Analysis
-
max time kernel
137s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
23-03-2023 04:28
Behavioral task
behavioral1
Sample
1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe
Resource
win7-20230220-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe
-
Size
14.9MB
-
MD5
97abffeaa7bdfaa81532bd6028498225
-
SHA1
26ab576a0abf7085ecf6321a311a7b3088ee48ae
-
SHA256
1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e
-
SHA512
af271b15a4f64ac4965cc75f7531e28d3ea0abc90d16ae4654251a301d1a3a0b10d80b205dc626b8866c976ffacdace74f71711c73ef1240d867aeb09c47cc75
-
SSDEEP
196608:aMygJ9edfbhSo5Kp8qPKlL8QgYVhqhOM8qTsSqwLM:7XJ9e1wo548qSV5VhKOeTsRwLM
Score
10/10
Malware Config
Signatures
-
Azov
A wiper seeking only damage, first seen in 2022.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\R: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\A: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\G: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\H: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\N: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\P: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\Q: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\S: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\T: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\F: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\W: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\Z: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\U: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\J: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\O: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\X: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\E: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\I: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\L: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\M: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\V: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\Y: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\B: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\pl.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-CN\RESTORE_FILES.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\106.0.5249.119.manifest 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File created C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\RESTORE_FILES.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File created C:\Program Files\Common Files\System\fr-FR\RESTORE_FILES.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\tnameserv.exe 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\EnterOpen.xlsx 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\RESTORE_FILES.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\7-Zip\Lang\nb.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\RESTORE_FILES.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java.exe 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\RESTORE_FILES.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Common Files\System\ado\msadomd28.tlb 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Common Files\System\ado\msadox28.tlb 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File created C:\Program Files\Common Files\System\msadc\it-IT\RESTORE_FILES.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File created C:\Program Files\Common Files\System\ado\es-ES\RESTORE_FILES.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-MX\RESTORE_FILES.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File created C:\Program Files\Common Files\microsoft shared\ink\sv-SE\RESTORE_FILES.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\RESTORE_FILES.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ktab.exe 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\7-Zip\Lang\mk.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\7-Zip\Lang\pt.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File created C:\Program Files\Common Files\microsoft shared\ink\tr-TR\RESTORE_FILES.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\RESTORE_FILES.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File created C:\Program Files\Common Files\microsoft shared\ink\th-TH\RESTORE_FILES.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jp2launcher.exe 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\7-Zip\Lang\uk.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File created C:\Program Files\7-Zip\Lang\RESTORE_FILES.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File created C:\Program Files\Common Files\DESIGNER\RESTORE_FILES.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmid.exe 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3604 taskmgr.exe Token: SeSystemProfilePrivilege 3604 taskmgr.exe Token: SeCreateGlobalPrivilege 3604 taskmgr.exe Token: 33 3604 taskmgr.exe Token: SeIncBasePriorityPrivilege 3604 taskmgr.exe -
Suspicious use of FindShellTrayWindow 46 IoCs
pid Process 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe -
Suspicious use of SendNotifyMessage 46 IoCs
pid Process 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe 3604 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe"C:\Users\Admin\AppData\Local\Temp\1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
PID:3392
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3604
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD578ede93114e65f9160fd03d3357c56e6
SHA188d531b101e57655f1d0d26c6b3257aa2468d460
SHA256c97412fbf88da8f91099a52888dea4c3f222cd95af3e681e3271cbca8b6b7bb5
SHA512074a4c741273902ccacb6f573b96d8accedb2ee405dbd04350cdbf54d180c1fd577a4e90c2aae26bf72f3782403f4494db6e3501a04cfd9d7d81a6bc14884b9d
-
Filesize
113KB
MD58390d75144d30381983e3983b09bbf9a
SHA1e17fe26f1e352b9129cb2f9799760f1d61d930aa
SHA2560de328d209552ef7fe9e5eb396cd805a0e1c0d9e56af2a8ff78d9334b33c9c00
SHA512bb733fc97acf84b5936673581afa5746acbf8b333618db568c3f0d2fce55a443df88c07ea12ea556f35b62d24c7258a6056935026db969212c536fe961cba769