Analysis
-
max time kernel
153s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
13-10-2023 03:31
Static task
static1
Behavioral task
behavioral1
Sample
8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe
Resource
win10v2004-20230915-en
General
-
Target
8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe
-
Size
513KB
-
MD5
89fe28686a81b90bf1f46b6d46251ce4
-
SHA1
19f6a799b4777acf208926cee4913c0a889db72e
-
SHA256
8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f
-
SHA512
9cb0181a6a9e6a37c10a6acf9c172fd4130f4d476b76c3b97acc71c157c3d8135f42d1f2a10bb87d07ecf784d30e705dc071b5630705e9f939127762795d0dfc
-
SSDEEP
12288:pX5JC7oT39ra0hI1iGKsHJwUJ10qx6qhE12:pLC7mtThIcGNSS1VY31
Malware Config
Extracted
smokeloader
2022
http://servermlogs27.xyz/statweb255/
http://servmblog45.xyz/statweb255/
http://demblog575.xyz/statweb255/
http://admlogs85x.xyz/statweb255/
http://blogmstat389.xyz/statweb255/
http://blogmstat255.xyz/statweb255/
Signatures
-
Ammyy Admin
Remote admin tool with various capabilities.
-
AmmyyAdmin payload 5 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\4672.tmp\svchost.exe family_ammyyadmin C:\Users\Admin\AppData\Local\Temp\4672.tmp\svchost.exe family_ammyyadmin C:\Users\Admin\AppData\Local\Temp\4672.tmp\svchost.exe family_ammyyadmin \Users\Admin\AppData\Local\Temp\4672.tmp\svchost.exe family_ammyyadmin C:\Users\Admin\AppData\Local\Temp\4672.tmp\svchost.exe family_ammyyadmin -
Detect rhadamanthys stealer shellcode 6 IoCs
Processes:
resource yara_rule behavioral1/memory/2408-24-0x00000000022F0000-0x00000000026F0000-memory.dmp family_rhadamanthys behavioral1/memory/2408-25-0x00000000022F0000-0x00000000026F0000-memory.dmp family_rhadamanthys behavioral1/memory/2408-26-0x00000000022F0000-0x00000000026F0000-memory.dmp family_rhadamanthys behavioral1/memory/2408-27-0x00000000022F0000-0x00000000026F0000-memory.dmp family_rhadamanthys behavioral1/memory/2408-37-0x00000000022F0000-0x00000000026F0000-memory.dmp family_rhadamanthys behavioral1/memory/2408-39-0x00000000022F0000-0x00000000026F0000-memory.dmp family_rhadamanthys -
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exedescription pid process target process PID 2408 created 1176 2408 8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe Explorer.EXE -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
Processes:
bcdedit.exebcdedit.exepid process 2832 bcdedit.exe 1428 bcdedit.exe -
Renames multiple (90) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
wbadmin.exepid process 1828 wbadmin.exe -
Downloads MZ/PE file
-
Modifies Windows Firewall 1 TTPs 2 IoCs
-
Deletes itself 1 IoCs
Processes:
certreq.exepid process 3048 certreq.exe -
Drops startup file 1 IoCs
Processes:
F41F.exedescription ioc process File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\F41F.exe F41F.exe -
Executes dropped EXE 19 IoCs
Processes:
9Jb.exe9Jb.exeMX(~Q{9xr.exe9Jb.exe9Jb.exe9Jb.exe9Jb.exe9Jb.exe9Jb.exe9Jb.exe9Jb.exe9Jb.exeMX(~Q{9xr.exeF41F.exeF74B.exeF41F.exeF41F.exeF41F.exesvchost.exepid process 2852 9Jb.exe 2472 9Jb.exe 2340 MX(~Q{9xr.exe 1960 9Jb.exe 1720 9Jb.exe 1944 9Jb.exe 2712 9Jb.exe 1216 9Jb.exe 1220 9Jb.exe 368 9Jb.exe 2656 9Jb.exe 2748 9Jb.exe 2716 MX(~Q{9xr.exe 2268 F41F.exe 1768 F74B.exe 2936 F41F.exe 2976 F41F.exe 1404 F41F.exe 2576 svchost.exe -
Loads dropped DLL 5 IoCs
Processes:
F41F.exeF41F.exeexplorer.exeF74B.exepid process 2268 F41F.exe 2976 F41F.exe 2684 explorer.exe 2684 explorer.exe 1768 F74B.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 9 IoCs
Processes:
certreq.exeexplorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook certreq.exe Key opened \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook certreq.exe Key opened \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook certreq.exe Key opened \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook certreq.exe Key opened \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook certreq.exe Key opened \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook certreq.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
F41F.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\F41F = "C:\\Users\\Admin\\AppData\\Local\\F41F.exe" F41F.exe Set value (str) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows\CurrentVersion\Run\F41F = "C:\\Users\\Admin\\AppData\\Local\\F41F.exe" F41F.exe -
Drops desktop.ini file(s) 4 IoCs
Processes:
F41F.exedescription ioc process File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini F41F.exe File opened for modification C:\Program Files\desktop.ini F41F.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-3185155662-718608226-894467740-1000\desktop.ini F41F.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3185155662-718608226-894467740-1000\desktop.ini F41F.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
svchost.exedescription ioc process File opened for modification \??\PhysicalDrive0 svchost.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exeMX(~Q{9xr.exeF41F.exeF41F.exedescription pid process target process PID 1936 set thread context of 2408 1936 8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe 8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe PID 2340 set thread context of 2716 2340 MX(~Q{9xr.exe MX(~Q{9xr.exe PID 2268 set thread context of 2936 2268 F41F.exe F41F.exe PID 2976 set thread context of 1404 2976 F41F.exe F41F.exe -
Drops file in Program Files directory 64 IoCs
Processes:
F41F.exedescription ioc process File opened for modification C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui F41F.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\epl-v10.html.id[2B47469F-3483].[[email protected]].8base F41F.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core.xml F41F.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.configuration_5.5.0.165303.jar.id[2B47469F-3483].[[email protected]].8base F41F.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security.ui_1.1.200.v20130626-2037.jar.id[2B47469F-3483].[[email protected]].8base F41F.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_ja_4.4.0.v20140623020002.jar F41F.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-execution.xml F41F.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\core.jar.id[2B47469F-3483].[[email protected]].8base F41F.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives.nl_ja_4.4.0.v20140623020002.jar.id[2B47469F-3483].[[email protected]].8base F41F.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-execution.xml F41F.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt F41F.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll F41F.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_notes.wmv F41F.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nl.pak F41F.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe F41F.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\epl-v10.html.id[2B47469F-3483].[[email protected]].8base F41F.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core.xml.id[2B47469F-3483].[[email protected]].8base F41F.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\boot_ja.jar F41F.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-execution.xml.id[2B47469F-3483].[[email protected]].8base F41F.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\tipresx.dll.mui F41F.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_VideoInset.png F41F.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe.id[2B47469F-3483].[[email protected]].8base F41F.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\cpyr.htm F41F.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\MANIFEST.MF.id[2B47469F-3483].[[email protected]].8base F41F.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui F41F.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png F41F.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\jawt_md.h F41F.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Mawson.id[2B47469F-3483].[[email protected]].8base F41F.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.xml.id[2B47469F-3483].[[email protected]].8base F41F.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\visualvm.conf.id[2B47469F-3483].[[email protected]].8base F41F.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-templates.jar F41F.exe File created C:\Program Files\Java\jre7\bin\libxml2.dll.id[2B47469F-3483].[[email protected]].8base F41F.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt F41F.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm F41F.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe F41F.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\t2k.dll.id[2B47469F-3483].[[email protected]].8base F41F.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.nl_ja_4.4.0.v20140623020002.jar F41F.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-services.jar F41F.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-javahelp_ja.jar.id[2B47469F-3483].[[email protected]].8base F41F.exe File created C:\Program Files\Java\jre7\bin\kinit.exe.id[2B47469F-3483].[[email protected]].8base F41F.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt F41F.exe File opened for modification C:\Program Files\DVD Maker\fr-FR\DVDMaker.exe.mui F41F.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_SelectionSubpicture.png F41F.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jli.dll F41F.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\EST5EDT.id[2B47469F-3483].[[email protected]].8base F41F.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.lucene.core_3.5.0.v20120725-1805.jar F41F.exe File created C:\Program Files\Java\jre7\lib\meta-index.id[2B47469F-3483].[[email protected]].8base F41F.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Shanghai F41F.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\ECLIPSE_.SF.id[2B47469F-3483].[[email protected]].8base F41F.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.p2.ui.overridden_5.5.0.165303.jar F41F.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hr.pak F41F.exe File created C:\Program Files\Java\jdk1.7.0_80\db\NOTICE.id[2B47469F-3483].[[email protected]].8base F41F.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\dt.jar.id[2B47469F-3483].[[email protected]].8base F41F.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-ui_zh_CN.jar F41F.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-nodes.xml F41F.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-ui.xml.id[2B47469F-3483].[[email protected]].8base F41F.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-execution_ja.jar.id[2B47469F-3483].[[email protected]].8base F41F.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-explorer_ja.jar.id[2B47469F-3483].[[email protected]].8base F41F.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_precomp_matte.wmv F41F.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\circle_glass_Thumbnail.bmp F41F.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ko.properties.id[2B47469F-3483].[[email protected]].8base F41F.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bogota F41F.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\MANIFEST.MF F41F.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse.nl_ja_4.4.0.v20140623020002.jar F41F.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
MX(~Q{9xr.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI MX(~Q{9xr.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI MX(~Q{9xr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI MX(~Q{9xr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
certreq.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 certreq.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString certreq.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 2068 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.execertreq.exe9Jb.exeMX(~Q{9xr.exeExplorer.EXEpid process 1936 8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe 1936 8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe 2408 8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe 2408 8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe 2408 8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe 2408 8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe 3048 certreq.exe 3048 certreq.exe 3048 certreq.exe 3048 certreq.exe 2852 9Jb.exe 2852 9Jb.exe 2852 9Jb.exe 2852 9Jb.exe 2852 9Jb.exe 2852 9Jb.exe 2852 9Jb.exe 2852 9Jb.exe 2852 9Jb.exe 2852 9Jb.exe 2852 9Jb.exe 2852 9Jb.exe 2852 9Jb.exe 2852 9Jb.exe 2852 9Jb.exe 2852 9Jb.exe 2852 9Jb.exe 2852 9Jb.exe 2852 9Jb.exe 2852 9Jb.exe 2716 MX(~Q{9xr.exe 2716 MX(~Q{9xr.exe 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1176 Explorer.EXE -
Suspicious behavior: MapViewOfSection 33 IoCs
Processes:
MX(~Q{9xr.exeExplorer.EXEexplorer.exepid process 2716 MX(~Q{9xr.exe 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 1176 Explorer.EXE 2684 explorer.exe 2684 explorer.exe -
Suspicious use of AdjustPrivilegeToken 53 IoCs
Processes:
8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe9Jb.exeMX(~Q{9xr.exeF41F.exeF41F.exeF74B.exeF41F.exevssvc.exeWMIC.exewbengine.exedescription pid process Token: SeDebugPrivilege 1936 8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe Token: SeDebugPrivilege 2852 9Jb.exe Token: SeDebugPrivilege 2340 MX(~Q{9xr.exe Token: SeDebugPrivilege 2268 F41F.exe Token: SeDebugPrivilege 2976 F41F.exe Token: SeDebugPrivilege 1768 F74B.exe Token: SeDebugPrivilege 2936 F41F.exe Token: SeBackupPrivilege 2440 vssvc.exe Token: SeRestorePrivilege 2440 vssvc.exe Token: SeAuditPrivilege 2440 vssvc.exe Token: SeIncreaseQuotaPrivilege 1456 WMIC.exe Token: SeSecurityPrivilege 1456 WMIC.exe Token: SeTakeOwnershipPrivilege 1456 WMIC.exe Token: SeLoadDriverPrivilege 1456 WMIC.exe Token: SeSystemProfilePrivilege 1456 WMIC.exe Token: SeSystemtimePrivilege 1456 WMIC.exe Token: SeProfSingleProcessPrivilege 1456 WMIC.exe Token: SeIncBasePriorityPrivilege 1456 WMIC.exe Token: SeCreatePagefilePrivilege 1456 WMIC.exe Token: SeBackupPrivilege 1456 WMIC.exe Token: SeRestorePrivilege 1456 WMIC.exe Token: SeShutdownPrivilege 1456 WMIC.exe Token: SeDebugPrivilege 1456 WMIC.exe Token: SeSystemEnvironmentPrivilege 1456 WMIC.exe Token: SeRemoteShutdownPrivilege 1456 WMIC.exe Token: SeUndockPrivilege 1456 WMIC.exe Token: SeManageVolumePrivilege 1456 WMIC.exe Token: 33 1456 WMIC.exe Token: 34 1456 WMIC.exe Token: 35 1456 WMIC.exe Token: SeIncreaseQuotaPrivilege 1456 WMIC.exe Token: SeSecurityPrivilege 1456 WMIC.exe Token: SeTakeOwnershipPrivilege 1456 WMIC.exe Token: SeLoadDriverPrivilege 1456 WMIC.exe Token: SeSystemProfilePrivilege 1456 WMIC.exe Token: SeSystemtimePrivilege 1456 WMIC.exe Token: SeProfSingleProcessPrivilege 1456 WMIC.exe Token: SeIncBasePriorityPrivilege 1456 WMIC.exe Token: SeCreatePagefilePrivilege 1456 WMIC.exe Token: SeBackupPrivilege 1456 WMIC.exe Token: SeRestorePrivilege 1456 WMIC.exe Token: SeShutdownPrivilege 1456 WMIC.exe Token: SeDebugPrivilege 1456 WMIC.exe Token: SeSystemEnvironmentPrivilege 1456 WMIC.exe Token: SeRemoteShutdownPrivilege 1456 WMIC.exe Token: SeUndockPrivilege 1456 WMIC.exe Token: SeManageVolumePrivilege 1456 WMIC.exe Token: 33 1456 WMIC.exe Token: 34 1456 WMIC.exe Token: 35 1456 WMIC.exe Token: SeBackupPrivilege 2224 wbengine.exe Token: SeRestorePrivilege 2224 wbengine.exe Token: SeSecurityPrivilege 2224 wbengine.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
svchost.exepid process 2576 svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe9Jb.exeMX(~Q{9xr.exedescription pid process target process PID 1936 wrote to memory of 2728 1936 8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe 8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe PID 1936 wrote to memory of 2728 1936 8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe 8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe PID 1936 wrote to memory of 2728 1936 8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe 8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe PID 1936 wrote to memory of 2728 1936 8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe 8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe PID 1936 wrote to memory of 2408 1936 8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe 8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe PID 1936 wrote to memory of 2408 1936 8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe 8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe PID 1936 wrote to memory of 2408 1936 8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe 8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe PID 1936 wrote to memory of 2408 1936 8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe 8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe PID 1936 wrote to memory of 2408 1936 8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe 8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe PID 1936 wrote to memory of 2408 1936 8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe 8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe PID 1936 wrote to memory of 2408 1936 8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe 8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe PID 1936 wrote to memory of 2408 1936 8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe 8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe PID 1936 wrote to memory of 2408 1936 8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe 8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe PID 2408 wrote to memory of 3048 2408 8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe certreq.exe PID 2408 wrote to memory of 3048 2408 8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe certreq.exe PID 2408 wrote to memory of 3048 2408 8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe certreq.exe PID 2408 wrote to memory of 3048 2408 8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe certreq.exe PID 2408 wrote to memory of 3048 2408 8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe certreq.exe PID 2408 wrote to memory of 3048 2408 8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe certreq.exe PID 2852 wrote to memory of 2472 2852 9Jb.exe 9Jb.exe PID 2852 wrote to memory of 2472 2852 9Jb.exe 9Jb.exe PID 2852 wrote to memory of 2472 2852 9Jb.exe 9Jb.exe PID 2852 wrote to memory of 2472 2852 9Jb.exe 9Jb.exe PID 2852 wrote to memory of 1960 2852 9Jb.exe 9Jb.exe PID 2852 wrote to memory of 1960 2852 9Jb.exe 9Jb.exe PID 2852 wrote to memory of 1960 2852 9Jb.exe 9Jb.exe PID 2852 wrote to memory of 1960 2852 9Jb.exe 9Jb.exe PID 2852 wrote to memory of 1720 2852 9Jb.exe 9Jb.exe PID 2852 wrote to memory of 1720 2852 9Jb.exe 9Jb.exe PID 2852 wrote to memory of 1720 2852 9Jb.exe 9Jb.exe PID 2852 wrote to memory of 1720 2852 9Jb.exe 9Jb.exe PID 2852 wrote to memory of 2712 2852 9Jb.exe 9Jb.exe PID 2852 wrote to memory of 2712 2852 9Jb.exe 9Jb.exe PID 2852 wrote to memory of 2712 2852 9Jb.exe 9Jb.exe PID 2852 wrote to memory of 2712 2852 9Jb.exe 9Jb.exe PID 2852 wrote to memory of 1944 2852 9Jb.exe 9Jb.exe PID 2852 wrote to memory of 1944 2852 9Jb.exe 9Jb.exe PID 2852 wrote to memory of 1944 2852 9Jb.exe 9Jb.exe PID 2852 wrote to memory of 1944 2852 9Jb.exe 9Jb.exe PID 2852 wrote to memory of 1220 2852 9Jb.exe 9Jb.exe PID 2852 wrote to memory of 1220 2852 9Jb.exe 9Jb.exe PID 2852 wrote to memory of 1220 2852 9Jb.exe 9Jb.exe PID 2852 wrote to memory of 1220 2852 9Jb.exe 9Jb.exe PID 2852 wrote to memory of 1216 2852 9Jb.exe 9Jb.exe PID 2852 wrote to memory of 1216 2852 9Jb.exe 9Jb.exe PID 2852 wrote to memory of 1216 2852 9Jb.exe 9Jb.exe PID 2852 wrote to memory of 1216 2852 9Jb.exe 9Jb.exe PID 2852 wrote to memory of 368 2852 9Jb.exe 9Jb.exe PID 2852 wrote to memory of 368 2852 9Jb.exe 9Jb.exe PID 2852 wrote to memory of 368 2852 9Jb.exe 9Jb.exe PID 2852 wrote to memory of 368 2852 9Jb.exe 9Jb.exe PID 2852 wrote to memory of 2656 2852 9Jb.exe 9Jb.exe PID 2852 wrote to memory of 2656 2852 9Jb.exe 9Jb.exe PID 2852 wrote to memory of 2656 2852 9Jb.exe 9Jb.exe PID 2852 wrote to memory of 2656 2852 9Jb.exe 9Jb.exe PID 2852 wrote to memory of 2748 2852 9Jb.exe 9Jb.exe PID 2852 wrote to memory of 2748 2852 9Jb.exe 9Jb.exe PID 2852 wrote to memory of 2748 2852 9Jb.exe 9Jb.exe PID 2852 wrote to memory of 2748 2852 9Jb.exe 9Jb.exe PID 2340 wrote to memory of 2716 2340 MX(~Q{9xr.exe MX(~Q{9xr.exe PID 2340 wrote to memory of 2716 2340 MX(~Q{9xr.exe MX(~Q{9xr.exe PID 2340 wrote to memory of 2716 2340 MX(~Q{9xr.exe MX(~Q{9xr.exe PID 2340 wrote to memory of 2716 2340 MX(~Q{9xr.exe MX(~Q{9xr.exe PID 2340 wrote to memory of 2716 2340 MX(~Q{9xr.exe MX(~Q{9xr.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe"C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exeC:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe3⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exeC:\Users\Admin\AppData\Local\Temp\8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f.exe3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\system32\certreq.exe"C:\Windows\system32\certreq.exe"2⤵
- Deletes itself
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\F41F.exeC:\Users\Admin\AppData\Local\Temp\F41F.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\F41F.exeC:\Users\Admin\AppData\Local\Temp\F41F.exe3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\F41F.exe"C:\Users\Admin\AppData\Local\Temp\F41F.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\F41F.exeC:\Users\Admin\AppData\Local\Temp\F41F.exe5⤵
- Executes dropped EXE
PID:1404 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"4⤵PID:2336
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet5⤵
- Interacts with shadow copies
PID:2068 -
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1456 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures5⤵
- Modifies boot configuration data using bcdedit
PID:2832 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no5⤵
- Modifies boot configuration data using bcdedit
PID:1428 -
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet5⤵
- Deletes backup catalog
PID:1828 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"4⤵PID:2316
-
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off5⤵
- Modifies Windows Firewall
PID:2260 -
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable5⤵
- Modifies Windows Firewall
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\F74B.exeC:\Users\Admin\AppData\Local\Temp\F74B.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\F74B.exe"C:\Users\Admin\AppData\Local\Temp\F74B.exe"3⤵PID:3012
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe2⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:828 -
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵PID:884
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe2⤵PID:2292
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe2⤵PID:1596
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe2⤵PID:2640
-
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵PID:1140
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe2⤵PID:2752
-
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵PID:2712
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe2⤵PID:2732
-
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵PID:908
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe2⤵PID:1912
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe2⤵PID:1888
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe2⤵PID:2780
-
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵PID:2184
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe2⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\4672.tmp\svchost.exeC:\Users\Admin\AppData\Local\Temp\4672.tmp\svchost.exe -debug3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of FindShellTrayWindow
PID:2576 -
C:\Windows\SysWOW64\ctfmon.exectfmon.exe4⤵PID:3008
-
C:\Users\Admin\AppData\Local\Microsoft\9Jb.exe"C:\Users\Admin\AppData\Local\Microsoft\9Jb.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Microsoft\9Jb.exeC:\Users\Admin\AppData\Local\Microsoft\9Jb.exe2⤵
- Executes dropped EXE
PID:2472 -
C:\Users\Admin\AppData\Local\Microsoft\9Jb.exeC:\Users\Admin\AppData\Local\Microsoft\9Jb.exe2⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Microsoft\9Jb.exeC:\Users\Admin\AppData\Local\Microsoft\9Jb.exe2⤵
- Executes dropped EXE
PID:1720 -
C:\Users\Admin\AppData\Local\Microsoft\9Jb.exeC:\Users\Admin\AppData\Local\Microsoft\9Jb.exe2⤵
- Executes dropped EXE
PID:1960 -
C:\Users\Admin\AppData\Local\Microsoft\9Jb.exeC:\Users\Admin\AppData\Local\Microsoft\9Jb.exe2⤵
- Executes dropped EXE
PID:1944 -
C:\Users\Admin\AppData\Local\Microsoft\9Jb.exeC:\Users\Admin\AppData\Local\Microsoft\9Jb.exe2⤵
- Executes dropped EXE
PID:1220 -
C:\Users\Admin\AppData\Local\Microsoft\9Jb.exeC:\Users\Admin\AppData\Local\Microsoft\9Jb.exe2⤵
- Executes dropped EXE
PID:2748 -
C:\Users\Admin\AppData\Local\Microsoft\9Jb.exeC:\Users\Admin\AppData\Local\Microsoft\9Jb.exe2⤵
- Executes dropped EXE
PID:2656 -
C:\Users\Admin\AppData\Local\Microsoft\9Jb.exeC:\Users\Admin\AppData\Local\Microsoft\9Jb.exe2⤵
- Executes dropped EXE
PID:368 -
C:\Users\Admin\AppData\Local\Microsoft\9Jb.exeC:\Users\Admin\AppData\Local\Microsoft\9Jb.exe2⤵
- Executes dropped EXE
PID:1216
-
C:\Users\Admin\AppData\Local\Microsoft\MX(~Q{9xr.exe"C:\Users\Admin\AppData\Local\Microsoft\MX(~Q{9xr.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Microsoft\MX(~Q{9xr.exeC:\Users\Admin\AppData\Local\Microsoft\MX(~Q{9xr.exe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2716
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2440
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2224
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:2120
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:2316
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Indicator Removal
3File Deletion
3Modify Registry
1Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab.id[2B47469F-3483].[[email protected]].8base
Filesize143.1MB
MD54a5d605d5b72b0c02c318fb057f89e95
SHA11dbc75194bca424055375a6a820e821cb840c1f2
SHA25604b65e97fca0a4cf17f8f6dc0281ce742bd2634dc13b4884c7f62c4db6766626
SHA5124145916c7fa82a2f425e411cc6546bbcec1b30894fd38c65ffe224bedde9a2e251a9857548620feafa5afa92360d99164e197dbc6a80ab81d22526695931e3a6
-
Filesize
227KB
MD52544c951135bba7846e943cf22a7eb59
SHA1099bf354174088d2c0cf68638bb441be60d7775f
SHA25614eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff
-
Filesize
227KB
MD52544c951135bba7846e943cf22a7eb59
SHA1099bf354174088d2c0cf68638bb441be60d7775f
SHA25614eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff
-
Filesize
227KB
MD52544c951135bba7846e943cf22a7eb59
SHA1099bf354174088d2c0cf68638bb441be60d7775f
SHA25614eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff
-
Filesize
227KB
MD52544c951135bba7846e943cf22a7eb59
SHA1099bf354174088d2c0cf68638bb441be60d7775f
SHA25614eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff
-
Filesize
227KB
MD52544c951135bba7846e943cf22a7eb59
SHA1099bf354174088d2c0cf68638bb441be60d7775f
SHA25614eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff
-
Filesize
227KB
MD52544c951135bba7846e943cf22a7eb59
SHA1099bf354174088d2c0cf68638bb441be60d7775f
SHA25614eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff
-
Filesize
227KB
MD52544c951135bba7846e943cf22a7eb59
SHA1099bf354174088d2c0cf68638bb441be60d7775f
SHA25614eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff
-
Filesize
227KB
MD52544c951135bba7846e943cf22a7eb59
SHA1099bf354174088d2c0cf68638bb441be60d7775f
SHA25614eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff
-
Filesize
227KB
MD52544c951135bba7846e943cf22a7eb59
SHA1099bf354174088d2c0cf68638bb441be60d7775f
SHA25614eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff
-
Filesize
227KB
MD52544c951135bba7846e943cf22a7eb59
SHA1099bf354174088d2c0cf68638bb441be60d7775f
SHA25614eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff
-
Filesize
227KB
MD52544c951135bba7846e943cf22a7eb59
SHA1099bf354174088d2c0cf68638bb441be60d7775f
SHA25614eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff
-
Filesize
227KB
MD52544c951135bba7846e943cf22a7eb59
SHA1099bf354174088d2c0cf68638bb441be60d7775f
SHA25614eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff
-
Filesize
389KB
MD54a97cfd7be5c68006c2e09dd71343ecd
SHA1db5d13f2768a73eb8f72fe08575c9911b49abfc5
SHA2565a7d72de3bb021b832bc1de6cd53e0b1202950b95d16bb6d197302d7714eb24e
SHA512a7143c491ccb8506d257d45aeadc7bb37b3965c8f325d0e0275d333e9827caecb766391e0cfdc4d9674804b35bcfc554cf6f41672d139e8d5af42b4e3dc569e9
-
Filesize
389KB
MD54a97cfd7be5c68006c2e09dd71343ecd
SHA1db5d13f2768a73eb8f72fe08575c9911b49abfc5
SHA2565a7d72de3bb021b832bc1de6cd53e0b1202950b95d16bb6d197302d7714eb24e
SHA512a7143c491ccb8506d257d45aeadc7bb37b3965c8f325d0e0275d333e9827caecb766391e0cfdc4d9674804b35bcfc554cf6f41672d139e8d5af42b4e3dc569e9
-
Filesize
389KB
MD54a97cfd7be5c68006c2e09dd71343ecd
SHA1db5d13f2768a73eb8f72fe08575c9911b49abfc5
SHA2565a7d72de3bb021b832bc1de6cd53e0b1202950b95d16bb6d197302d7714eb24e
SHA512a7143c491ccb8506d257d45aeadc7bb37b3965c8f325d0e0275d333e9827caecb766391e0cfdc4d9674804b35bcfc554cf6f41672d139e8d5af42b4e3dc569e9
-
Filesize
798KB
MD590aadf2247149996ae443e2c82af3730
SHA1050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be
-
Filesize
798KB
MD590aadf2247149996ae443e2c82af3730
SHA1050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be
-
Filesize
798KB
MD590aadf2247149996ae443e2c82af3730
SHA1050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be
-
Filesize
284KB
MD5dc78f4828dbb4c0da15f789d059d700c
SHA1c9375db9533f60612b9d4bc19965fb797e88bf6b
SHA2568f2da1f44d85506d69b1a4573f9bb9a62a61591d284638469af67fb2591c160e
SHA5126455549a5d58a222352c89665f0f1a2606c680cf40a4e94049dd11328239080e1b32f0ec9ef779fa8c7ba55c7774743a74d3fc263783ae7628b7905a330e7b15
-
Filesize
284KB
MD5dc78f4828dbb4c0da15f789d059d700c
SHA1c9375db9533f60612b9d4bc19965fb797e88bf6b
SHA2568f2da1f44d85506d69b1a4573f9bb9a62a61591d284638469af67fb2591c160e
SHA5126455549a5d58a222352c89665f0f1a2606c680cf40a4e94049dd11328239080e1b32f0ec9ef779fa8c7ba55c7774743a74d3fc263783ae7628b7905a330e7b15
-
Filesize
284KB
MD5dc78f4828dbb4c0da15f789d059d700c
SHA1c9375db9533f60612b9d4bc19965fb797e88bf6b
SHA2568f2da1f44d85506d69b1a4573f9bb9a62a61591d284638469af67fb2591c160e
SHA5126455549a5d58a222352c89665f0f1a2606c680cf40a4e94049dd11328239080e1b32f0ec9ef779fa8c7ba55c7774743a74d3fc263783ae7628b7905a330e7b15
-
Filesize
284KB
MD5dc78f4828dbb4c0da15f789d059d700c
SHA1c9375db9533f60612b9d4bc19965fb797e88bf6b
SHA2568f2da1f44d85506d69b1a4573f9bb9a62a61591d284638469af67fb2591c160e
SHA5126455549a5d58a222352c89665f0f1a2606c680cf40a4e94049dd11328239080e1b32f0ec9ef779fa8c7ba55c7774743a74d3fc263783ae7628b7905a330e7b15
-
Filesize
284KB
MD5dc78f4828dbb4c0da15f789d059d700c
SHA1c9375db9533f60612b9d4bc19965fb797e88bf6b
SHA2568f2da1f44d85506d69b1a4573f9bb9a62a61591d284638469af67fb2591c160e
SHA5126455549a5d58a222352c89665f0f1a2606c680cf40a4e94049dd11328239080e1b32f0ec9ef779fa8c7ba55c7774743a74d3fc263783ae7628b7905a330e7b15
-
Filesize
468KB
MD520bb118569b859e64feaaf30227e04b8
SHA13fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c
-
Filesize
468KB
MD520bb118569b859e64feaaf30227e04b8
SHA13fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c
-
Filesize
284KB
MD5dc78f4828dbb4c0da15f789d059d700c
SHA1c9375db9533f60612b9d4bc19965fb797e88bf6b
SHA2568f2da1f44d85506d69b1a4573f9bb9a62a61591d284638469af67fb2591c160e
SHA5126455549a5d58a222352c89665f0f1a2606c680cf40a4e94049dd11328239080e1b32f0ec9ef779fa8c7ba55c7774743a74d3fc263783ae7628b7905a330e7b15
-
Filesize
798KB
MD590aadf2247149996ae443e2c82af3730
SHA1050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be
-
Filesize
798KB
MD590aadf2247149996ae443e2c82af3730
SHA1050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be
-
Filesize
284KB
MD5dc78f4828dbb4c0da15f789d059d700c
SHA1c9375db9533f60612b9d4bc19965fb797e88bf6b
SHA2568f2da1f44d85506d69b1a4573f9bb9a62a61591d284638469af67fb2591c160e
SHA5126455549a5d58a222352c89665f0f1a2606c680cf40a4e94049dd11328239080e1b32f0ec9ef779fa8c7ba55c7774743a74d3fc263783ae7628b7905a330e7b15
-
Filesize
284KB
MD5dc78f4828dbb4c0da15f789d059d700c
SHA1c9375db9533f60612b9d4bc19965fb797e88bf6b
SHA2568f2da1f44d85506d69b1a4573f9bb9a62a61591d284638469af67fb2591c160e
SHA5126455549a5d58a222352c89665f0f1a2606c680cf40a4e94049dd11328239080e1b32f0ec9ef779fa8c7ba55c7774743a74d3fc263783ae7628b7905a330e7b15
-
Filesize
468KB
MD520bb118569b859e64feaaf30227e04b8
SHA13fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c