Analysis
- max time kernel
70s - max time network
75s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system - submitted
23/03/2023, 04:16
Behavioral task
behavioral1
Sample
1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe
Resource
win7-20230220-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe
- Size 14.9MB
- Sample230323-ewav6afd41
- SHA256 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e
- MD5 97abffeaa7bdfaa81532bd6028498225
- SHA1 26ab576a0abf7085ecf6321a311a7b3088ee48ae
- SHA512 af271b15a4f64ac4965cc75f7531e28d3ea0abc90d16ae4654251a301d1a3a0b10d80b205dc626b8866c976ffacdace74f71711c73ef1240d867aeb09c47cc75
- SSDEEP 196608:aMygJ9edfbhSo5Kp8qPKlL8QgYVhqhOM8qTsSqwLM:7XJ9e1wo548qSV5VhKOeTsRwLM
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Azov
A wiper seeking only damage, first seen in 2022.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe - Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\G: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\T: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\B: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\F: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\I: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\Q: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\U: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\V: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\Y: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\Z: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\A: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\H: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\L: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\M: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\N: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\R: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\S: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\W: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\J: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\K: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\O: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\P: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened (read-only) \??\X: 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\ar.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\7-Zip\Lang\vi.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\RESTORE_FILES.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmc.exe 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\pack200.exe 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\7-Zip\Lang\mk.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\7-Zip\Lang\si.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\external_extensions.json 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\unpack200.exe 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\RESTORE_FILES.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\keytool.exe 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsgen.exe 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\BlockComplete.zip 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\RESTORE_FILES.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\RESTORE_FILES.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\7-Zip\Lang\tr.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Common Files\System\ado\msadomd28.tlb 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File created C:\Program Files\Common Files\microsoft shared\ink\ro-RO\RESTORE_FILES.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\pack200.exe 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File created C:\Program Files\Common Files\microsoft shared\ink\sv-SE\RESTORE_FILES.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File created C:\Program Files\Common Files\Services\RESTORE_FILES.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java-rmi.exe 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaws.exe 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File created C:\Program Files\Common Files\microsoft shared\VGX\RESTORE_FILES.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\7-Zip\Lang\en.ttt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\7-Zip\Lang\mr.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\klist.exe 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\RESTORE_FILES.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File created C:\Program Files\Common Files\microsoft shared\ink\fi-FI\RESTORE_FILES.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmid.exe 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\7-Zip\7z.sfx 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\RESTORE_FILES.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\EditStop.xlsx 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File created C:\Program Files\Common Files\microsoft shared\ink\tr-TR\RESTORE_FILES.txt 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec64.exe 1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1536 taskmgr.exe Token: SeSystemProfilePrivilege 1536 taskmgr.exe Token: SeCreateGlobalPrivilege 1536 taskmgr.exe Token: 33 1536 taskmgr.exe Token: SeIncBasePriorityPrivilege 1536 taskmgr.exe - Suspicious use of FindShellTrayWindow 48 IoCs
pid Process 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe - Suspicious use of SendNotifyMessage 48 IoCs
pid Process 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe 1536 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe"C:\Users\Admin\AppData\Local\Temp\1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
PID:1288
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1536
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\Lang\RESTORE_FILES.txt
- Size 2KB
- SHA256 c97412fbf88da8f91099a52888dea4c3f222cd95af3e681e3271cbca8b6b7bb5
- MD5 78ede93114e65f9160fd03d3357c56e6
- SHA1 88d531b101e57655f1d0d26c6b3257aa2468d460
- SHA512 074a4c741273902ccacb6f573b96d8accedb2ee405dbd04350cdbf54d180c1fd577a4e90c2aae26bf72f3782403f4494db6e3501a04cfd9d7d81a6bc14884b9d
- MD5 SHA1 SHA512
- Path C:\ProgramData\rdpclient.exe
- Size 113KB
- SHA256 6c05b8318797e07a1d03818ef92ff9e5adc827a3887c63cb4a1b8fc6f6a7c9f0
- MD5 001ce3fffc6020534f67e30032b026cd
- SHA1 67576bbd5dfaaf289d4b15397757aaaa85df7ccd
- SHA512 2c8435e7abea3059791cf9b0f0a753815c2f9f0ddca3aa9709c22c760382b4f45b76ad447fe67f0fdd835dfc88ef273e453734dcf4f8afb24fe116e2892d0f17
- SSDEEP 1536:lxhjqDHJeFxvXuhi3ughXjQzZ28Tx4rUbu607d0V32KBeaxLpRwj2Ph0GTLmDsYY:lE42U39qHTx4rd607dgtvLw2xDjGu
- MD5 SHA1 SHA512 SSDEEP