: 35 4108 iexplore.exe Token: 35 3972 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: 36 4108 iexplore.exe Token: 36 3972 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe Token: SeIncreaseQuotaPrivilege 3960 iexplore.exe Token: SeSecurityPrivilege 3960 iexplore.exe Token: SeTakeOwnershipPrivilege 3960 iexplore.exe Token: SeLoadDriverPrivilege 3960 iexplore.exe Token: SeSystemProfilePrivilege 3960 iexplore.exe Token: SeSystemtimePrivilege 3960 iexplore.exe Token: SeProfSingleProcessPrivilege 3960 iexplore.exe Token: SeIncBasePriorityPrivilege 3960 iexplore.exe Token: SeCreatePagefilePrivilege 3960 iexplore.exe Token: SeBackupPrivilege 3960 iexplore.exe Token: SeRestorePrivilege 3960 iexplore.exe Token: SeShutdownPrivilege 3960 iexplore.exe Token: SeDebugPrivilege 3960 iexplore.exe Token: SeSystemEnvironmentPrivilege 3960 iexplore.exe Token: SeChangeNotifyPrivilege 3960 iexplore.exe Token: SeRemoteShutdownPrivilege 3960 iexplore.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
iexplore.exepid process 4108 iexplore.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.execmd.exenet.exeiexplore.exec4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exedescription pid process target process PID 2180 wrote to memory of 2516 2180 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe cmd.exe PID 2180 wrote to memory of 2516 2180 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe cmd.exe PID 2180 wrote to memory of 2516 2180 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe cmd.exe PID 2180 wrote to memory of 4108 2180 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe iexplore.exe PID 2180 wrote to memory of 4108 2180 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe iexplore.exe PID 2180 wrote to memory of 4108 2180 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe iexplore.exe PID 2180 wrote to memory of 4108 2180 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe iexplore.exe PID 2180 wrote to memory of 4108 2180 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe iexplore.exe PID 2180 wrote to memory of 4108 2180 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe iexplore.exe PID 2180 wrote to memory of 4108 2180 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe iexplore.exe PID 2180 wrote to memory of 4108 2180 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe iexplore.exe PID 2516 wrote to memory of 2080 2516 cmd.exe net.exe PID 2516 wrote to memory of 2080 2516 cmd.exe net.exe PID 2516 wrote to memory of 2080 2516 cmd.exe net.exe PID 2080 wrote to memory of 5020 2080 net.exe net1.exe PID 2080 wrote to memory of 5020 2080 net.exe net1.exe PID 2080 wrote to memory of 5020 2080 net.exe net1.exe PID 2180 wrote to memory of 3972 2180 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe PID 2180 wrote to memory of 3972 2180 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe PID 2180 wrote to memory of 3972 2180 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe PID 2180 wrote to memory of 3972 2180 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe PID 2180 wrote to memory of 3972 2180 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe PID 2180 wrote to memory of 3972 2180 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe PID 2180 wrote to memory of 3972 2180 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe PID 2180 wrote to memory of 3972 2180 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe PID 4108 wrote to memory of 4992 4108 iexplore.exe notepad.exe PID 4108 wrote to memory of 4992 4108 iexplore.exe notepad.exe PID 4108 wrote to memory of 4992 4108 iexplore.exe notepad.exe PID 4108 wrote to memory of 4992 4108 iexplore.exe notepad.exe PID 4108 wrote to memory of 4992 4108 iexplore.exe notepad.exe PID 4108 wrote to memory of 4992 4108 iexplore.exe notepad.exe PID 4108 wrote to memory of 4992 4108 iexplore.exe notepad.exe PID 4108 wrote to memory of 4992 4108 iexplore.exe notepad.exe PID 4108 wrote to memory of 4992 4108 iexplore.exe notepad.exe PID 4108 wrote to memory of 4992 4108 iexplore.exe notepad.exe PID 4108 wrote to memory of 4992 4108 iexplore.exe notepad.exe PID 4108 wrote to memory of 4992 4108 iexplore.exe notepad.exe PID 4108 wrote to memory of 4992 4108 iexplore.exe notepad.exe PID 4108 wrote to memory of 4992 4108 iexplore.exe notepad.exe PID 4108 wrote to memory of 4992 4108 iexplore.exe notepad.exe PID 4108 wrote to memory of 4992 4108 iexplore.exe notepad.exe PID 4108 wrote to memory of 4992 4108 iexplore.exe notepad.exe PID 4108 wrote to memory of 4992 4108 iexplore.exe notepad.exe PID 4108 wrote to memory of 4992 4108 iexplore.exe notepad.exe PID 4108 wrote to memory of 4992 4108 iexplore.exe notepad.exe PID 4108 wrote to memory of 4992 4108 iexplore.exe notepad.exe PID 4108 wrote to memory of 4992 4108 iexplore.exe notepad.exe PID 3972 wrote to memory of 4808 3972 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe cmd.exe PID 3972 wrote to memory of 4808 3972 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe cmd.exe PID 3972 wrote to memory of 4808 3972 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe cmd.exe PID 3972 wrote to memory of 3224 3972 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe cmd.exe PID 3972 wrote to memory of 3224 3972 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe cmd.exe PID 3972 wrote to memory of 3224 3972 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe cmd.exe PID 3972 wrote to memory of 3240 3972 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe notepad.exe PID 3972 wrote to memory of 3240 3972 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe notepad.exe PID 3972 wrote to memory of 3240 3972 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe notepad.exe PID 3972 wrote to memory of 3240 3972 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe notepad.exe PID 3972 wrote to memory of 3240 3972 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe notepad.exe PID 3972 wrote to memory of 3240 3972 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe notepad.exe PID 3972 wrote to memory of 3240 3972 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe notepad.exe PID 3972 wrote to memory of 3240 3972 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe notepad.exe PID 3972 wrote to memory of 3240 3972 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe notepad.exe PID 3972 wrote to memory of 3240 3972 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe notepad.exe PID 3972 wrote to memory of 3240 3972 c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe notepad.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
remaxcheckings.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion remaxcheckings.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern remaxcheckings.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" remaxcheckings.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1908 attrib.exe 3596 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe"C:\Users\Admin\AppData\Local\Temp\c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c net stop MpsSvc2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop MpsSvc3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc4⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
-
C:\Users\Admin\AppData\Local\Temp\c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exeC:\Users\Admin\AppData\Local\Temp\c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe" +s +h3⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exe" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
-
C:\MSDCSC\remaxcheckings.exe"C:\MSDCSC\remaxcheckings.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe/c net stop MpsSvc4⤵
-
C:\Windows\SysWOW64\net.exenet stop MpsSvc5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc6⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"4⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Suspicious use of AdjustPrivilegeToken
-
C:\MSDCSC\remaxcheckings.exeC:\MSDCSC\remaxcheckings.exe4⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- System policy modification
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSDCSC\remaxcheckings.exeFilesize
317KB
MD5178b94a462503845831cd0a6c3e3b500
SHA199510e9b7abbfff7cc4097e51196ad801fc1d82d
SHA256c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339
SHA512ee4ee70924bf2221de983527cbc3b6d10c2962d0f0f046efe523088bf51df0da0de0c5a8a56e8c6958167e32052201b789eeff2cc989d2333760e9549e0465cf
-
C:\MSDCSC\remaxcheckings.exeFilesize
317KB
MD5178b94a462503845831cd0a6c3e3b500
SHA199510e9b7abbfff7cc4097e51196ad801fc1d82d
SHA256c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339
SHA512ee4ee70924bf2221de983527cbc3b6d10c2962d0f0f046efe523088bf51df0da0de0c5a8a56e8c6958167e32052201b789eeff2cc989d2333760e9549e0465cf
-
C:\MSDCSC\remaxcheckings.exeFilesize
317KB
MD5178b94a462503845831cd0a6c3e3b500
SHA199510e9b7abbfff7cc4097e51196ad801fc1d82d
SHA256c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339
SHA512ee4ee70924bf2221de983527cbc3b6d10c2962d0f0f046efe523088bf51df0da0de0c5a8a56e8c6958167e32052201b789eeff2cc989d2333760e9549e0465cf
-
C:\Users\Admin\AppData\Local\Temp\c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339.exeFilesize
317KB
MD5178b94a462503845831cd0a6c3e3b500
SHA199510e9b7abbfff7cc4097e51196ad801fc1d82d
SHA256c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339
SHA512ee4ee70924bf2221de983527cbc3b6d10c2962d0f0f046efe523088bf51df0da0de0c5a8a56e8c6958167e32052201b789eeff2cc989d2333760e9549e0465cf
-
C:\Users\Admin\AppData\Roaming\InstallDir\help.exeFilesize
317KB
MD5178b94a462503845831cd0a6c3e3b500
SHA199510e9b7abbfff7cc4097e51196ad801fc1d82d
SHA256c4211660f42c1a72369c64c614ae994836bc501040058521cfc07383cadae339
SHA512ee4ee70924bf2221de983527cbc3b6d10c2962d0f0f046efe523088bf51df0da0de0c5a8a56e8c6958167e32052201b789eeff2cc989d2333760e9549e0465cf
-
memory/380-155-0x0000000000000000-mapping.dmp
-
memory/628-149-0x0000000000000000-mapping.dmp
-
memory/1800-157-0x0000000000000000-mapping.dmp
-
memory/1800-163-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1908-148-0x0000000000000000-mapping.dmp
-
memory/2080-133-0x0000000000000000-mapping.dmp
-
memory/2180-134-0x00000000021F0000-0x00000000021F4000-memory.dmpFilesize
16KB
-
memory/2516-132-0x0000000000000000-mapping.dmp
-
memory/2868-154-0x0000000000000000-mapping.dmp
-
memory/3224-145-0x0000000000000000-mapping.dmp
-
memory/3240-146-0x0000000000000000-mapping.dmp
-
memory/3596-147-0x0000000000000000-mapping.dmp
-
memory/3932-153-0x0000000000000000-mapping.dmp
-
memory/3972-143-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3972-141-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3972-140-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3972-139-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3972-156-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3972-137-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3972-136-0x0000000000000000-mapping.dmp
-
memory/4808-144-0x0000000000000000-mapping.dmp
-
memory/4992-142-0x0000000000000000-mapping.dmp
-
memory/5020-135-0x0000000000000000-mapping.dmp