Analysis Overview
SHA256
471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747
Threat Level: Known bad
The file 5e243f79ecb539d0d1f75fce7ddfedeccee70a48 was found to be: Known bad.
Malicious Activity Summary
PureCrypter
Aurora
Detect PureCrypter injector
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Adds Run key to start application
Suspicious use of SetThreadContext
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2023-02-05 13:32
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2023-02-05 13:32
Reported
2023-02-05 13:35
Platform
win7-20221111-en
Max time kernel
103s
Max time network
143s
Command Line
Signatures
Aurora
Detect PureCrypter injector
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
PureCrypter
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe | N/A |
| Key created | \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce | C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe | N/A |
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
"C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
"C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
C:\Windows\SysWOW64\Wbem\wmic.exe
wmic os get Caption
C:\Windows\SysWOW64\cmd.exe
cmd /C "wmic path win32_VideoController get name"
Network
| Country | Destination | Domain | Proto |
| DE | 45.9.74.11:8081 | tcp | |
| DE | 45.9.74.11:8081 | tcp |
Files
memory/1736-54-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
| MD5 | e416b553ccbd7ba263578f234c3902ed |
| SHA1 | b8b28c73d2cbe69944af118b2212709c8112c078 |
| SHA256 | 15f6358302609a3eec155b38527ff36d08c874da4f0dfe3b75e21cd80bbe3c10 |
| SHA512 | 3c4abb585d161150aceb0d136d3acae94c2776bd6378544c8d6adbf9c3d98c2298c34444fa97428e7680bca4688e01e61c5de069d6317eb642191fd1ed0dc048 |
memory/1736-56-0x0000000075D11000-0x0000000075D13000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
| MD5 | 1656d074c5c8c2c9b1a10d4e018f8058 |
| SHA1 | cb193bd319b5e1b01cf5272437f4fc654ca93304 |
| SHA256 | 8a341b9f8a83adc9c2483bbd255008ec4082052ff478a44b583a0f51f7d7d4fd |
| SHA512 | e0005d0bff64cc0e463bd13abf6f7ea63a416eac0df75b77120835de3117a86e6b4877c3e9da65875b2a3b5178543b86ee98b9441389f33fc3ed1bae5b3de535 |
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
| MD5 | 9a85025c3f8c9d92198495f6c66af35c |
| SHA1 | f54c5225bc853bf1d4b8613a541f6609a1405325 |
| SHA256 | 79e4b7a9ca4c95395fe758f736143f208314b6693a932965a2a15aa0da026f95 |
| SHA512 | f0f503d84bc4f2fccc077af04bb3cf3028df3208e3276010644cd89653f6d146c19af37344f9384ca6106176ea2d0900e4fa3e4259bc49a0db76f5e589cd8596 |
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
| MD5 | 7bff1772af764fca47bac0c018bd1003 |
| SHA1 | d5caa88cc0c3583358d4f6db1385be9f7cb42160 |
| SHA256 | 3cf7e34b6462032a08f8cc50d849034ac713b37caa95c36f5d949c75bf596d18 |
| SHA512 | b3f822b2b4c9504c11a4680a8fd612a99e5b540a6379839e7cff25d3c5ffb32f04f6176d51b81203825bdd2264001360d511027285ad41b78f0cb449692a501b |
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
| MD5 | b53840f25dddead8351a9e1de4c76cfe |
| SHA1 | 91e5a3d6c47673f6b12c1330bd9d40d3888b2ca3 |
| SHA256 | 7383509103fa4c305a627a3140de5537b9ae83203ef90fd2be5a9b5b7c036b69 |
| SHA512 | d4a3263a449e89dbd28fa059ff811784e4d2a218488be1ea7d0469244d48ba4d19eb39eebf199919e892f1a7cb0c4e658567a8b8ffcee0d78da540097c6ea92e |
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
| MD5 | 5d6cd8ac333bea4a4ed594e36238074e |
| SHA1 | 89db5b5aa3d7e9acbf3806e333484ee831016b84 |
| SHA256 | d5685c76ec2d11e7b317fb85afc8b8055a87bb2eb5362c84fd14965418462416 |
| SHA512 | 7e0b87beb0e56e625ed52666dd56f11034db84cbb0e9cf30ee007d91a58ab3d8a4a8750ebeba074e6603e54fcd7fbfb2a70008e2989e770cf2f364549aa0d04f |
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
| MD5 | 02d32bacc7c7954c725accff01ef2059 |
| SHA1 | 8a75a11b6ae6d8188298b4dffbc9e23cdbe0f2c8 |
| SHA256 | 35e79c551977fdda23bef3317a532c90c5fff7e663e0180a1ed0a9d6a375b9df |
| SHA512 | 5c0226cb1dee344f9bd892546daf4d4fa806de983e6e245d43c481c6f44c4b9616c0058ef171c2d9825ec6ecdd899f8df8bc71e21343ccd36ef98e1732f48d65 |
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
| MD5 | b21e77a5ac8143714802fba76a7230ee |
| SHA1 | 89dfdbca76dd7386320a7ee770f80a79d650e5db |
| SHA256 | ac66b1bf4b4a32a0c14bb8413c13d10707690d194aeffcf7053b9b2ac6aef69e |
| SHA512 | 6da5ba85684b2c3dd143b30202e051013aaf2f7cd61c7fc7379e2b12dbfa64d1b915ff623b93e18f9c0cebb81b25d797c1d1bb327ff15a011bd1598bad33affd |
memory/624-62-0x0000000000000000-mapping.dmp
memory/624-65-0x0000000000F70000-0x00000000016E4000-memory.dmp
memory/624-66-0x00000000064F0000-0x0000000006890000-memory.dmp
memory/1676-67-0x0000000000000000-mapping.dmp
memory/1676-69-0x000000006F850000-0x000000006FDFB000-memory.dmp
memory/1676-70-0x000000006F850000-0x000000006FDFB000-memory.dmp
memory/1676-71-0x000000006F850000-0x000000006FDFB000-memory.dmp
memory/1496-72-0x0000000000000000-mapping.dmp
memory/624-73-0x0000000005460000-0x00000000055D2000-memory.dmp
memory/840-74-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
| MD5 | 3a9903e3eb074060779c848f83af86e2 |
| SHA1 | 5c191230200cbc3d00878de5177b20866bed9e0d |
| SHA256 | f58fa956f608f3db3485ac7ba72ff8e501666a6754c34242418ca3adf54f1d2e |
| SHA512 | e0eb55af57c6b023e0de7cc4dc4c4ee926fa8526189e9fa9d0627933d2a933da724061540751213cc01c0e7018abe98e0b863f8fbbfd571e5b0f51366ab9dc48 |
memory/840-78-0x000000006F5B0000-0x000000006FB5B000-memory.dmp
memory/1068-77-0x0000000000400000-0x0000000000731000-memory.dmp
memory/1068-79-0x0000000000400000-0x0000000000731000-memory.dmp
memory/1068-81-0x0000000000400000-0x0000000000731000-memory.dmp
memory/1068-83-0x0000000000400000-0x0000000000731000-memory.dmp
memory/1068-86-0x0000000000400000-0x0000000000731000-memory.dmp
memory/1068-85-0x0000000000400000-0x0000000000731000-memory.dmp
memory/1068-88-0x0000000000400000-0x0000000000731000-memory.dmp
memory/1068-89-0x0000000000400000-0x0000000000731000-memory.dmp
memory/1068-90-0x0000000000464C20-mapping.dmp
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
| MD5 | 37429e658270788ee4bccba20ba262a0 |
| SHA1 | 5e432ac72027f0f207a40b87610b27a84f580920 |
| SHA256 | bee64ad5386fac0294e564f0efd35891ce8e703a6761cd828e362eb8c9303760 |
| SHA512 | 60101c0114a4d92bc03cdae4a1a2b0eab0e15270daa28a9ab963910f8edac5a37be0b73a6e13f7eb546d8c72376e1ff828ff0ed545941045265ca19c4f2a59f0 |
memory/840-93-0x000000006F5B0000-0x000000006FB5B000-memory.dmp
memory/1068-94-0x0000000000400000-0x0000000000731000-memory.dmp
memory/1068-95-0x0000000000400000-0x0000000000731000-memory.dmp
memory/928-97-0x0000000000000000-mapping.dmp
memory/1068-96-0x0000000000400000-0x0000000000731000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2023-02-05 13:32
Reported
2023-02-05 13:35
Platform
win10v2004-20220901-en
Max time kernel
61s
Max time network
127s
Command Line
Signatures
Aurora
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe | N/A |
Reads user/profile data of web browsers
Adds Run key to start application
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce | C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 3360 set thread context of 4536 | N/A | C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe | C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe |
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: 33 | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: 34 | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: 35 | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: 36 | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: 33 | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: 34 | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: 35 | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: 36 | N/A | C:\Windows\SysWOW64\Wbem\wmic.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\SysWOW64\Wbem\WMIC.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
"C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
"C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
C:\Windows\SysWOW64\Wbem\wmic.exe
wmic os get Caption
C:\Windows\SysWOW64\cmd.exe
cmd /C "wmic path win32_VideoController get name"
C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic path win32_VideoController get name
C:\Windows\SysWOW64\cmd.exe
cmd /C "wmic cpu get name"
C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic cpu get name
Network
| Country | Destination | Domain | Proto |
| US | 93.184.220.29:80 | tcp | |
| US | 20.42.73.24:443 | tcp | |
| DE | 45.9.74.11:8081 | tcp | |
| NL | 104.80.225.205:443 | tcp |
Files
memory/3472-132-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
| MD5 | 38e2f0e837ed1073eabb0bb2e4d8522d |
| SHA1 | d3ffecf867abbde6417d8b4fac7c73074262890b |
| SHA256 | bf13a5122130844a8884fdfa13e66201af168fa3c9af2707cb3f859448c725ca |
| SHA512 | fd0e2fff420c138fd83da01d38c5aaf77c4e75c3413e0579c66c1349884235e80843135354fa775e44de0e3209546fc3b23d99953a8707d455ed5a27ef0e3c50 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
| MD5 | 030d25972cdc70c77659e0199250a3bb |
| SHA1 | 88933bb0a8eb1c45b19a56df18f045bf9394877f |
| SHA256 | 7255ac279dac4048ddab7c2d345369a4d2e140dd14405910d5f5375f0d67ec8a |
| SHA512 | 2a3cd7d8f2d63b07e4c81e48e7587ca3273e4890257fe422af57f12fe6ab69b6becb1cbd73d36a27522debf0857450bf2a1f3337fd6cd8d03cd79637e91e1ed6 |
memory/3360-135-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
| MD5 | 1e752412ce36efad6d4998ac66cc8757 |
| SHA1 | 9c3d12ae990d1c7c29ce2ea137730f1ef6e8553d |
| SHA256 | f8d312600b4d741e6b42629bd9e7682e0e9278e36b5d32b642204e9c774dcbd0 |
| SHA512 | 9a6e6f26937617fb53012c9a201679145f83aac4676e070f78df09b6ff4cbb8496c32de90ac2ba9e7ebcb911c77c9bd99c45dac28a8ba52fdcd85f0effe11b5d |
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
| MD5 | 46812ed4b22121d22690a936afc2b268 |
| SHA1 | 7ba070a3e6c69a289754a8a4dc2ab6eab009ceb7 |
| SHA256 | a85a3cbda09d3d485cfb0967d45e3ecd8e575394f274aa10377dde07fdf1f4a4 |
| SHA512 | ea0b845071713158561d42dccc9178ebff519049d1c042e2e257958169d13f6f90024e767e8dc4eeab821183949fddedac15951ecf1d6fd603b1f153a076a219 |
memory/3360-138-0x0000000000C40000-0x00000000013B4000-memory.dmp
memory/3360-139-0x00000000071C0000-0x00000000071E2000-memory.dmp
memory/3768-140-0x0000000000000000-mapping.dmp
memory/3768-141-0x0000000002AF0000-0x0000000002B26000-memory.dmp
memory/3768-142-0x0000000005470000-0x0000000005A98000-memory.dmp
memory/3768-143-0x00000000053C0000-0x0000000005426000-memory.dmp
memory/3768-144-0x0000000005AA0000-0x0000000005B06000-memory.dmp
memory/3768-145-0x00000000060E0000-0x00000000060FE000-memory.dmp
memory/3768-146-0x0000000007930000-0x0000000007FAA000-memory.dmp
memory/3768-147-0x00000000065C0000-0x00000000065DA000-memory.dmp
memory/4968-148-0x0000000000000000-mapping.dmp
memory/4564-149-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
| MD5 | 4280e36a29fa31c01e4d8b2ba726a0d8 |
| SHA1 | c485c2c9ce0a99747b18d899b71dfa9a64dabe32 |
| SHA256 | e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359 |
| SHA512 | 494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4 |
memory/1536-151-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
| MD5 | 214f62d903b883da780b0239563f52aa |
| SHA1 | 72e3e558bde95d38a005416581a1ec89db0a34b2 |
| SHA256 | 63a6ac4e72a5a61623c1ff958dd59f16ec820109bf85ea3910468cb6d8ada129 |
| SHA512 | b6190fc2ec65be50279e6e41d52213b0755de5c9365c9915656952243417f8b1c2d39780126b7e14ac35f4edc0102f4aff028f9b25eb9c130b45a6c51df4ccb4 |
memory/4956-153-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
| MD5 | 010e97d9b79b4bfa6b16e78075afa0e6 |
| SHA1 | fe1b97287b237784ab3f0d99f184911dccb04d51 |
| SHA256 | 7873f856f8f4f94cf4c4bef89be40a76620f0849e1f118d75c80b265c6a11888 |
| SHA512 | fb3bdd08962675346e8200344b62ae6ef448c1620e0c4fdcdaaccc2a92b38597f2f4ab8a0f8c6e18c64e6c2bac694db526dcf1abd47c50b6787cab6fffeaee03 |
memory/4536-155-0x0000000000000000-mapping.dmp
memory/4536-156-0x0000000000400000-0x0000000000731000-memory.dmp
memory/4536-159-0x0000000000400000-0x0000000000731000-memory.dmp
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
| MD5 | 507d75510baf312db93ea3915df2f406 |
| SHA1 | 7f65a7ebb317a9ce1d555b0ae62ef7fcd256aa2a |
| SHA256 | acb1a9edda48fef2b439240fe9f6200214ea42493bf4013602480a43418eb01d |
| SHA512 | bb7b36d4d53ae97a397ccf8f217afdc1f4742896ee45ce283a30d4518349ab6390efdd8759888760721542b0175f475a879fcf4fefcae3e0eb76882dd33661c8 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | e4565a407deeb8eb8ab97fd4bf03b89d |
| SHA1 | 9cd8bb9df44052a8c2622f11c62defa201897a4b |
| SHA256 | a233cbcdc9b1ddcbcefb30463fbad7c617b1418b341ffdf50ec8b2ee1307224e |
| SHA512 | 6d853b85afda6075b10a1af89dca21eae5e749e0f9c0f85db07e955f3f0ff22583dfa694e0b1174bfddc753c26ee15eda3737f0aaececf0d3356cc907bfdd69c |
memory/4536-161-0x0000000000400000-0x0000000000731000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
| MD5 | 06ad34f9739c5159b4d92d702545bd49 |
| SHA1 | 9152a0d4f153f3f40f7e606be75f81b582ee0c17 |
| SHA256 | 474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba |
| SHA512 | c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92 |
memory/4564-163-0x0000000006AA0000-0x0000000006AD2000-memory.dmp
memory/4564-164-0x0000000075AD0000-0x0000000075B1C000-memory.dmp
memory/4564-166-0x0000000006060000-0x000000000607E000-memory.dmp
memory/3776-165-0x0000000000000000-mapping.dmp
memory/4564-167-0x0000000006E60000-0x0000000006E6A000-memory.dmp
memory/3356-168-0x0000000000000000-mapping.dmp
memory/4564-169-0x00000000070B0000-0x0000000007146000-memory.dmp
memory/4548-170-0x0000000000000000-mapping.dmp
memory/828-171-0x0000000000000000-mapping.dmp
memory/4884-172-0x0000000000000000-mapping.dmp
memory/4564-173-0x0000000005920000-0x000000000592E000-memory.dmp
memory/4564-174-0x0000000007010000-0x000000000702A000-memory.dmp
memory/4564-175-0x0000000006FF0000-0x0000000006FF8000-memory.dmp
memory/4536-176-0x0000000000400000-0x0000000000731000-memory.dmp