Analysis
- max time kernel
150s - max time network
121s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
17/12/2022, 02:56
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
21 signatures
150 seconds
General
- Target file.exe
- Size 213KB
- Sample221217-de16caga97
- SHA256 4ec544ab5dea3f6392db3d122ef23becda3ed99d6468cd9d135a0f0f0fc56458
- MD5 73363404936254f3431962a1e8dc98db
- SHA1 b431e0d560aa9c95a0986d92fe4869444203e40b
- SHA512 7fc237b4359de30b0339994ed20bd8f0c5692f8920e2e57df1ed5ea0e4fa573c27bffc9cb7f82c1e867d22f9561af92f12e8ace39d22380e2149b2f7c06930fa
- SSDEEP 3072:0ORLjLAx+s6aTRVV2FFXaT+niviHCYoULszrRA40zwUzQRKF+:VVLAx+oV2ST+nPQUgztA40M2b
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
danabot
C2
-
49.0.50.0:57
-
51.0.52.0:0
-
53.0.54.0:1200
-
55.0.56.0:65535
Attributes
-
type
loader
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/1476-133-0x00000000001F0000-0x00000000001F9000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 3 IoCs
pid Process 4020 ED24.exe 3844 Eewfhetyyyrtfpd.exe 752 22FA.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation ED24.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2492 Process not Found 1500 chrome.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4020 set thread context of 1504 4020 ED24.exe 89 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 4 IoCs
pid pid_target Process procid_target 644 1504 WerFault.exe 89 2188 752 WerFault.exe 102 4760 1500 WerFault.exe 90 3204 4020 WerFault.exe 87 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe - Checks processor information in registry 2 TTPs 49 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ED24.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ED24.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 ED24.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier ED24.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor ED24.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet ED24.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ED24.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information ED24.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 ED24.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor ED24.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information ED24.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 ED24.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz ED24.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data ED24.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision ED24.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status ED24.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString ED24.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status ED24.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 ED24.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision ED24.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier ED24.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision ED24.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier ED24.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier ED24.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ED24.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision rundll32.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1476 file.exe 1476 file.exe 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2492 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1476 file.exe - Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeDebugPrivilege 3844 Eewfhetyyyrtfpd.exe Token: SeShutdownPrivilege 2492 Process not Found Token: SeCreatePagefilePrivilege 2492 Process not Found Token: SeDebugPrivilege 2492 Process not Found Token: SeShutdownPrivilege 2492 Process not Found Token: SeCreatePagefilePrivilege 2492 Process not Found Token: SeShutdownPrivilege 2492 Process not Found Token: SeCreatePagefilePrivilege 2492 Process not Found Token: SeShutdownPrivilege 2492 Process not Found Token: SeCreatePagefilePrivilege 2492 Process not Found Token: SeShutdownPrivilege 2492 Process not Found Token: SeCreatePagefilePrivilege 2492 Process not Found Token: SeShutdownPrivilege 2492 Process not Found Token: SeCreatePagefilePrivilege 2492 Process not Found Token: SeShutdownPrivilege 2492 Process not Found Token: SeCreatePagefilePrivilege 2492 Process not Found Token: SeShutdownPrivilege 2492 Process not Found Token: SeCreatePagefilePrivilege 2492 Process not Found Token: SeShutdownPrivilege 2492 Process not Found Token: SeCreatePagefilePrivilege 2492 Process not Found Token: SeShutdownPrivilege 2492 Process not Found Token: SeCreatePagefilePrivilege 2492 Process not Found Token: SeShutdownPrivilege 2492 Process not Found Token: SeCreatePagefilePrivilege 2492 Process not Found Token: SeShutdownPrivilege 2492 Process not Found Token: SeCreatePagefilePrivilege 2492 Process not Found Token: SeShutdownPrivilege 2492 Process not Found Token: SeCreatePagefilePrivilege 2492 Process not Found - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3844 Eewfhetyyyrtfpd.exe 1500 chrome.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3844 Eewfhetyyyrtfpd.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1500 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2492 wrote to memory of 4020 2492 Process not Found 87 PID 2492 wrote to memory of 4020 2492 Process not Found 87 PID 2492 wrote to memory of 4020 2492 Process not Found 87 PID 4020 wrote to memory of 3844 4020 ED24.exe 88 PID 4020 wrote to memory of 3844 4020 ED24.exe 88 PID 4020 wrote to memory of 3844 4020 ED24.exe 88 PID 4020 wrote to memory of 1504 4020 ED24.exe 89 PID 4020 wrote to memory of 1504 4020 ED24.exe 89 PID 4020 wrote to memory of 1504 4020 ED24.exe 89 PID 4020 wrote to memory of 1504 4020 ED24.exe 89 PID 2492 wrote to memory of 1500 2492 Process not Found 90 PID 2492 wrote to memory of 1500 2492 Process not Found 90 PID 1500 wrote to memory of 3176 1500 chrome.exe 91 PID 1500 wrote to memory of 3176 1500 chrome.exe 91 PID 1500 wrote to memory of 1268 1500 chrome.exe 97 PID 1500 wrote to memory of 1268 1500 chrome.exe 97 PID 1500 wrote to memory of 1268 1500 chrome.exe 97 PID 1500 wrote to memory of 1268 1500 chrome.exe 97 PID 1500 wrote to memory of 1268 1500 chrome.exe 97 PID 1500 wrote to memory of 1268 1500 chrome.exe 97 PID 1500 wrote to memory of 1268 1500 chrome.exe 97 PID 1500 wrote to memory of 1268 1500 chrome.exe 97 PID 1500 wrote to memory of 1268 1500 chrome.exe 97 PID 1500 wrote to memory of 1268 1500 chrome.exe 97 PID 1500 wrote to memory of 1268 1500 chrome.exe 97 PID 1500 wrote to memory of 1268 1500 chrome.exe 97 PID 1500 wrote to memory of 1268 1500 chrome.exe 97 PID 1500 wrote to memory of 1268 1500 chrome.exe 97 PID 1500 wrote to memory of 1268 1500 chrome.exe 97 PID 1500 wrote to memory of 1268 1500 chrome.exe 97 PID 1500 wrote to memory of 1268 1500 chrome.exe 97 PID 1500 wrote to memory of 1268 1500 chrome.exe 97 PID 1500 wrote to memory of 1268 1500 chrome.exe 97 PID 1500 wrote to memory of 1268 1500 chrome.exe 97 PID 1500 wrote to memory of 1268 1500 chrome.exe 97 PID 1500 wrote to memory of 1268 1500 chrome.exe 97 PID 1500 wrote to memory of 1268 1500 chrome.exe 97 PID 1500 wrote to memory of 1268 1500 chrome.exe 97 PID 1500 wrote to memory of 1268 1500 chrome.exe 97 PID 1500 wrote to memory of 1268 1500 chrome.exe 97 PID 1500 wrote to memory of 1268 1500 chrome.exe 97 PID 1500 wrote to memory of 1268 1500 chrome.exe 97 PID 1500 wrote to memory of 1268 1500 chrome.exe 97 PID 1500 wrote to memory of 1268 1500 chrome.exe 97 PID 1500 wrote to memory of 1268 1500 chrome.exe 97 PID 1500 wrote to memory of 1268 1500 chrome.exe 97 PID 1500 wrote to memory of 1268 1500 chrome.exe 97 PID 1500 wrote to memory of 1268 1500 chrome.exe 97 PID 1500 wrote to memory of 1268 1500 chrome.exe 97 PID 1500 wrote to memory of 1268 1500 chrome.exe 97 PID 1500 wrote to memory of 1268 1500 chrome.exe 97 PID 1500 wrote to memory of 1268 1500 chrome.exe 97 PID 1500 wrote to memory of 1268 1500 chrome.exe 97 PID 1500 wrote to memory of 1268 1500 chrome.exe 97 PID 1500 wrote to memory of 536 1500 chrome.exe 98 PID 1500 wrote to memory of 536 1500 chrome.exe 98 PID 1500 wrote to memory of 4680 1500 chrome.exe 100 PID 1500 wrote to memory of 4680 1500 chrome.exe 100 PID 1500 wrote to memory of 4680 1500 chrome.exe 100 PID 1500 wrote to memory of 4680 1500 chrome.exe 100 PID 1500 wrote to memory of 4680 1500 chrome.exe 100 PID 1500 wrote to memory of 4680 1500 chrome.exe 100 PID 1500 wrote to memory of 4680 1500 chrome.exe 100 PID 1500 wrote to memory of 4680 1500 chrome.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1476
-
C:\Users\Admin\AppData\Local\Temp\ED24.exeC:\Users\Admin\AppData\Local\Temp\ED24.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\Eewfhetyyyrtfpd.exe"C:\Users\Admin\AppData\Local\Temp\Eewfhetyyyrtfpd.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3844
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Checks processor information in registry
PID:1504 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 13003⤵
- Program crash
PID:644
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 11562⤵
- Program crash
PID:3204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check --silent-launch --disable-backgrounding-occluded-windows --disable-background-timer-throttling --ran-launcher --profile-directory="Default"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa44d44f50,0x7ffa44d44f60,0x7ffa44d44f702⤵PID:3176
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1616,13648098956956468903,5471617841761852866,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1656 /prefetch:22⤵PID:1268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1616,13648098956956468903,5471617841761852866,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2008 /prefetch:82⤵PID:536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1616,13648098956956468903,5471617841761852866,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2276 /prefetch:82⤵PID:4680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13648098956956468903,5471617841761852866,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3548 /prefetch:82⤵PID:2244
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1500 -s 36122⤵
- Program crash
PID:4760
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1504 -ip 15041⤵PID:1116
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\22FA.exeC:\Users\Admin\AppData\Local\Temp\22FA.exe1⤵
- Executes dropped EXE
PID:752 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 752 -s 2682⤵
- Program crash
PID:2188
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 752 -ip 7521⤵PID:4344
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 420 -p 1500 -ip 15001⤵PID:2672
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4020 -ip 40201⤵PID:3928
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\22FA.exe
- Size 1.4MB
- SHA256 bf52f8def7e804055268e9f17bd8fc91edea479e7d719f9335035bfc71ef21bd
- MD5 1ea8aaf997bbebac62ec8031d9304100
- SHA1 e8b7a1aeae449fc28310c8244bc6940d94adabb6
- SHA512 04217d1f733e56ce32aa96758941ebd6171242f7ff3f7ed8694247aae61a9b6d1b2fa1d0477612acda5a60a32f47af690dce7fdc4c388d337ddf5fce12335b96
- SSDEEP 24576:dYwKO4kHg7JLZnTXuN+dgYermPVPFDoupERWFg3Xm4rGk5awdr/JBNUSj:dYwzBi0pdksDhGBwd1Rj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\22FA.exe
- Size 1.4MB
- SHA256 bf52f8def7e804055268e9f17bd8fc91edea479e7d719f9335035bfc71ef21bd
- MD5 1ea8aaf997bbebac62ec8031d9304100
- SHA1 e8b7a1aeae449fc28310c8244bc6940d94adabb6
- SHA512 04217d1f733e56ce32aa96758941ebd6171242f7ff3f7ed8694247aae61a9b6d1b2fa1d0477612acda5a60a32f47af690dce7fdc4c388d337ddf5fce12335b96
- SSDEEP 24576:dYwKO4kHg7JLZnTXuN+dgYermPVPFDoupERWFg3Xm4rGk5awdr/JBNUSj:dYwzBi0pdksDhGBwd1Rj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\ED24.exe
- Size 5.6MB
- SHA256 358a2fc8a8e93409e1e99de29f45b604438786c346ed5a9c4b378bc58e969a2f
- MD5 c5ee3b82f85113612ae8611a7788d71a
- SHA1 49d4c7af96eb725dcee9470cc12857533a7109d1
- SHA512 42cc9fe9a66d5984705d186fd18351a5cc8ee8ce5a18195aa477ab2e0ac48ffd77fe17e1a4fad875a934f67fc35b2f50f1a461a34b09cc496e07328681565d0f
- SSDEEP 98304:FHAuuogwtbn/I7nrwO74xriT8dP+tLioOyyuaHSa4RHErVuE2sDlTBZf:Fg+gIbgjsOyN+1iWyuaHF/pF2MlHf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\ED24.exe
- Size 5.6MB
- SHA256 358a2fc8a8e93409e1e99de29f45b604438786c346ed5a9c4b378bc58e969a2f
- MD5 c5ee3b82f85113612ae8611a7788d71a
- SHA1 49d4c7af96eb725dcee9470cc12857533a7109d1
- SHA512 42cc9fe9a66d5984705d186fd18351a5cc8ee8ce5a18195aa477ab2e0ac48ffd77fe17e1a4fad875a934f67fc35b2f50f1a461a34b09cc496e07328681565d0f
- SSDEEP 98304:FHAuuogwtbn/I7nrwO74xriT8dP+tLioOyyuaHSa4RHErVuE2sDlTBZf:Fg+gIbgjsOyN+1iWyuaHF/pF2MlHf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Eewfhetyyyrtfpd.exe
- Size 2.4MB
- SHA256 794be0b98421623959185a060092be697fa695a73268ab8a46c7ab12655df62b
- MD5 e7053575255acd45d4213d866123dbaf
- SHA1 95fa5a2178eb1dd6a445685b3ab2905c11045d0c
- SHA512 e934ae1bb4cef1e71cf1905655bcb5979f8f70944817de88204d8bebf3a36300b7b282d0bd711cc41ae5e69f91b6e14576b7a8098ee283d29bdb451d98238401
- SSDEEP 49152:SoLSnQJ3JMdMMmCnrGxclU/2/vptXkHrLCz3Ra8Zynlo/9s:So2n+ahixf2HptXkvQ3Q+ynyFs
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Eewfhetyyyrtfpd.exe
- Size 2.4MB
- SHA256 794be0b98421623959185a060092be697fa695a73268ab8a46c7ab12655df62b
- MD5 e7053575255acd45d4213d866123dbaf
- SHA1 95fa5a2178eb1dd6a445685b3ab2905c11045d0c
- SHA512 e934ae1bb4cef1e71cf1905655bcb5979f8f70944817de88204d8bebf3a36300b7b282d0bd711cc41ae5e69f91b6e14576b7a8098ee283d29bdb451d98238401
- SSDEEP 49152:SoLSnQJ3JMdMMmCnrGxclU/2/vptXkHrLCz3Ra8Zynlo/9s:So2n+ahixf2HptXkvQ3Q+ynyFs
- MD5 SHA1 SHA512 SSDEEP