Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30-01-2023 04:29
Static task
static1
Behavioral task
behavioral1
Sample
ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe
Resource
win7-20220812-en
General
-
Target
ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe
-
Size
888KB
-
MD5
480eddeae93d43757a9cd25c81e0c845
-
SHA1
c1ce2217a0eaefb4d3b42a7272f643c447dd5fb8
-
SHA256
ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70
-
SHA512
70254b59577a8553f6405931297b4e73f5a20f905da2c2ef3dfd3fb3559dc86cf6d54fb9854fe048435823bcc3829760dcd383250f67bfa13e6c4eaf18cbd968
-
SSDEEP
24576:fwOC3vvkS4zF8BDAYLg+fapr/NV23642s0j/:83H3UFZInfSz236A07
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Adobe\\services.exe" ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
services.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "1" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" services.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
services.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" services.exe -
Processes:
services.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" services.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" services.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
services.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" services.exe -
Disables Task Manager via registry modification
-
Executes dropped EXE 3 IoCs
Processes:
services.exeservices.exeservices.exepid process 2388 services.exe 1448 services.exe 4724 services.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exeservices.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate services.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe -
Processes:
services.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" services.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" services.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exeservices.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adobe = "C:\\Adobe\\services.exe" ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run services.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exeservices.exedescription ioc process File opened for modification \??\PhysicalDrive0 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe File opened for modification \??\PhysicalDrive0 services.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exeed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exeservices.exeservices.exedescription pid process target process PID 4488 set thread context of 2340 4488 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe PID 2340 set thread context of 1400 2340 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe PID 2388 set thread context of 1448 2388 services.exe services.exe PID 1448 set thread context of 4724 1448 services.exe services.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exeservices.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 services.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString services.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier services.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier services.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exeservices.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier services.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
services.exepid process 4724 services.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exeservices.exedescription pid process Token: SeIncreaseQuotaPrivilege 1400 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe Token: SeSecurityPrivilege 1400 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe Token: SeTakeOwnershipPrivilege 1400 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe Token: SeLoadDriverPrivilege 1400 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe Token: SeSystemProfilePrivilege 1400 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe Token: SeSystemtimePrivilege 1400 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe Token: SeProfSingleProcessPrivilege 1400 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe Token: SeIncBasePriorityPrivilege 1400 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe Token: SeCreatePagefilePrivilege 1400 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe Token: SeBackupPrivilege 1400 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe Token: SeRestorePrivilege 1400 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe Token: SeShutdownPrivilege 1400 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe Token: SeDebugPrivilege 1400 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe Token: SeSystemEnvironmentPrivilege 1400 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe Token: SeChangeNotifyPrivilege 1400 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe Token: SeRemoteShutdownPrivilege 1400 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe Token: SeUndockPrivilege 1400 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe Token: SeManageVolumePrivilege 1400 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe Token: SeImpersonatePrivilege 1400 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe Token: SeCreateGlobalPrivilege 1400 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe Token: 33 1400 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe Token: 34 1400 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe Token: 35 1400 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe Token: 36 1400 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe Token: SeIncreaseQuotaPrivilege 4724 services.exe Token: SeSecurityPrivilege 4724 services.exe Token: SeTakeOwnershipPrivilege 4724 services.exe Token: SeLoadDriverPrivilege 4724 services.exe Token: SeSystemProfilePrivilege 4724 services.exe Token: SeSystemtimePrivilege 4724 services.exe Token: SeProfSingleProcessPrivilege 4724 services.exe Token: SeIncBasePriorityPrivilege 4724 services.exe Token: SeCreatePagefilePrivilege 4724 services.exe Token: SeBackupPrivilege 4724 services.exe Token: SeRestorePrivilege 4724 services.exe Token: SeShutdownPrivilege 4724 services.exe Token: SeDebugPrivilege 4724 services.exe Token: SeSystemEnvironmentPrivilege 4724 services.exe Token: SeChangeNotifyPrivilege 4724 services.exe Token: SeRemoteShutdownPrivilege 4724 services.exe Token: SeUndockPrivilege 4724 services.exe Token: SeManageVolumePrivilege 4724 services.exe Token: SeImpersonatePrivilege 4724 services.exe Token: SeCreateGlobalPrivilege 4724 services.exe Token: 33 4724 services.exe Token: 34 4724 services.exe Token: 35 4724 services.exe Token: 36 4724 services.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exeed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exeservices.exeservices.exeservices.exepid process 4488 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe 2340 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe 2388 services.exe 1448 services.exe 4724 services.exe -
Suspicious use of WriteProcessMemory 47 IoCs
Processes:
ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exeed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exeed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exeservices.exeservices.exedescription pid process target process PID 4488 wrote to memory of 2340 4488 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe PID 4488 wrote to memory of 2340 4488 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe PID 4488 wrote to memory of 2340 4488 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe PID 4488 wrote to memory of 2340 4488 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe PID 4488 wrote to memory of 2340 4488 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe PID 4488 wrote to memory of 2340 4488 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe PID 4488 wrote to memory of 2340 4488 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe PID 4488 wrote to memory of 2340 4488 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe PID 2340 wrote to memory of 1400 2340 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe PID 2340 wrote to memory of 1400 2340 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe PID 2340 wrote to memory of 1400 2340 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe PID 2340 wrote to memory of 1400 2340 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe PID 2340 wrote to memory of 1400 2340 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe PID 2340 wrote to memory of 1400 2340 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe PID 2340 wrote to memory of 1400 2340 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe PID 2340 wrote to memory of 1400 2340 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe PID 2340 wrote to memory of 1400 2340 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe PID 2340 wrote to memory of 1400 2340 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe PID 2340 wrote to memory of 1400 2340 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe PID 2340 wrote to memory of 1400 2340 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe PID 2340 wrote to memory of 1400 2340 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe PID 2340 wrote to memory of 1400 2340 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe PID 1400 wrote to memory of 2388 1400 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe services.exe PID 1400 wrote to memory of 2388 1400 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe services.exe PID 1400 wrote to memory of 2388 1400 ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe services.exe PID 2388 wrote to memory of 1448 2388 services.exe services.exe PID 2388 wrote to memory of 1448 2388 services.exe services.exe PID 2388 wrote to memory of 1448 2388 services.exe services.exe PID 2388 wrote to memory of 1448 2388 services.exe services.exe PID 2388 wrote to memory of 1448 2388 services.exe services.exe PID 2388 wrote to memory of 1448 2388 services.exe services.exe PID 2388 wrote to memory of 1448 2388 services.exe services.exe PID 2388 wrote to memory of 1448 2388 services.exe services.exe PID 1448 wrote to memory of 4724 1448 services.exe services.exe PID 1448 wrote to memory of 4724 1448 services.exe services.exe PID 1448 wrote to memory of 4724 1448 services.exe services.exe PID 1448 wrote to memory of 4724 1448 services.exe services.exe PID 1448 wrote to memory of 4724 1448 services.exe services.exe PID 1448 wrote to memory of 4724 1448 services.exe services.exe PID 1448 wrote to memory of 4724 1448 services.exe services.exe PID 1448 wrote to memory of 4724 1448 services.exe services.exe PID 1448 wrote to memory of 4724 1448 services.exe services.exe PID 1448 wrote to memory of 4724 1448 services.exe services.exe PID 1448 wrote to memory of 4724 1448 services.exe services.exe PID 1448 wrote to memory of 4724 1448 services.exe services.exe PID 1448 wrote to memory of 4724 1448 services.exe services.exe PID 1448 wrote to memory of 4724 1448 services.exe services.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
services.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" services.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion services.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern services.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe"C:\Users\Admin\AppData\Local\Temp\ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe"C:\Users\Admin\AppData\Local\Temp\ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe"2⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe"C:\Users\Admin\AppData\Local\Temp\ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70.exe"3⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Adds Run key to start application
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Adobe\services.exe"C:\Adobe\services.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Adobe\services.exe"C:\Adobe\services.exe"5⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Adobe\services.exe"C:\Adobe\services.exe"6⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Checks BIOS information in registry
- Windows security modification
- Adds Run key to start application
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Adobe\services.exeFilesize
888KB
MD5480eddeae93d43757a9cd25c81e0c845
SHA1c1ce2217a0eaefb4d3b42a7272f643c447dd5fb8
SHA256ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70
SHA51270254b59577a8553f6405931297b4e73f5a20f905da2c2ef3dfd3fb3559dc86cf6d54fb9854fe048435823bcc3829760dcd383250f67bfa13e6c4eaf18cbd968
-
C:\Adobe\services.exeFilesize
888KB
MD5480eddeae93d43757a9cd25c81e0c845
SHA1c1ce2217a0eaefb4d3b42a7272f643c447dd5fb8
SHA256ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70
SHA51270254b59577a8553f6405931297b4e73f5a20f905da2c2ef3dfd3fb3559dc86cf6d54fb9854fe048435823bcc3829760dcd383250f67bfa13e6c4eaf18cbd968
-
C:\Adobe\services.exeFilesize
888KB
MD5480eddeae93d43757a9cd25c81e0c845
SHA1c1ce2217a0eaefb4d3b42a7272f643c447dd5fb8
SHA256ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70
SHA51270254b59577a8553f6405931297b4e73f5a20f905da2c2ef3dfd3fb3559dc86cf6d54fb9854fe048435823bcc3829760dcd383250f67bfa13e6c4eaf18cbd968
-
C:\Adobe\services.exeFilesize
888KB
MD5480eddeae93d43757a9cd25c81e0c845
SHA1c1ce2217a0eaefb4d3b42a7272f643c447dd5fb8
SHA256ed0f6dc6897eac22d2d4afd7fba057a4afa347f3a63745eb08aa475148541c70
SHA51270254b59577a8553f6405931297b4e73f5a20f905da2c2ef3dfd3fb3559dc86cf6d54fb9854fe048435823bcc3829760dcd383250f67bfa13e6c4eaf18cbd968
-
memory/1400-142-0x0000000000400000-0x00000000004C1000-memory.dmpFilesize
772KB
-
memory/1400-143-0x0000000000400000-0x00000000004C1000-memory.dmpFilesize
772KB
-
memory/1400-139-0x0000000000000000-mapping.dmp
-
memory/1400-140-0x0000000000400000-0x00000000004C1000-memory.dmpFilesize
772KB
-
memory/1400-149-0x0000000000400000-0x00000000004C1000-memory.dmpFilesize
772KB
-
memory/1448-150-0x0000000000000000-mapping.dmp
-
memory/1448-160-0x0000000000400000-0x00000000004BF000-memory.dmpFilesize
764KB
-
memory/2340-135-0x0000000000400000-0x00000000004BF000-memory.dmpFilesize
764KB
-
memory/2340-141-0x0000000000400000-0x00000000004BF000-memory.dmpFilesize
764KB
-
memory/2340-134-0x0000000000000000-mapping.dmp
-
memory/2388-144-0x0000000000000000-mapping.dmp
-
memory/4724-156-0x0000000000000000-mapping.dmp
-
memory/4724-161-0x0000000000400000-0x00000000004C1000-memory.dmpFilesize
772KB
-
memory/4724-162-0x0000000000400000-0x00000000004C1000-memory.dmpFilesize
772KB
-
memory/4724-163-0x0000000000400000-0x00000000004C1000-memory.dmpFilesize
772KB