Analysis
-
max time kernel
83s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
13-10-2023 03:53
Static task
static1
Behavioral task
behavioral1
Sample
e6f506f57365deb1b24b84eafbd9271f.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
e6f506f57365deb1b24b84eafbd9271f.exe
Resource
win10v2004-20230915-en
General
-
Target
e6f506f57365deb1b24b84eafbd9271f.exe
-
Size
468KB
-
MD5
e6f506f57365deb1b24b84eafbd9271f
-
SHA1
d120720527f6d02f2c6e058bc95cc18d8c23f269
-
SHA256
ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6
-
SHA512
3273f5720d13ae0c77eb9e35ef52368f187b4acfe1e40471629c6e51e0f7c442f420bd0cbbe1f5e21918760fdd260cb86b7086eb93d92e28d00b502cd3e066e9
-
SSDEEP
12288:zPmdD7nWjmGR5iErreKOOkLsxhDzfrroATRwJJ:7mN7u5iEKOKalroATRwX
Malware Config
Extracted
smokeloader
2022
http://servermlogs27.xyz/statweb255/
http://servmblog45.xyz/statweb255/
http://demblog575.xyz/statweb255/
http://admlogs85x.xyz/statweb255/
http://blogmstat389.xyz/statweb255/
http://blogmstat255.xyz/statweb255/
Signatures
-
Ammyy Admin
Remote admin tool with various capabilities.
-
AmmyyAdmin payload 2 IoCs
resource yara_rule behavioral2/files/0x000600000002320c-817.dat family_ammyyadmin behavioral2/files/0x000600000002320c-845.dat family_ammyyadmin -
Detect rhadamanthys stealer shellcode 6 IoCs
resource yara_rule behavioral2/memory/2016-14-0x0000000003290000-0x0000000003690000-memory.dmp family_rhadamanthys behavioral2/memory/2016-15-0x0000000003290000-0x0000000003690000-memory.dmp family_rhadamanthys behavioral2/memory/2016-16-0x0000000003290000-0x0000000003690000-memory.dmp family_rhadamanthys behavioral2/memory/2016-17-0x0000000003290000-0x0000000003690000-memory.dmp family_rhadamanthys behavioral2/memory/2016-27-0x0000000003290000-0x0000000003690000-memory.dmp family_rhadamanthys behavioral2/memory/2016-29-0x0000000003290000-0x0000000003690000-memory.dmp family_rhadamanthys -
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 2016 created 3200 2016 e6f506f57365deb1b24b84eafbd9271f.exe 48 -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 2988 bcdedit.exe 3836 bcdedit.exe -
pid Process 2816 wbadmin.exe -
Downloads MZ/PE file
-
Modifies Windows Firewall 1 TTPs 2 IoCs
pid Process 4104 netsh.exe 2608 netsh.exe -
Deletes itself 1 IoCs
pid Process 4924 certreq.exe -
Executes dropped EXE 19 IoCs
pid Process 1648 992@6Nx3{{.exe 5084 f{REx(.exe 3036 992@6Nx3{{.exe 960 992@6Nx3{{.exe 4572 992@6Nx3{{.exe 3664 992@6Nx3{{.exe 832 992@6Nx3{{.exe 1952 992@6Nx3{{.exe 2980 992@6Nx3{{.exe 3516 992@6Nx3{{.exe 3172 992@6Nx3{{.exe 2300 f{REx(.exe 768 992@6Nx3{{.exe 4628 f{REx(.exe 4144 F8A3.exe 2732 F9FC.exe 4476 F8A3.exe 3468 F8A3.exe 1708 F8A3.exe -
Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook certreq.exe Key opened \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook certreq.exe Key opened \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook certreq.exe Key opened \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook certreq.exe Key opened \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook certreq.exe Key opened \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook certreq.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2504 set thread context of 2016 2504 e6f506f57365deb1b24b84eafbd9271f.exe 83 PID 5084 set thread context of 4628 5084 f{REx(.exe 108 PID 4144 set thread context of 1708 4144 F8A3.exe 112 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f{REx(.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f{REx(.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f{REx(.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString certreq.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 certreq.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2212 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2016 e6f506f57365deb1b24b84eafbd9271f.exe 2016 e6f506f57365deb1b24b84eafbd9271f.exe 2016 e6f506f57365deb1b24b84eafbd9271f.exe 2016 e6f506f57365deb1b24b84eafbd9271f.exe 4924 certreq.exe 4924 certreq.exe 4924 certreq.exe 4924 certreq.exe 1648 992@6Nx3{{.exe 1648 992@6Nx3{{.exe 1648 992@6Nx3{{.exe 1648 992@6Nx3{{.exe 1648 992@6Nx3{{.exe 1648 992@6Nx3{{.exe 1648 992@6Nx3{{.exe 1648 992@6Nx3{{.exe 1648 992@6Nx3{{.exe 1648 992@6Nx3{{.exe 1648 992@6Nx3{{.exe 1648 992@6Nx3{{.exe 1648 992@6Nx3{{.exe 1648 992@6Nx3{{.exe 1648 992@6Nx3{{.exe 1648 992@6Nx3{{.exe 1648 992@6Nx3{{.exe 1648 992@6Nx3{{.exe 5084 f{REx(.exe 5084 f{REx(.exe 1648 992@6Nx3{{.exe 1648 992@6Nx3{{.exe 4628 f{REx(.exe 4628 f{REx(.exe 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE 3200 Explorer.EXE -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4628 f{REx(.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2504 e6f506f57365deb1b24b84eafbd9271f.exe Token: SeDebugPrivilege 1648 992@6Nx3{{.exe Token: SeDebugPrivilege 5084 f{REx(.exe Token: SeDebugPrivilege 4144 F8A3.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2504 wrote to memory of 2016 2504 e6f506f57365deb1b24b84eafbd9271f.exe 83 PID 2504 wrote to memory of 2016 2504 e6f506f57365deb1b24b84eafbd9271f.exe 83 PID 2504 wrote to memory of 2016 2504 e6f506f57365deb1b24b84eafbd9271f.exe 83 PID 2504 wrote to memory of 2016 2504 e6f506f57365deb1b24b84eafbd9271f.exe 83 PID 2504 wrote to memory of 2016 2504 e6f506f57365deb1b24b84eafbd9271f.exe 83 PID 2504 wrote to memory of 2016 2504 e6f506f57365deb1b24b84eafbd9271f.exe 83 PID 2504 wrote to memory of 2016 2504 e6f506f57365deb1b24b84eafbd9271f.exe 83 PID 2504 wrote to memory of 2016 2504 e6f506f57365deb1b24b84eafbd9271f.exe 83 PID 2016 wrote to memory of 4924 2016 e6f506f57365deb1b24b84eafbd9271f.exe 89 PID 2016 wrote to memory of 4924 2016 e6f506f57365deb1b24b84eafbd9271f.exe 89 PID 2016 wrote to memory of 4924 2016 e6f506f57365deb1b24b84eafbd9271f.exe 89 PID 2016 wrote to memory of 4924 2016 e6f506f57365deb1b24b84eafbd9271f.exe 89 PID 1648 wrote to memory of 3036 1648 992@6Nx3{{.exe 97 PID 1648 wrote to memory of 3036 1648 992@6Nx3{{.exe 97 PID 1648 wrote to memory of 3036 1648 992@6Nx3{{.exe 97 PID 1648 wrote to memory of 960 1648 992@6Nx3{{.exe 101 PID 1648 wrote to memory of 960 1648 992@6Nx3{{.exe 101 PID 1648 wrote to memory of 960 1648 992@6Nx3{{.exe 101 PID 1648 wrote to memory of 4572 1648 992@6Nx3{{.exe 100 PID 1648 wrote to memory of 4572 1648 992@6Nx3{{.exe 100 PID 1648 wrote to memory of 4572 1648 992@6Nx3{{.exe 100 PID 1648 wrote to memory of 3664 1648 992@6Nx3{{.exe 99 PID 1648 wrote to memory of 3664 1648 992@6Nx3{{.exe 99 PID 1648 wrote to memory of 3664 1648 992@6Nx3{{.exe 99 PID 1648 wrote to memory of 832 1648 992@6Nx3{{.exe 98 PID 1648 wrote to memory of 832 1648 992@6Nx3{{.exe 98 PID 1648 wrote to memory of 832 1648 992@6Nx3{{.exe 98 PID 1648 wrote to memory of 1952 1648 992@6Nx3{{.exe 103 PID 1648 wrote to memory of 1952 1648 992@6Nx3{{.exe 103 PID 1648 wrote to memory of 1952 1648 992@6Nx3{{.exe 103 PID 1648 wrote to memory of 3516 1648 992@6Nx3{{.exe 102 PID 1648 wrote to memory of 3516 1648 992@6Nx3{{.exe 102 PID 1648 wrote to memory of 3516 1648 992@6Nx3{{.exe 102 PID 1648 wrote to memory of 2980 1648 992@6Nx3{{.exe 104 PID 1648 wrote to memory of 2980 1648 992@6Nx3{{.exe 104 PID 1648 wrote to memory of 2980 1648 992@6Nx3{{.exe 104 PID 1648 wrote to memory of 3172 1648 992@6Nx3{{.exe 105 PID 1648 wrote to memory of 3172 1648 992@6Nx3{{.exe 105 PID 1648 wrote to memory of 3172 1648 992@6Nx3{{.exe 105 PID 1648 wrote to memory of 768 1648 992@6Nx3{{.exe 106 PID 1648 wrote to memory of 768 1648 992@6Nx3{{.exe 106 PID 1648 wrote to memory of 768 1648 992@6Nx3{{.exe 106 PID 5084 wrote to memory of 2300 5084 f{REx(.exe 107 PID 5084 wrote to memory of 2300 5084 f{REx(.exe 107 PID 5084 wrote to memory of 2300 5084 f{REx(.exe 107 PID 5084 wrote to memory of 4628 5084 f{REx(.exe 108 PID 5084 wrote to memory of 4628 5084 f{REx(.exe 108 PID 5084 wrote to memory of 4628 5084 f{REx(.exe 108 PID 5084 wrote to memory of 4628 5084 f{REx(.exe 108 PID 5084 wrote to memory of 4628 5084 f{REx(.exe 108 PID 5084 wrote to memory of 4628 5084 f{REx(.exe 108 PID 3200 wrote to memory of 4144 3200 Explorer.EXE 109 PID 3200 wrote to memory of 4144 3200 Explorer.EXE 109 PID 3200 wrote to memory of 4144 3200 Explorer.EXE 109 PID 3200 wrote to memory of 2732 3200 Explorer.EXE 110 PID 3200 wrote to memory of 2732 3200 Explorer.EXE 110 PID 3200 wrote to memory of 2732 3200 Explorer.EXE 110 PID 4144 wrote to memory of 4476 4144 F8A3.exe 111 PID 4144 wrote to memory of 4476 4144 F8A3.exe 111 PID 4144 wrote to memory of 4476 4144 F8A3.exe 111 PID 4144 wrote to memory of 3468 4144 F8A3.exe 114 PID 4144 wrote to memory of 3468 4144 F8A3.exe 114 PID 4144 wrote to memory of 3468 4144 F8A3.exe 114 PID 4144 wrote to memory of 1708 4144 F8A3.exe 112 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook certreq.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook certreq.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\e6f506f57365deb1b24b84eafbd9271f.exe"C:\Users\Admin\AppData\Local\Temp\e6f506f57365deb1b24b84eafbd9271f.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\e6f506f57365deb1b24b84eafbd9271f.exeC:\Users\Admin\AppData\Local\Temp\e6f506f57365deb1b24b84eafbd9271f.exe3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2016
-
-
-
C:\Windows\system32\certreq.exe"C:\Windows\system32\certreq.exe"2⤵
- Deletes itself
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path
PID:4924
-
-
C:\Users\Admin\AppData\Local\Temp\F8A3.exeC:\Users\Admin\AppData\Local\Temp\F8A3.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\F8A3.exeC:\Users\Admin\AppData\Local\Temp\F8A3.exe3⤵
- Executes dropped EXE
PID:4476
-
-
C:\Users\Admin\AppData\Local\Temp\F8A3.exeC:\Users\Admin\AppData\Local\Temp\F8A3.exe3⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\F8A3.exe"C:\Users\Admin\AppData\Local\Temp\F8A3.exe"4⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\F8A3.exeC:\Users\Admin\AppData\Local\Temp\F8A3.exe5⤵PID:1016
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"4⤵PID:1964
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable5⤵
- Modifies Windows Firewall
PID:2608
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"4⤵PID:4896
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete5⤵PID:1800
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures5⤵
- Modifies boot configuration data using bcdedit
PID:2988
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no5⤵
- Modifies boot configuration data using bcdedit
PID:3836
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet5⤵
- Deletes backup catalog
PID:2816
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\F8A3.exeC:\Users\Admin\AppData\Local\Temp\F8A3.exe3⤵
- Executes dropped EXE
PID:3468
-
-
-
C:\Users\Admin\AppData\Local\Temp\F9FC.exeC:\Users\Admin\AppData\Local\Temp\F9FC.exe2⤵
- Executes dropped EXE
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\F9FC.exe"C:\Users\Admin\AppData\Local\Temp\F9FC.exe"3⤵PID:4116
-
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe2⤵PID:1044
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵PID:4620
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe2⤵PID:3216
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe2⤵PID:748
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe2⤵PID:1852
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵PID:2292
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe2⤵PID:3056
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵PID:980
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe2⤵PID:4640
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵PID:1068
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe2⤵PID:4864
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe2⤵PID:552
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe2⤵PID:3772
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵PID:2776
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe2⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\38D9.tmp\svchost.exeC:\Users\Admin\AppData\Local\Temp\38D9.tmp\svchost.exe -debug3⤵PID:3760
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\992@6Nx3{{.exe"C:\Users\Admin\AppData\Local\Microsoft\992@6Nx3{{.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Microsoft\992@6Nx3{{.exeC:\Users\Admin\AppData\Local\Microsoft\992@6Nx3{{.exe2⤵
- Executes dropped EXE
PID:3036
-
-
C:\Users\Admin\AppData\Local\Microsoft\992@6Nx3{{.exeC:\Users\Admin\AppData\Local\Microsoft\992@6Nx3{{.exe2⤵
- Executes dropped EXE
PID:832
-
-
C:\Users\Admin\AppData\Local\Microsoft\992@6Nx3{{.exeC:\Users\Admin\AppData\Local\Microsoft\992@6Nx3{{.exe2⤵
- Executes dropped EXE
PID:3664
-
-
C:\Users\Admin\AppData\Local\Microsoft\992@6Nx3{{.exeC:\Users\Admin\AppData\Local\Microsoft\992@6Nx3{{.exe2⤵
- Executes dropped EXE
PID:4572
-
-
C:\Users\Admin\AppData\Local\Microsoft\992@6Nx3{{.exeC:\Users\Admin\AppData\Local\Microsoft\992@6Nx3{{.exe2⤵
- Executes dropped EXE
PID:960
-
-
C:\Users\Admin\AppData\Local\Microsoft\992@6Nx3{{.exeC:\Users\Admin\AppData\Local\Microsoft\992@6Nx3{{.exe2⤵
- Executes dropped EXE
PID:3516
-
-
C:\Users\Admin\AppData\Local\Microsoft\992@6Nx3{{.exeC:\Users\Admin\AppData\Local\Microsoft\992@6Nx3{{.exe2⤵
- Executes dropped EXE
PID:1952
-
-
C:\Users\Admin\AppData\Local\Microsoft\992@6Nx3{{.exeC:\Users\Admin\AppData\Local\Microsoft\992@6Nx3{{.exe2⤵
- Executes dropped EXE
PID:2980
-
-
C:\Users\Admin\AppData\Local\Microsoft\992@6Nx3{{.exeC:\Users\Admin\AppData\Local\Microsoft\992@6Nx3{{.exe2⤵
- Executes dropped EXE
PID:3172
-
-
C:\Users\Admin\AppData\Local\Microsoft\992@6Nx3{{.exeC:\Users\Admin\AppData\Local\Microsoft\992@6Nx3{{.exe2⤵
- Executes dropped EXE
PID:768
-
-
C:\Users\Admin\AppData\Local\Microsoft\f{REx(.exe"C:\Users\Admin\AppData\Local\Microsoft\f{REx(.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Microsoft\f{REx(.exeC:\Users\Admin\AppData\Local\Microsoft\f{REx(.exe2⤵
- Executes dropped EXE
PID:2300
-
-
C:\Users\Admin\AppData\Local\Microsoft\f{REx(.exeC:\Users\Admin\AppData\Local\Microsoft\f{REx(.exe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4628
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet1⤵
- Interacts with shadow copies
PID:2212
-
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off1⤵
- Modifies Windows Firewall
PID:4104
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:1452
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵PID:4408
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:3264
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:1412
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id[DD1FA420-3483].[[email protected]].8base
Filesize3.2MB
MD5fee7f776ae0d0263ed055194521146e0
SHA1342bb087c2bf10defba2cbede25598177bb36028
SHA2560256bc35afd06245baa0b47302686d5169f71f3456560ae7fb8e7d673eea412b
SHA5121bbb58d38755ba3db032b6144dc7853e153c42d2bb325ce1cf1376f27addfdb24cc52377915ba1d8c0633db818d15abf5579d035ff03ad51127a5aa904a126c2
-
Filesize
284KB
MD5dc78f4828dbb4c0da15f789d059d700c
SHA1c9375db9533f60612b9d4bc19965fb797e88bf6b
SHA2568f2da1f44d85506d69b1a4573f9bb9a62a61591d284638469af67fb2591c160e
SHA5126455549a5d58a222352c89665f0f1a2606c680cf40a4e94049dd11328239080e1b32f0ec9ef779fa8c7ba55c7774743a74d3fc263783ae7628b7905a330e7b15
-
Filesize
227KB
MD52544c951135bba7846e943cf22a7eb59
SHA1099bf354174088d2c0cf68638bb441be60d7775f
SHA25614eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff
-
Filesize
227KB
MD52544c951135bba7846e943cf22a7eb59
SHA1099bf354174088d2c0cf68638bb441be60d7775f
SHA25614eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff
-
Filesize
227KB
MD52544c951135bba7846e943cf22a7eb59
SHA1099bf354174088d2c0cf68638bb441be60d7775f
SHA25614eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff
-
Filesize
227KB
MD52544c951135bba7846e943cf22a7eb59
SHA1099bf354174088d2c0cf68638bb441be60d7775f
SHA25614eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff
-
Filesize
227KB
MD52544c951135bba7846e943cf22a7eb59
SHA1099bf354174088d2c0cf68638bb441be60d7775f
SHA25614eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff
-
Filesize
227KB
MD52544c951135bba7846e943cf22a7eb59
SHA1099bf354174088d2c0cf68638bb441be60d7775f
SHA25614eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff
-
Filesize
227KB
MD52544c951135bba7846e943cf22a7eb59
SHA1099bf354174088d2c0cf68638bb441be60d7775f
SHA25614eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff
-
Filesize
227KB
MD52544c951135bba7846e943cf22a7eb59
SHA1099bf354174088d2c0cf68638bb441be60d7775f
SHA25614eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff
-
Filesize
227KB
MD52544c951135bba7846e943cf22a7eb59
SHA1099bf354174088d2c0cf68638bb441be60d7775f
SHA25614eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff
-
Filesize
227KB
MD52544c951135bba7846e943cf22a7eb59
SHA1099bf354174088d2c0cf68638bb441be60d7775f
SHA25614eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff
-
Filesize
227KB
MD52544c951135bba7846e943cf22a7eb59
SHA1099bf354174088d2c0cf68638bb441be60d7775f
SHA25614eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff
-
Filesize
227KB
MD52544c951135bba7846e943cf22a7eb59
SHA1099bf354174088d2c0cf68638bb441be60d7775f
SHA25614eed4f96b35da8dec987d582a64b691a3be3f0f3e6a0ccab47ba4b5717969a9
SHA512e4a44e1b0969dce3cd2181ca77ed4dce6efa2a5510ac8136309402391a2d09c2cbf78c8261a895edcdca5dcb9c28c437f63ff02d2ddea0b7a2bd49e9d1ca2bff
-
Filesize
927B
MD54a911455784f74e368a4c2c7876d76f4
SHA1a1700a0849ffb4f26671eb76da2489946b821c34
SHA256264098e15b5b33d425f3b76e45b7976b58f917048125041135f7e60d8151108c
SHA5124617591400409e1930195795a55e20d5f063042bb3e9fd1955099066e507b6ac8a1e3ae54cc42418e2639149b31bf7e58cd5743670d9030a15e29f14d813815d
-
Filesize
389KB
MD54a97cfd7be5c68006c2e09dd71343ecd
SHA1db5d13f2768a73eb8f72fe08575c9911b49abfc5
SHA2565a7d72de3bb021b832bc1de6cd53e0b1202950b95d16bb6d197302d7714eb24e
SHA512a7143c491ccb8506d257d45aeadc7bb37b3965c8f325d0e0275d333e9827caecb766391e0cfdc4d9674804b35bcfc554cf6f41672d139e8d5af42b4e3dc569e9
-
Filesize
389KB
MD54a97cfd7be5c68006c2e09dd71343ecd
SHA1db5d13f2768a73eb8f72fe08575c9911b49abfc5
SHA2565a7d72de3bb021b832bc1de6cd53e0b1202950b95d16bb6d197302d7714eb24e
SHA512a7143c491ccb8506d257d45aeadc7bb37b3965c8f325d0e0275d333e9827caecb766391e0cfdc4d9674804b35bcfc554cf6f41672d139e8d5af42b4e3dc569e9
-
Filesize
389KB
MD54a97cfd7be5c68006c2e09dd71343ecd
SHA1db5d13f2768a73eb8f72fe08575c9911b49abfc5
SHA2565a7d72de3bb021b832bc1de6cd53e0b1202950b95d16bb6d197302d7714eb24e
SHA512a7143c491ccb8506d257d45aeadc7bb37b3965c8f325d0e0275d333e9827caecb766391e0cfdc4d9674804b35bcfc554cf6f41672d139e8d5af42b4e3dc569e9
-
Filesize
389KB
MD54a97cfd7be5c68006c2e09dd71343ecd
SHA1db5d13f2768a73eb8f72fe08575c9911b49abfc5
SHA2565a7d72de3bb021b832bc1de6cd53e0b1202950b95d16bb6d197302d7714eb24e
SHA512a7143c491ccb8506d257d45aeadc7bb37b3965c8f325d0e0275d333e9827caecb766391e0cfdc4d9674804b35bcfc554cf6f41672d139e8d5af42b4e3dc569e9
-
Filesize
798KB
MD590aadf2247149996ae443e2c82af3730
SHA1050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be
-
Filesize
798KB
MD590aadf2247149996ae443e2c82af3730
SHA1050b7eba825412b24e3f02d76d7da5ae97e10502
SHA256ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
SHA512eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be
-
Filesize
284KB
MD5dc78f4828dbb4c0da15f789d059d700c
SHA1c9375db9533f60612b9d4bc19965fb797e88bf6b
SHA2568f2da1f44d85506d69b1a4573f9bb9a62a61591d284638469af67fb2591c160e
SHA5126455549a5d58a222352c89665f0f1a2606c680cf40a4e94049dd11328239080e1b32f0ec9ef779fa8c7ba55c7774743a74d3fc263783ae7628b7905a330e7b15
-
Filesize
284KB
MD5dc78f4828dbb4c0da15f789d059d700c
SHA1c9375db9533f60612b9d4bc19965fb797e88bf6b
SHA2568f2da1f44d85506d69b1a4573f9bb9a62a61591d284638469af67fb2591c160e
SHA5126455549a5d58a222352c89665f0f1a2606c680cf40a4e94049dd11328239080e1b32f0ec9ef779fa8c7ba55c7774743a74d3fc263783ae7628b7905a330e7b15
-
Filesize
284KB
MD5dc78f4828dbb4c0da15f789d059d700c
SHA1c9375db9533f60612b9d4bc19965fb797e88bf6b
SHA2568f2da1f44d85506d69b1a4573f9bb9a62a61591d284638469af67fb2591c160e
SHA5126455549a5d58a222352c89665f0f1a2606c680cf40a4e94049dd11328239080e1b32f0ec9ef779fa8c7ba55c7774743a74d3fc263783ae7628b7905a330e7b15
-
Filesize
284KB
MD5dc78f4828dbb4c0da15f789d059d700c
SHA1c9375db9533f60612b9d4bc19965fb797e88bf6b
SHA2568f2da1f44d85506d69b1a4573f9bb9a62a61591d284638469af67fb2591c160e
SHA5126455549a5d58a222352c89665f0f1a2606c680cf40a4e94049dd11328239080e1b32f0ec9ef779fa8c7ba55c7774743a74d3fc263783ae7628b7905a330e7b15
-
Filesize
284KB
MD5dc78f4828dbb4c0da15f789d059d700c
SHA1c9375db9533f60612b9d4bc19965fb797e88bf6b
SHA2568f2da1f44d85506d69b1a4573f9bb9a62a61591d284638469af67fb2591c160e
SHA5126455549a5d58a222352c89665f0f1a2606c680cf40a4e94049dd11328239080e1b32f0ec9ef779fa8c7ba55c7774743a74d3fc263783ae7628b7905a330e7b15
-
Filesize
284KB
MD5dc78f4828dbb4c0da15f789d059d700c
SHA1c9375db9533f60612b9d4bc19965fb797e88bf6b
SHA2568f2da1f44d85506d69b1a4573f9bb9a62a61591d284638469af67fb2591c160e
SHA5126455549a5d58a222352c89665f0f1a2606c680cf40a4e94049dd11328239080e1b32f0ec9ef779fa8c7ba55c7774743a74d3fc263783ae7628b7905a330e7b15
-
Filesize
284KB
MD5dc78f4828dbb4c0da15f789d059d700c
SHA1c9375db9533f60612b9d4bc19965fb797e88bf6b
SHA2568f2da1f44d85506d69b1a4573f9bb9a62a61591d284638469af67fb2591c160e
SHA5126455549a5d58a222352c89665f0f1a2606c680cf40a4e94049dd11328239080e1b32f0ec9ef779fa8c7ba55c7774743a74d3fc263783ae7628b7905a330e7b15
-
Filesize
468KB
MD520bb118569b859e64feaaf30227e04b8
SHA13fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c
-
Filesize
468KB
MD520bb118569b859e64feaaf30227e04b8
SHA13fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c
-
Filesize
468KB
MD520bb118569b859e64feaaf30227e04b8
SHA13fb2c608529575ad4b06770e130eb9d2d0750ed7
SHA256c1d2e8b7b961e48a1ee4877d3f527f038697e0dfcda69b8cd470900b73e1e674
SHA512567906d7b98058ec24c1455d5167ee13127ce6739350f1f38954c01e46f96ba0851d6c88ef49a192edb53c5f759ab8663c7ac9fcc795c35db98165d11259587c