Analysis
-
max time kernel
150s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 11:04
Static task
static1
Behavioral task
behavioral1
Sample
f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe
Resource
win7-20220812-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe
-
Size
230KB
-
MD5
af24764584267de44e98dfde976b0191
-
SHA1
4fd84c0c2cbe6affc2e09d55d897889664a71da6
-
SHA256
f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa
-
SHA512
45cd5a58cdbcc9643043378512a564561bda7e2f0403bc710e7de1a35f5b1a4abd2ed4dd3a2ee0a6c7787a297198d87ca8ef843b54c2dbf44c37f1fbce742987
-
SSDEEP
3072:lcb/0w4wde92SXNDuq6SNtPcXHJxmjNcgmOlq07FFnJYIt0DEgv9OlnPJ2JRDXeH:ls/BfUiq64hNcgb33n2IsGnP0JJe
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\WINDÎWS\\åõðlîrår.exe" åõðlîrår.exe -
Executes dropped EXE 2 IoCs
pid Process 1632 åõðlîrår.exe 1384 åõðlîrår.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Loads dropped DLL 3 IoCs
pid Process 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1632 åõðlîrår.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\C:\WINDÎWS\åõðlîrår.exe = "C:\\WINDÎWS\\åõðlîrår.exe" åõðlîrår.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1080 set thread context of 1572 1080 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 28 PID 1632 set thread context of 1384 1632 åõðlîrår.exe 37 -
Kills process with taskkill 1 IoCs
pid Process 1492 taskkill.exe -
Modifies registry class 20 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe Token: SeDebugPrivilege 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe Token: SeDebugPrivilege 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe Token: SeDebugPrivilege 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe Token: SeDebugPrivilege 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe Token: SeDebugPrivilege 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe Token: SeDebugPrivilege 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe Token: SeDebugPrivilege 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe Token: SeDebugPrivilege 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe Token: SeDebugPrivilege 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe Token: SeDebugPrivilege 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe Token: SeDebugPrivilege 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe Token: SeDebugPrivilege 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe Token: SeDebugPrivilege 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe Token: SeDebugPrivilege 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe Token: SeDebugPrivilege 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe Token: SeDebugPrivilege 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe Token: SeDebugPrivilege 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe Token: SeDebugPrivilege 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe Token: SeDebugPrivilege 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe Token: SeDebugPrivilege 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe Token: SeDebugPrivilege 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe Token: SeDebugPrivilege 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe Token: SeDebugPrivilege 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe Token: SeDebugPrivilege 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe Token: SeDebugPrivilege 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe Token: SeDebugPrivilege 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe Token: SeShutdownPrivilege 1252 explorer.exe Token: SeShutdownPrivilege 1252 explorer.exe Token: SeShutdownPrivilege 1252 explorer.exe Token: SeShutdownPrivilege 1252 explorer.exe Token: SeShutdownPrivilege 1252 explorer.exe Token: SeShutdownPrivilege 1252 explorer.exe Token: SeShutdownPrivilege 1252 explorer.exe Token: SeShutdownPrivilege 1252 explorer.exe Token: SeShutdownPrivilege 1252 explorer.exe Token: SeShutdownPrivilege 1252 explorer.exe Token: 33 1564 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1564 AUDIODG.EXE Token: SeDebugPrivilege 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe Token: SeDebugPrivilege 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe Token: SeDebugPrivilege 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe Token: SeDebugPrivilege 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe Token: SeDebugPrivilege 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe Token: SeDebugPrivilege 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe Token: 33 1564 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1564 AUDIODG.EXE Token: SeDebugPrivilege 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe Token: SeDebugPrivilege 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe Token: SeDebugPrivilege 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe Token: SeShutdownPrivilege 1280 explorer.exe Token: SeShutdownPrivilege 1280 explorer.exe Token: SeShutdownPrivilege 1280 explorer.exe Token: SeShutdownPrivilege 1280 explorer.exe Token: SeShutdownPrivilege 1280 explorer.exe Token: SeShutdownPrivilege 1280 explorer.exe Token: SeShutdownPrivilege 1280 explorer.exe Token: SeDebugPrivilege 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe Token: SeDebugPrivilege 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe Token: SeDebugPrivilege 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe Token: SeDebugPrivilege 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe Token: SeDebugPrivilege 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe Token: SeDebugPrivilege 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe Token: SeDebugPrivilege 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe -
Suspicious use of FindShellTrayWindow 17 IoCs
pid Process 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1280 explorer.exe 1280 explorer.exe 1280 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe -
Suspicious use of SendNotifyMessage 16 IoCs
pid Process 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe 1816 explorer.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1080 wrote to memory of 1572 1080 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 28 PID 1080 wrote to memory of 1572 1080 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 28 PID 1080 wrote to memory of 1572 1080 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 28 PID 1080 wrote to memory of 1572 1080 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 28 PID 1080 wrote to memory of 1572 1080 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 28 PID 1080 wrote to memory of 1572 1080 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 28 PID 1080 wrote to memory of 1572 1080 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 28 PID 1080 wrote to memory of 1572 1080 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 28 PID 1080 wrote to memory of 1572 1080 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 28 PID 1080 wrote to memory of 1572 1080 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 28 PID 1080 wrote to memory of 1572 1080 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 28 PID 1080 wrote to memory of 1572 1080 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 28 PID 1572 wrote to memory of 1632 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 35 PID 1572 wrote to memory of 1632 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 35 PID 1572 wrote to memory of 1632 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 35 PID 1572 wrote to memory of 1632 1572 f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe 35 PID 1632 wrote to memory of 1384 1632 åõðlîrår.exe 37 PID 1632 wrote to memory of 1384 1632 åõðlîrår.exe 37 PID 1632 wrote to memory of 1384 1632 åõðlîrår.exe 37 PID 1632 wrote to memory of 1384 1632 åõðlîrår.exe 37 PID 1632 wrote to memory of 1384 1632 åõðlîrår.exe 37 PID 1632 wrote to memory of 1384 1632 åõðlîrår.exe 37 PID 1632 wrote to memory of 1384 1632 åõðlîrår.exe 37 PID 1632 wrote to memory of 1384 1632 åõðlîrår.exe 37 PID 1632 wrote to memory of 1384 1632 åõðlîrår.exe 37 PID 1632 wrote to memory of 1384 1632 åõðlîrår.exe 37 PID 1632 wrote to memory of 1384 1632 åõðlîrår.exe 37 PID 1632 wrote to memory of 1384 1632 åõðlîrår.exe 37 PID 1384 wrote to memory of 1492 1384 åõðlîrår.exe 38 PID 1384 wrote to memory of 1492 1384 åõðlîrår.exe 38 PID 1384 wrote to memory of 1492 1384 åõðlîrår.exe 38 PID 1384 wrote to memory of 1492 1384 åõðlîrår.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe"C:\Users\Admin\AppData\Local\Temp\f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe"C:\Users\Admin\AppData\Local\Temp\f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\WINDÎWS\åõðlîrår.exeC:\WINDÎWS\åõðlîrår.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\WINDÎWS\åõðlîrår.exeC:\WINDÎWS\åõðlîrår.exe4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM explorer.exe5⤵
- Kills process with taskkill
PID:1492
-
-
-
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1252
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5a41⤵
- Suspicious use of AdjustPrivilegeToken
PID:1564
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1280
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1816
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
PID:988
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1912
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
230KB
MD5af24764584267de44e98dfde976b0191
SHA14fd84c0c2cbe6affc2e09d55d897889664a71da6
SHA256f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa
SHA51245cd5a58cdbcc9643043378512a564561bda7e2f0403bc710e7de1a35f5b1a4abd2ed4dd3a2ee0a6c7787a297198d87ca8ef843b54c2dbf44c37f1fbce742987
-
Filesize
230KB
MD5af24764584267de44e98dfde976b0191
SHA14fd84c0c2cbe6affc2e09d55d897889664a71da6
SHA256f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa
SHA51245cd5a58cdbcc9643043378512a564561bda7e2f0403bc710e7de1a35f5b1a4abd2ed4dd3a2ee0a6c7787a297198d87ca8ef843b54c2dbf44c37f1fbce742987
-
Filesize
230KB
MD5af24764584267de44e98dfde976b0191
SHA14fd84c0c2cbe6affc2e09d55d897889664a71da6
SHA256f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa
SHA51245cd5a58cdbcc9643043378512a564561bda7e2f0403bc710e7de1a35f5b1a4abd2ed4dd3a2ee0a6c7787a297198d87ca8ef843b54c2dbf44c37f1fbce742987
-
Filesize
230KB
MD5af24764584267de44e98dfde976b0191
SHA14fd84c0c2cbe6affc2e09d55d897889664a71da6
SHA256f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa
SHA51245cd5a58cdbcc9643043378512a564561bda7e2f0403bc710e7de1a35f5b1a4abd2ed4dd3a2ee0a6c7787a297198d87ca8ef843b54c2dbf44c37f1fbce742987
-
Filesize
230KB
MD5af24764584267de44e98dfde976b0191
SHA14fd84c0c2cbe6affc2e09d55d897889664a71da6
SHA256f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa
SHA51245cd5a58cdbcc9643043378512a564561bda7e2f0403bc710e7de1a35f5b1a4abd2ed4dd3a2ee0a6c7787a297198d87ca8ef843b54c2dbf44c37f1fbce742987
-
Filesize
230KB
MD5af24764584267de44e98dfde976b0191
SHA14fd84c0c2cbe6affc2e09d55d897889664a71da6
SHA256f72037a07dc05e19826d9354a8b11e6006a6a545604fc134bf615908fdf47dfa
SHA51245cd5a58cdbcc9643043378512a564561bda7e2f0403bc710e7de1a35f5b1a4abd2ed4dd3a2ee0a6c7787a297198d87ca8ef843b54c2dbf44c37f1fbce742987