Analysis
-
max time kernel
153s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05/12/2022, 07:54
Static task
static1
Behavioral task
behavioral1
Sample
3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe
Resource
win7-20220812-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe
-
Size
157KB
-
MD5
8508ce39832ac5ec0bb510b35465629e
-
SHA1
74a386a774e37a444223486d826ba62db9fd71f1
-
SHA256
3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a
-
SHA512
d8c61be79ad5788274c27ce7b649db5b15b8d8cec1f0624d2eaf4dddd389738280f25808d91fe0c41cbb4544087f632e48db8f187eba285e18105304a0df1414
-
SSDEEP
3072:MkOYL0Db5OJcaZ3KNQyxCDSe6i3tvk6T/+Qcdym+INp1rkj:MCL0Db5pa0QXDSejj+tCINp1Aj
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\WINDÎWS\\åõðlîrår.exe" åõðlîrår.exe -
Executes dropped EXE 2 IoCs
pid Process 1584 åõðlîrår.exe 1540 åõðlîrår.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Loads dropped DLL 2 IoCs
pid Process 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\C:\WINDÎWS\åõðlîrår.exe = "C:\\WINDÎWS\\åõðlîrår.exe" åõðlîrår.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1944 set thread context of 1196 1944 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 27 PID 1584 set thread context of 1540 1584 åõðlîrår.exe 35 -
Kills process with taskkill 1 IoCs
pid Process 520 taskkill.exe -
Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe Token: SeDebugPrivilege 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe Token: SeDebugPrivilege 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe Token: SeDebugPrivilege 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe Token: SeDebugPrivilege 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe Token: SeDebugPrivilege 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe Token: SeDebugPrivilege 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe Token: SeDebugPrivilege 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe Token: SeDebugPrivilege 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe Token: SeShutdownPrivilege 1148 explorer.exe Token: SeShutdownPrivilege 1148 explorer.exe Token: SeShutdownPrivilege 1148 explorer.exe Token: SeShutdownPrivilege 1148 explorer.exe Token: SeShutdownPrivilege 1148 explorer.exe Token: SeShutdownPrivilege 1148 explorer.exe Token: SeShutdownPrivilege 1148 explorer.exe Token: SeShutdownPrivilege 1148 explorer.exe Token: SeShutdownPrivilege 1148 explorer.exe Token: SeShutdownPrivilege 1148 explorer.exe Token: 33 524 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 524 AUDIODG.EXE Token: 33 524 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 524 AUDIODG.EXE Token: SeDebugPrivilege 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe Token: SeDebugPrivilege 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe Token: SeDebugPrivilege 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe Token: SeDebugPrivilege 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe Token: SeDebugPrivilege 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe Token: SeDebugPrivilege 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe Token: SeDebugPrivilege 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe Token: SeDebugPrivilege 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe Token: SeDebugPrivilege 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe Token: SeShutdownPrivilege 1616 explorer.exe Token: SeShutdownPrivilege 1616 explorer.exe Token: SeShutdownPrivilege 1616 explorer.exe Token: SeShutdownPrivilege 1616 explorer.exe Token: SeShutdownPrivilege 1616 explorer.exe Token: SeShutdownPrivilege 1616 explorer.exe Token: SeShutdownPrivilege 1616 explorer.exe Token: SeDebugPrivilege 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe Token: SeDebugPrivilege 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe Token: SeDebugPrivilege 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe Token: SeDebugPrivilege 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe Token: SeDebugPrivilege 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe Token: SeDebugPrivilege 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe Token: SeDebugPrivilege 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe Token: SeDebugPrivilege 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe Token: SeDebugPrivilege 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe Token: SeShutdownPrivilege 1472 explorer.exe Token: SeShutdownPrivilege 1472 explorer.exe Token: SeShutdownPrivilege 1472 explorer.exe Token: SeShutdownPrivilege 1472 explorer.exe Token: SeShutdownPrivilege 1472 explorer.exe Token: SeShutdownPrivilege 1472 explorer.exe Token: SeDebugPrivilege 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe Token: SeDebugPrivilege 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe Token: SeDebugPrivilege 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe Token: SeDebugPrivilege 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe Token: SeDebugPrivilege 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe Token: SeDebugPrivilege 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe Token: SeDebugPrivilege 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe Token: SeDebugPrivilege 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe Token: SeDebugPrivilege 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe Token: SeShutdownPrivilege 1556 explorer.exe -
Suspicious use of FindShellTrayWindow 16 IoCs
pid Process 1148 explorer.exe 1148 explorer.exe 1148 explorer.exe 1148 explorer.exe 1148 explorer.exe 1148 explorer.exe 1148 explorer.exe 1616 explorer.exe 1616 explorer.exe 1616 explorer.exe 1616 explorer.exe 1616 explorer.exe 1616 explorer.exe 1616 explorer.exe 1472 explorer.exe 1472 explorer.exe -
Suspicious use of SendNotifyMessage 14 IoCs
pid Process 1148 explorer.exe 1148 explorer.exe 1148 explorer.exe 1616 explorer.exe 1616 explorer.exe 1616 explorer.exe 1616 explorer.exe 1616 explorer.exe 1616 explorer.exe 1472 explorer.exe 1472 explorer.exe 1472 explorer.exe 1472 explorer.exe 1472 explorer.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1944 wrote to memory of 1196 1944 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 27 PID 1944 wrote to memory of 1196 1944 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 27 PID 1944 wrote to memory of 1196 1944 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 27 PID 1944 wrote to memory of 1196 1944 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 27 PID 1944 wrote to memory of 1196 1944 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 27 PID 1944 wrote to memory of 1196 1944 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 27 PID 1944 wrote to memory of 1196 1944 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 27 PID 1944 wrote to memory of 1196 1944 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 27 PID 1944 wrote to memory of 1196 1944 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 27 PID 1944 wrote to memory of 1196 1944 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 27 PID 1944 wrote to memory of 1196 1944 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 27 PID 1944 wrote to memory of 1196 1944 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 27 PID 1196 wrote to memory of 1584 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 34 PID 1196 wrote to memory of 1584 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 34 PID 1196 wrote to memory of 1584 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 34 PID 1196 wrote to memory of 1584 1196 3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe 34 PID 1584 wrote to memory of 1540 1584 åõðlîrår.exe 35 PID 1584 wrote to memory of 1540 1584 åõðlîrår.exe 35 PID 1584 wrote to memory of 1540 1584 åõðlîrår.exe 35 PID 1584 wrote to memory of 1540 1584 åõðlîrår.exe 35 PID 1584 wrote to memory of 1540 1584 åõðlîrår.exe 35 PID 1584 wrote to memory of 1540 1584 åõðlîrår.exe 35 PID 1584 wrote to memory of 1540 1584 åõðlîrår.exe 35 PID 1584 wrote to memory of 1540 1584 åõðlîrår.exe 35 PID 1584 wrote to memory of 1540 1584 åõðlîrår.exe 35 PID 1584 wrote to memory of 1540 1584 åõðlîrår.exe 35 PID 1584 wrote to memory of 1540 1584 åõðlîrår.exe 35 PID 1584 wrote to memory of 1540 1584 åõðlîrår.exe 35 PID 1540 wrote to memory of 520 1540 åõðlîrår.exe 36 PID 1540 wrote to memory of 520 1540 åõðlîrår.exe 36 PID 1540 wrote to memory of 520 1540 åõðlîrår.exe 36 PID 1540 wrote to memory of 520 1540 åõðlîrår.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe"C:\Users\Admin\AppData\Local\Temp\3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe"C:\Users\Admin\AppData\Local\Temp\3bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\WINDÎWS\åõðlîrår.exeC:\WINDÎWS\åõðlîrår.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\WINDÎWS\åõðlîrår.exeC:\WINDÎWS\åõðlîrår.exe4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM explorer.exe5⤵
- Kills process with taskkill
PID:520
-
-
-
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1148
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5481⤵
- Suspicious use of AdjustPrivilegeToken
PID:524
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1616
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1472
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Suspicious use of AdjustPrivilegeToken
PID:1556
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
157KB
MD58508ce39832ac5ec0bb510b35465629e
SHA174a386a774e37a444223486d826ba62db9fd71f1
SHA2563bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a
SHA512d8c61be79ad5788274c27ce7b649db5b15b8d8cec1f0624d2eaf4dddd389738280f25808d91fe0c41cbb4544087f632e48db8f187eba285e18105304a0df1414
-
Filesize
157KB
MD58508ce39832ac5ec0bb510b35465629e
SHA174a386a774e37a444223486d826ba62db9fd71f1
SHA2563bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a
SHA512d8c61be79ad5788274c27ce7b649db5b15b8d8cec1f0624d2eaf4dddd389738280f25808d91fe0c41cbb4544087f632e48db8f187eba285e18105304a0df1414
-
Filesize
157KB
MD58508ce39832ac5ec0bb510b35465629e
SHA174a386a774e37a444223486d826ba62db9fd71f1
SHA2563bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a
SHA512d8c61be79ad5788274c27ce7b649db5b15b8d8cec1f0624d2eaf4dddd389738280f25808d91fe0c41cbb4544087f632e48db8f187eba285e18105304a0df1414
-
Filesize
157KB
MD58508ce39832ac5ec0bb510b35465629e
SHA174a386a774e37a444223486d826ba62db9fd71f1
SHA2563bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a
SHA512d8c61be79ad5788274c27ce7b649db5b15b8d8cec1f0624d2eaf4dddd389738280f25808d91fe0c41cbb4544087f632e48db8f187eba285e18105304a0df1414
-
Filesize
157KB
MD58508ce39832ac5ec0bb510b35465629e
SHA174a386a774e37a444223486d826ba62db9fd71f1
SHA2563bf0a484b0d42af707c586ef6138bd79dec48d198ff3b76237b5586cfd64e70a
SHA512d8c61be79ad5788274c27ce7b649db5b15b8d8cec1f0624d2eaf4dddd389738280f25808d91fe0c41cbb4544087f632e48db8f187eba285e18105304a0df1414