Overview
overview
10Static
static
10231121-01-...d4.exe
windows7-x64
10231121-01-...d4.exe
windows10-2004-x64
10231121-02-...4c.exe
windows7-x64
10231121-02-...4c.exe
windows10-2004-x64
10231121-03-...94.exe
windows7-x64
10231121-03-...94.exe
windows10-2004-x64
10231121-04-...05.exe
windows7-x64
10231121-04-...05.exe
windows10-2004-x64
10231121-05-...29.exe
windows7-x64
10231121-05-...29.exe
windows10-2004-x64
10231121-06-...a6.exe
windows7-x64
10231121-06-...a6.exe
windows10-2004-x64
10231121-07-...6a.exe
windows7-x64
10231121-07-...6a.exe
windows10-2004-x64
10231121-08-...84.exe
windows7-x64
10231121-08-...84.exe
windows10-2004-x64
10231121-09-...c4.exe
windows7-x64
10231121-09-...c4.exe
windows10-2004-x64
10231121-10-...ec.exe
windows7-x64
10231121-10-...ec.exe
windows10-2004-x64
10231121-11-...bc.exe
windows7-x64
10231121-11-...bc.exe
windows10-2004-x64
10231121-12-...1d.exe
windows7-x64
10231121-12-...1d.exe
windows10-2004-x64
10231121-13-...5e.exe
windows7-x64
10231121-13-...5e.exe
windows10-2004-x64
10231121-14-...29.exe
windows7-x64
10231121-14-...29.exe
windows10-2004-x64
10231121-15-...f4.exe
windows7-x64
3231121-15-...f4.exe
windows10-2004-x64
10231121-16-...00.exe
windows7-x64
10231121-16-...00.exe
windows10-2004-x64
10Analysis
-
max time kernel
118s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
21-11-2023 02:01
Behavioral task
behavioral1
Sample
231121-01-AgentTesla-4f4bd4.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
231121-01-AgentTesla-4f4bd4.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral3
Sample
231121-02-AgentTesla-29ec4c.exe
Resource
win7-20231023-en
Behavioral task
behavioral4
Sample
231121-02-AgentTesla-29ec4c.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral5
Sample
231121-03-SmokeLoader-a0e394.exe
Resource
win7-20231025-en
Behavioral task
behavioral6
Sample
231121-03-SmokeLoader-a0e394.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral7
Sample
231121-04-AgentTesla-41c205.exe
Resource
win7-20231020-en
Behavioral task
behavioral8
Sample
231121-04-AgentTesla-41c205.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral9
Sample
231121-05-CobaltStrike-189129.exe
Resource
win7-20231023-en
Behavioral task
behavioral10
Sample
231121-05-CobaltStrike-189129.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral11
Sample
231121-06-AgentTesla-b971a6.exe
Resource
win7-20231023-en
Behavioral task
behavioral12
Sample
231121-06-AgentTesla-b971a6.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral13
Sample
231121-07-AgentTesla-64b66a.exe
Resource
win7-20231020-en
Behavioral task
behavioral14
Sample
231121-07-AgentTesla-64b66a.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral15
Sample
231121-08-AgentTesla-d20084.exe
Resource
win7-20231023-en
Behavioral task
behavioral16
Sample
231121-08-AgentTesla-d20084.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral17
Sample
231121-09-AgentTesla-fbf7c4.exe
Resource
win7-20231025-en
Behavioral task
behavioral18
Sample
231121-09-AgentTesla-fbf7c4.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral19
Sample
231121-10-AgentTesla-a77eec.exe
Resource
win7-20231023-en
Behavioral task
behavioral20
Sample
231121-10-AgentTesla-a77eec.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral21
Sample
231121-11-AgentTesla-fe5abc.exe
Resource
win7-20231023-en
Behavioral task
behavioral22
Sample
231121-11-AgentTesla-fe5abc.exe
Resource
win10v2004-20231025-en
Behavioral task
behavioral23
Sample
231121-12-AgentTesla-68ee1d.exe
Resource
win7-20231020-en
Behavioral task
behavioral24
Sample
231121-12-AgentTesla-68ee1d.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral25
Sample
231121-13-AgentTesla-4c625e.exe
Resource
win7-20231023-en
Behavioral task
behavioral26
Sample
231121-13-AgentTesla-4c625e.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral27
Sample
231121-14-AgentTesla-1fcc29.exe
Resource
win7-20231023-en
Behavioral task
behavioral28
Sample
231121-14-AgentTesla-1fcc29.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral29
Sample
231121-15-Lokibot-a3aaf4.exe
Resource
win7-20231023-en
Behavioral task
behavioral30
Sample
231121-15-Lokibot-a3aaf4.exe
Resource
win10v2004-20231025-en
Behavioral task
behavioral31
Sample
231121-16-Lime-098e00.exe
Resource
win7-20231020-en
General
-
Target
231121-16-Lime-098e00.exe
-
Size
66KB
-
MD5
50b2b692da0c363e301709a28b30afaf
-
SHA1
098e00413ba405bcc72b71a5869c2d151e93448a
-
SHA256
d25339ece508876c8900d27721f042391a4cc2769805afa377556a416a192c49
-
SHA512
d463babcae95c3c200af5ae59aa5f89e2edeb267bb15e843f8a241e17794db1672067cba421ba38cda4e161151d93e5eb2e3bb06cd5ce6bc98d651ebf58f06ce
-
SSDEEP
1536:UJOjk0yzcRvVSfD8tzsy/jV49Gko0S/aATWJvQ3MJea9yn90+x:UJ70yK4D6P+YxpABJD9F+x
Malware Config
Extracted
xworm
5.0
162.212.154.8:41589
1fGBFdYzxtDnKgy4
-
Install_directory
%AppData%
-
install_file
OneDrive.exe
-
telegram
https://api.telegram.org/bot6875063177:AAG1OPJLZ36MPY8oqR1DVb1VHR2wOmnCudg/sendMessage?chat_id=2136313574
Extracted
limerat
-
aes_key
devil
-
antivm
false
-
c2_url
https://pastebin.com/raw/rPy10VvM
-
delay
3
-
download_payload
false
-
install
true
-
install_name
Windows Session Manager.exe
-
main_folder
AppData
-
pin_spread
false
-
sub_folder
\Windows\
-
usb_spread
false
Signatures
-
Detect Xworm Payload 4 IoCs
resource yara_rule behavioral31/files/0x00110000000006fc-20.dat family_xworm behavioral31/files/0x00110000000006fc-21.dat family_xworm behavioral31/memory/2728-22-0x0000000000FB0000-0x0000000000FD8000-memory.dmp family_xworm behavioral31/files/0x0006000000016ff7-105.dat family_xworm -
Executes dropped EXE 2 IoCs
pid Process 2728 one.exe 2064 ses.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Windows\CurrentVersion\Run\one = "C:\\Windows\\System32\\one.exe" 231121-16-Lime-098e00.exe Set value (str) \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Windows\CurrentVersion\Run\ses = "C:\\Windows\\System32\\ses.exe" 231121-16-Lime-098e00.exe Set value (str) \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive = "C:\\Users\\Admin\\AppData\\Roaming\\OneDrive.exe" one.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip-api.com -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\System32\one.exe 231121-16-Lime-098e00.exe File created C:\Windows\System32\ses.exe 231121-16-Lime-098e00.exe File opened for modification C:\Windows\System32\ses.exe 231121-16-Lime-098e00.exe File created C:\Windows\System32\one.exe 231121-16-Lime-098e00.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2312 schtasks.exe 2612 schtasks.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FC34FA41-8811-11EE-A7A1-C63A139B68A6} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009159649b912a9140bf53d83809c5b2ac00000000020000000000106600000001000020000000a1b96dd6d4569664c7afd8625b23ac287678cf69aa255bb3a10bf4e1a1e4f69f000000000e8000000002000020000000d49a9f6fc9c763b12e3d8364670505b5e57b792bc9f81d07c03a0af6513b785c900000001cc167a28f61db043d4292a47a0d434576411e5c097d7a5864b1961a4d3a79cb2e73a1f9623b68f4f6bec01758a5f25c356b063f4aa3064c5dd2e7389a093646cdaf27cd27e3b0ec59095a64fd1925fef946f433a18f9de2c05e80a9df332454ba3312740a8c37c880925ca558b38880729fd4307ff6926643a81584911df6000fbaaec23769f09bed7b23cc0313833d40000000a8470a05ecc163b97705dd5875124c7285ac0635ab6ddaf339c3a737aa055549920e05cb6ffb5495c0006ce9f2bcdae0f8cfa2482573f7ce202d68b7f1a26908 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009159649b912a9140bf53d83809c5b2ac000000000200000000001066000000010000200000001d9c2d582fdf4ad0b0ef7fc0efbe550cf6aa5563ed324b378ea022bad62ad0c1000000000e8000000002000020000000be49c4183daec54b7bd7eeba4fb401b618221a7b324f24dc883c9bd98a318ec0200000005274c80594d2e9e959b7519a3bc8e6dedd2ac00c8c04d912570edb86fe0407fb400000008fd94d255e44e42e5f71defd90e8fccaed13673720a0f8bd0278cb0d065d52ca45f9e3e79791e014d82380b158acea6a4c5f059bb60b76da349d3259676ee179 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 004a7bd31e1cda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "406694001" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2728 one.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 268 powershell.exe 2824 powershell.exe 1872 powershell.exe 1292 powershell.exe 2556 powershell.exe 1584 powershell.exe 2728 one.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 2332 231121-16-Lime-098e00.exe Token: SeDebugPrivilege 268 powershell.exe Token: SeDebugPrivilege 2728 one.exe Token: SeDebugPrivilege 2824 powershell.exe Token: SeDebugPrivilege 1872 powershell.exe Token: SeDebugPrivilege 1292 powershell.exe Token: SeDebugPrivilege 2556 powershell.exe Token: SeDebugPrivilege 1584 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 632 iexplore.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 632 iexplore.exe 632 iexplore.exe 796 IEXPLORE.EXE 796 IEXPLORE.EXE 2728 one.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 2332 wrote to memory of 268 2332 231121-16-Lime-098e00.exe 29 PID 2332 wrote to memory of 268 2332 231121-16-Lime-098e00.exe 29 PID 2332 wrote to memory of 268 2332 231121-16-Lime-098e00.exe 29 PID 2332 wrote to memory of 2312 2332 231121-16-Lime-098e00.exe 32 PID 2332 wrote to memory of 2312 2332 231121-16-Lime-098e00.exe 32 PID 2332 wrote to memory of 2312 2332 231121-16-Lime-098e00.exe 32 PID 2332 wrote to memory of 2728 2332 231121-16-Lime-098e00.exe 33 PID 2332 wrote to memory of 2728 2332 231121-16-Lime-098e00.exe 33 PID 2332 wrote to memory of 2728 2332 231121-16-Lime-098e00.exe 33 PID 2332 wrote to memory of 2824 2332 231121-16-Lime-098e00.exe 34 PID 2332 wrote to memory of 2824 2332 231121-16-Lime-098e00.exe 34 PID 2332 wrote to memory of 2824 2332 231121-16-Lime-098e00.exe 34 PID 2332 wrote to memory of 2612 2332 231121-16-Lime-098e00.exe 38 PID 2332 wrote to memory of 2612 2332 231121-16-Lime-098e00.exe 38 PID 2332 wrote to memory of 2612 2332 231121-16-Lime-098e00.exe 38 PID 2332 wrote to memory of 2064 2332 231121-16-Lime-098e00.exe 40 PID 2332 wrote to memory of 2064 2332 231121-16-Lime-098e00.exe 40 PID 2332 wrote to memory of 2064 2332 231121-16-Lime-098e00.exe 40 PID 2332 wrote to memory of 2064 2332 231121-16-Lime-098e00.exe 40 PID 2728 wrote to memory of 1872 2728 one.exe 41 PID 2728 wrote to memory of 1872 2728 one.exe 41 PID 2728 wrote to memory of 1872 2728 one.exe 41 PID 2728 wrote to memory of 1292 2728 one.exe 44 PID 2728 wrote to memory of 1292 2728 one.exe 44 PID 2728 wrote to memory of 1292 2728 one.exe 44 PID 2064 wrote to memory of 632 2064 ses.exe 45 PID 2064 wrote to memory of 632 2064 ses.exe 45 PID 2064 wrote to memory of 632 2064 ses.exe 45 PID 2064 wrote to memory of 632 2064 ses.exe 45 PID 2728 wrote to memory of 2556 2728 one.exe 47 PID 2728 wrote to memory of 2556 2728 one.exe 47 PID 2728 wrote to memory of 2556 2728 one.exe 47 PID 632 wrote to memory of 796 632 iexplore.exe 49 PID 632 wrote to memory of 796 632 iexplore.exe 49 PID 632 wrote to memory of 796 632 iexplore.exe 49 PID 632 wrote to memory of 796 632 iexplore.exe 49 PID 2728 wrote to memory of 1584 2728 one.exe 51 PID 2728 wrote to memory of 1584 2728 one.exe 51 PID 2728 wrote to memory of 1584 2728 one.exe 51 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\231121-16-Lime-098e00.exe"C:\Users\Admin\AppData\Local\Temp\231121-16-Lime-098e00.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\one.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:268
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "one" /SC ONLOGON /TR "C:\Windows\System32\one.exe" /RL HIGHEST2⤵
- Creates scheduled task(s)
PID:2312
-
-
C:\Windows\System32\one.exe"C:\Windows\System32\one.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\one.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1872
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'one.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1292
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\OneDrive.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2556
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'OneDrive.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1584
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\ses.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2824
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "ses" /SC ONLOGON /TR "C:\Windows\System32\ses.exe" /RL HIGHEST2⤵
- Creates scheduled task(s)
PID:2612
-
-
C:\Windows\System32\ses.exe"C:\Windows\System32\ses.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ses.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.03⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:632 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:796
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD537b258b811ca33fb0ae598cf87d44a4d
SHA19428144c50d336016fa0d11f5d53d8decd070aaf
SHA256b97e76ca337a0473642044afbb6a58542bbb9aed21e4d55d3b6fc3c5bc0ff6e2
SHA512c109518c99700ca74979dd3e3643573caa293d632289776b8e0393af69d9ddb1190fd3e4cd1dc659597a9ea7bf1507370e3dcdb95460cd798ae23500bb231210
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD522abc879971d00babda6ed75c11e2203
SHA17c7eeb5cc76984da5258f4f97dfcafddc58f3f76
SHA256d98e67faebc15a7ae55185005c2403109630cd21704617eeff192852410b9b36
SHA512747c0bdd9e08ec41d31e9050b83283f173fdf4033c7cc87ff2eef51bd524fd8c6d7a95c9151821d8d01dd05e2d5521223e3829b4403a46a634ee66052debea22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55094cdc261b1cb3a7693a26e1b3742fb
SHA1c5ee0b978e27513b30b512d4199d1041aa3d17b3
SHA25615273b7f56f691c97c75238ba6660dd2495fa2f1fa37625926ac3a134c426a57
SHA51293ba68af5410375359a9f07029f9ca80fc3b31ecd50fd6e7414c8fa1fba36ef130c19b3e512deff0a497e9b43e9bb57246cc9923f86a14de0563fad39d26f995
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef8b37034f2698c99aba548fa9c0c837
SHA1245bbae7e3aaa98ff3418f73c5e7ba49072a8a22
SHA25627bdc941dbdf3e4ad8e25d45c6e65666a6e75c2c192470e163ca7a8a51639b4d
SHA5120dae4dd81631d3d0ffd45ae5f262e5d54fb7c91969edc293ea0a1d4b091418fd03d5088fdcc225553d6af7fbb9eaf9e5683b7b0ea754147fbb1b8e8ec0988602
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ae890b06a6f7adaa5e10b4ff861cdfeb
SHA1715c011678e0429c01c6b9ae3f40612809d5a8c7
SHA2565274238d6561070402ed3834ecf96a8fe9fb7b8171b6cb3f69a11285310e244e
SHA512bd472498de618adb62001e797ec239beea78eb9bb837d7a0f936eee94eb9d98914712eef918ff0db55a214691e343088f79a2ef58dee92a14c99ee6047e760b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b8f654bca1d15c867b71288f4a303451
SHA1b738d24d4b47e8aa0c4e74d6633bae7d671e3fc3
SHA25692883f7f5f9cedb7138c4367b7aabe7c1a31a5b175b8cd9614502115883e98e1
SHA512c4bbd74372f007f5946330060f73a9679f9237ec853f6452187ab2f89004b541ecaf0855e65ba9a7a7004ad9a04ea1666a07ff0ba073ebc298229dc6ae206a09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51234af85050edc33e4977bf66391ba0d
SHA1bbd4cee704ce9b6b631865af1456af117e2b585a
SHA256591108aec05a58d714b4a4b7ac1658827c1b5586286cc8acd5dee873d499b114
SHA512cefd489aabf7c82420bbbedcfa71f994c37f63b994b44161fd4f9955e140b4b9b2672fbb215ee9704391fc2e48a5c39bca9b6df5139dad390c15a988ba114ca0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD502cb8d0e598507428b4fc13219763d94
SHA1095cafde7069a952b21759f01b9019089dff9243
SHA256bd4e78e81968f2dbabb400c79e6e227f59808d778e003d738d5347aed4702aa1
SHA51247bdff4ce245ad0a446ee65366f863ea4573b086e4f4d7ad9a4f5df661885bb0929983a0ec0fc322addd65152a5360486d5f22378adcd591279ab822c09f31b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD519b431168918ffad2de205c4c3337026
SHA1e4c98ddcf18ebdd62384deab429a7f3366c3ab8e
SHA2564c97e3daa30bf2fe283ccc8724db56487344dbf6fb9487bd778715c275be653b
SHA5123895411d08ed53883ab1e3f5b611c876f76fcb1e0a156f5bbcb2918398b3a5f9cb49fd17605347e95ca2c7d41030e31988d61bf2e1c9d9115778094180724b4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD515f5037fd433d62483a5d561b9303002
SHA11951dfc397409a79f6f1d232178c7fe5724a9f39
SHA2567864fcf9e43e3a134d64bb4830bbfe3d48a6e934ebe7cb405ce6f791153aaf83
SHA512929fffb6bef39512df0e5b033bcfa3ba860602e7b88a10cf23710d279772e24aaabf8fdc36c61286c980ddd276da0de81b683034ea8ca64eedb2f149c554d4cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d603ce6cf492c8cd9e91b9df5b9bdcd
SHA1dd82f49f26c0f085609049b4513b9098b56417d9
SHA256d2bd71dad5e68e4c872885bcfb12fc3d4dbbe83175c776fbadb5514ade473e38
SHA5125555fecac7ceeacdb9cbe851a11753f6f9e96bdf08eb82d83b1610e1f45c9049ce668d7bf5926652bfe565df9384bb9355350d34e5ab2ccb04c46ab3091002e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54cfc804732015ade4a7bba6599db2d61
SHA11cd1ea34e5826911bc972e556bdd09dfce4d1673
SHA256196e6e30e30a4fed57ef86d875e382c014196d9d82afddbb7b6bc853ecb4321a
SHA5122e91e19d79da132546faf31e6c4dbbd7d6b68c95d36ff3feb7b99d1ab06d8b011705be754cf0f7b9f4875f00b919f4b216725f3b389609eba20bc3c617dbe88c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54464f060bdd4b9026dfb119caae933b0
SHA1b018e8b15dcd0b062455c45de01e9f682406e86d
SHA2566225e5540216553d43c63597d9435daad505ed1d104421192a2ac241cec9c988
SHA51235a953fd7edc82f4e9ed14a67420646fbbe9a541ab1981e64a6a20aa4a70d6d9bc2dde3e245633d0cb77360645424b36855fa65d8455f97f1b06c1570e274c9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59e0509ada914554df2ac74d5eb4e28a1
SHA14ccd89aa5d009c17fd3ad641946e233193e20f5b
SHA256754978f060e7cd5728927936628861231a5562f9fafc6068849af89492fa0c86
SHA512ad7933159e94d02d7ba281127c9d2c1006c4cb63618e3a91dbf04a7e4702e7ae8cec34772361a899a9c3147c533d009ee8255f3eb9deddbe63054a22226a0f11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e0b52384e7ed7bc8ff76bac5d8f4d94a
SHA1a5b487c61b9bea2414b5a3e17508a19d777a03bc
SHA2566a9536ea00c93fcd8704592e397783508044efa1f683bf89948fcdbd62900bba
SHA5127002375b4204e26ed027aef8eaae6f5ed1052e57f1c4a4eba3d5b5247871db0b375de5181fd3c36f471b27ffeb1a5f5b666a5cc77e9bd1eb5c47fd7c15b49c09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD581d4e99aff34525609d8b345f1be85e9
SHA18260e92401213999b24a4ac0969e92a74575c335
SHA25616ec301c5476578056e1114aa16e832e3220469a86fe0dfb3241366717b71b15
SHA512f60a59dc94d9baa990aaea0bdccfa36b232be23ffc5964fc91666ee4238e25ffa4d94c3e2e660f47edce3f8c9e6857689edfbcdb2537da580a91477037e91b1d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fbee817a3c28c427e978321a748f8de6
SHA123b59474ea5523a7d56493c5ea49e5893596c68c
SHA25614e3c0c5c9340b918d2b4c092686c196aac3b01c6ed78b974ee9bc0dd9a292b4
SHA512beae948370db3b7029e3276056c57f36bb3fccac6f6ee362f433289a016958dee80e275ba655653d94689b6395cc3cdd9bbe53926e03b1a73b1166a14492d9b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD565de476fd4ab827f41dd53eedbdadcaa
SHA160aa93eb334796ab7d732f23f11dc4640150ec99
SHA25685a3fa08cfd811b65b46808d2c6a9a472274ae4b2bf0c7eb17b206d3e78340b8
SHA5120e74121b02971abd54b84341bf3f54a0b7a495d5c06842dffae859c567da067339cda8b00416d4f9d6b606aeb14c24d154d4691b26bee85d44e526dd1af6b92d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53071702188deefd52665698737fecb11
SHA1a08002d9bb350b0ea04eeb6f89e0967fb9ea4259
SHA2562c24dc5c5ccb01f1f4d6895d92ffdb7c39b971de81946c420545ea54b7102d91
SHA512520709a16b3abd9118b7bdd67cc61d186653c657330ac7a25c21fb9cc7e63940da51cb3b66affb669424374e33d29c68b57b384d006634653310027af8a62efd
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5749ea6107d991b2290e2b878bd4c5275
SHA1581594bb929b3a0e5e4b3541538c04981ba5b8d8
SHA256a43cb8fb99bccc30257615d8d6bb59b77bc882b8cfbfe949f634bae4915abfdf
SHA512b040737aeb1c4ae68e981da5d6fc7f8cf98606d244b40bce5c2601a2bf731755a811e69ac14f390fc3c76ab59fb6d8ec1179a7d76d9940d30907cf88036fdfe1
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5749ea6107d991b2290e2b878bd4c5275
SHA1581594bb929b3a0e5e4b3541538c04981ba5b8d8
SHA256a43cb8fb99bccc30257615d8d6bb59b77bc882b8cfbfe949f634bae4915abfdf
SHA512b040737aeb1c4ae68e981da5d6fc7f8cf98606d244b40bce5c2601a2bf731755a811e69ac14f390fc3c76ab59fb6d8ec1179a7d76d9940d30907cf88036fdfe1
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD56fe9408f9b9af1d9a1c1ebfe52e00d31
SHA1611f1bad2e3309a14c2d9ced6743247e5a5178cd
SHA2560eaf5ab05b1e71ade8df19dbe25e36d0c1fd220ba88baa27643eee2ec18f1d80
SHA5124043aba542ba76945aae1c6c2d0b2eceacbfea2e5f04d884f8da6cda05df9d779af52c06709a0dc39b0fe28bb69446c36820a2c8989c06ffbe1bb298ae4d2860
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5749ea6107d991b2290e2b878bd4c5275
SHA1581594bb929b3a0e5e4b3541538c04981ba5b8d8
SHA256a43cb8fb99bccc30257615d8d6bb59b77bc882b8cfbfe949f634bae4915abfdf
SHA512b040737aeb1c4ae68e981da5d6fc7f8cf98606d244b40bce5c2601a2bf731755a811e69ac14f390fc3c76ab59fb6d8ec1179a7d76d9940d30907cf88036fdfe1
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD55fe4dc4b1e3062f7f29d5ccd6cef9769
SHA13c0623fe341ed10e3fa2bc1fb74505538fb3618c
SHA25662f93c07bd62d695c55dafd26b5ff7c077459c62a11cba9697f4622200d7b52c
SHA51243c74fe60ccf5aec1d97ee64ee872c23d86da5d1bd119d7ab2ce4f9c6ed2ce93cd2e043cb515d73e1f7da123227de1224bcef38c7426e5d0559e61d6e19d0528
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9KHRBR5Y51XVOL78COMD.temp
Filesize7KB
MD56fe9408f9b9af1d9a1c1ebfe52e00d31
SHA1611f1bad2e3309a14c2d9ced6743247e5a5178cd
SHA2560eaf5ab05b1e71ade8df19dbe25e36d0c1fd220ba88baa27643eee2ec18f1d80
SHA5124043aba542ba76945aae1c6c2d0b2eceacbfea2e5f04d884f8da6cda05df9d779af52c06709a0dc39b0fe28bb69446c36820a2c8989c06ffbe1bb298ae4d2860
-
Filesize
142KB
MD52f2fed589cef6c6973db3dd854a6ba13
SHA16a121feaa70814260efcc50a0b48696cd0cf570e
SHA2561d77e69e717573061d58bb385dfe760cbbfbb205a9e1c1ea3428a25ac7319c36
SHA512c8d942892f514afbd5a8f888897b31e6e4d4c2e2d155bf1561dfba03ff382a5c12e810f5bb2cd9ff461524f4dd4012e85363537568ca7b36ad51c2bd4d95aade
-
Filesize
142KB
MD52f2fed589cef6c6973db3dd854a6ba13
SHA16a121feaa70814260efcc50a0b48696cd0cf570e
SHA2561d77e69e717573061d58bb385dfe760cbbfbb205a9e1c1ea3428a25ac7319c36
SHA512c8d942892f514afbd5a8f888897b31e6e4d4c2e2d155bf1561dfba03ff382a5c12e810f5bb2cd9ff461524f4dd4012e85363537568ca7b36ad51c2bd4d95aade
-
Filesize
142KB
MD52f2fed589cef6c6973db3dd854a6ba13
SHA16a121feaa70814260efcc50a0b48696cd0cf570e
SHA2561d77e69e717573061d58bb385dfe760cbbfbb205a9e1c1ea3428a25ac7319c36
SHA512c8d942892f514afbd5a8f888897b31e6e4d4c2e2d155bf1561dfba03ff382a5c12e810f5bb2cd9ff461524f4dd4012e85363537568ca7b36ad51c2bd4d95aade
-
Filesize
28KB
MD5ab9502a920271fd1cf060f388a45fcd0
SHA1c7292f1d76eae037d3ea5dbbc171eee21bc944d8
SHA256e0fb281db34b9fa35971cb1af42175d6b5650c46f261771361a1aeed70565787
SHA5127fcf30539e0cf74d4f27904c4205d0d8fd209ffec2ca97fdd1277c3096e1dc8c910ce239b7bd622d4275d4ea24f5be2ca0ae6a3a2687e492fd7774712c620452
-
Filesize
28KB
MD5ab9502a920271fd1cf060f388a45fcd0
SHA1c7292f1d76eae037d3ea5dbbc171eee21bc944d8
SHA256e0fb281db34b9fa35971cb1af42175d6b5650c46f261771361a1aeed70565787
SHA5127fcf30539e0cf74d4f27904c4205d0d8fd209ffec2ca97fdd1277c3096e1dc8c910ce239b7bd622d4275d4ea24f5be2ca0ae6a3a2687e492fd7774712c620452