Analysis
-
max time kernel
270s -
max time network
257s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
25-03-2023 04:55
Static task
static1
Behavioral task
behavioral1
Sample
b59a26cf9a84386e31f54cd6b18e44fba40b4716d9acf9c9ed6a85860105dbb2.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
b59a26cf9a84386e31f54cd6b18e44fba40b4716d9acf9c9ed6a85860105dbb2.exe
Resource
win10v2004-20230220-en
General
-
Target
b59a26cf9a84386e31f54cd6b18e44fba40b4716d9acf9c9ed6a85860105dbb2.exe
-
Size
249KB
-
MD5
fae86954741e60a3e85ba7d7884c8478
-
SHA1
5b5dae13db12d4acdc5d78782938588b6173256f
-
SHA256
b59a26cf9a84386e31f54cd6b18e44fba40b4716d9acf9c9ed6a85860105dbb2
-
SHA512
f8eef60c2bbe47bbec1ba0cd85fe49a058f5e498daf2a22b7af8221962553ff565a8fc5ec3ebea85706ee522705ae690f754b14f26bf82e4b7da52724d55f003
-
SSDEEP
3072:AnH+6IjwpCVuLkTOeYDNI5WXSnHsz0dsJlE2WKXK5KTrNUTZsl5hWpz7bIyNCG:g+XVuLQ/YDiQXWM73G0Wh7b
Malware Config
Extracted
smokeloader
2022
http://potunulit.org/
http://hutnilior.net/
http://bulimu55t.net/
http://soryytlic4.net/
http://novanosa5org.org/
http://nuljjjnuli.org/
http://tolilolihul.net/
http://somatoka51hub.net/
http://hujukui3.net/
http://bukubuka1.net/
http://golilopaster.org/
http://newzelannd66.org/
http://otriluyttn.org/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
b59a26cf9a84386e31f54cd6b18e44fba40b4716d9acf9c9ed6a85860105dbb2.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI b59a26cf9a84386e31f54cd6b18e44fba40b4716d9acf9c9ed6a85860105dbb2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI b59a26cf9a84386e31f54cd6b18e44fba40b4716d9acf9c9ed6a85860105dbb2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI b59a26cf9a84386e31f54cd6b18e44fba40b4716d9acf9c9ed6a85860105dbb2.exe -
Processes:
description ioc process Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" -
Modifies registry class 52 IoCs
Processes:
description ioc process Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC} Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9} Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1092616193" Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\IconSize = "16" Set value (data) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Set value (data) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Set value (data) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0" Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\LogicalViewMode = "1" Set value (data) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\NodeSlot = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}\GroupByKey:PID = "0" Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}\IconSize = "48" Set value (data) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}\Rev = "0" Set value (data) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000 Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}\FFlags = "1092616209" Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}\GroupView = "0" Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}\GroupByDirection = "1" Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "2" Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell Set value (data) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Set value (data) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = ffffffff Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Rev = "0" Set value (str) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}" Set value (data) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 Set value (data) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}\FFlags = "1092616193" Set value (str) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}" Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}\LogicalViewMode = "2" Set value (data) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000 Set value (str) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}" Set value (str) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}" Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\TV_TopViewVersion = "0" Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Mode = "4" Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}\Mode = "6" Set value (str) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" Set value (data) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Sort = 000000000000000000000000000000000200000030f125b7ef471a10a5f102608c9eebac0a0000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0" Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1" Set value (data) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{C4D98F09-6124-4FE0-9942-826416082DA9} Set value (data) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
b59a26cf9a84386e31f54cd6b18e44fba40b4716d9acf9c9ed6a85860105dbb2.exepid process 2024 b59a26cf9a84386e31f54cd6b18e44fba40b4716d9acf9c9ed6a85860105dbb2.exe 2024 b59a26cf9a84386e31f54cd6b18e44fba40b4716d9acf9c9ed6a85860105dbb2.exe 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
taskmgr.exepid process 1248 1144 taskmgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
b59a26cf9a84386e31f54cd6b18e44fba40b4716d9acf9c9ed6a85860105dbb2.exepid process 2024 b59a26cf9a84386e31f54cd6b18e44fba40b4716d9acf9c9ed6a85860105dbb2.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
Processes:
taskmgr.exeAUDIODG.EXEdescription pid process Token: SeShutdownPrivilege 1248 Token: SeDebugPrivilege 1144 taskmgr.exe Token: SeShutdownPrivilege 1248 Token: SeShutdownPrivilege 1248 Token: SeShutdownPrivilege 1248 Token: SeShutdownPrivilege 1248 Token: SeShutdownPrivilege 1248 Token: 33 1968 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1968 AUDIODG.EXE Token: 33 1968 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1968 AUDIODG.EXE Token: SeShutdownPrivilege 1248 Token: SeShutdownPrivilege 1248 Token: SeShutdownPrivilege 1248 -
Suspicious use of FindShellTrayWindow 46 IoCs
Processes:
taskmgr.exepid process 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1248 1248 1248 1248 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1248 1248 1248 1248 -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1248 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1248 1248 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1144 taskmgr.exe 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 1248 -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
pid process 1248 1248 -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
description pid process target process PID 1248 wrote to memory of 1144 1248 taskmgr.exe PID 1248 wrote to memory of 1144 1248 taskmgr.exe PID 1248 wrote to memory of 1144 1248 taskmgr.exe PID 1248 wrote to memory of 1468 1248 explorer.exe PID 1248 wrote to memory of 1468 1248 explorer.exe PID 1248 wrote to memory of 1468 1248 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b59a26cf9a84386e31f54cd6b18e44fba40b4716d9acf9c9ed6a85860105dbb2.exe"C:\Users\Admin\AppData\Local\Temp\b59a26cf9a84386e31f54cd6b18e44fba40b4716d9acf9c9ed6a85860105dbb2.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1841⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1144-61-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/1144-62-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/1248-56-0x0000000002A50000-0x0000000002A66000-memory.dmpFilesize
88KB
-
memory/1248-60-0x000007FEE4E70000-0x000007FEE4E7A000-memory.dmpFilesize
40KB
-
memory/2024-55-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/2024-57-0x0000000000400000-0x0000000000702000-memory.dmpFilesize
3.0MB