Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
07-12-2023 19:54
Behavioral task
behavioral1
Sample
23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe
Resource
win7-20231020-en
General
-
Target
23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe
-
Size
223KB
-
MD5
aa7c1437997a0f1c1ae8d07ff907135a
-
SHA1
9a7e53855be3996f35854572cc5d9867e734f260
-
SHA256
23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8
-
SHA512
df285ebbbcf74a70aa5a60ed6f116b5b2d0799db321a4abb69ac19bbedab7ea1727a2ea7c1cd3f0d4626d59f200de0ce1d9a3b3f9616c371c54e8b90ebab765e
-
SSDEEP
3072:xZ7wXfSRZ0ON/EwW66wN94xu4CkAZJM2k5D66L+NfGbVON2Nqi/6gS5UoWXHz72n:7wPSUONLNsuWA7koN+boRi9S6oiz72D
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
Explorer.EXEdescription pid process target process PID 3120 created 588 3120 Explorer.EXE winlogon.exe -
Drops file in Drivers directory 9 IoCs
Processes:
msdtc.exedescription ioc process File opened for modification C:\Windows\system32\drivers\jNkMsMmWFa.roj msdtc.exe File opened for modification C:\Windows\system32\drivers\DhcEKD3Bx4suz.ayv msdtc.exe File opened for modification C:\Windows\system32\drivers\GZIiD2KSn39C.sys msdtc.exe File opened for modification C:\Windows\system32\drivers\b8dFKa4aeKS.oma msdtc.exe File opened for modification C:\Windows\system32\drivers\q0uuwiskCN3bT.sys msdtc.exe File opened for modification C:\Windows\system32\drivers\KZTmakl77u.wqj msdtc.exe File created C:\Windows\System32\drivers\gRU4Q6.sys msdtc.exe File opened for modification C:\Windows\system32\drivers\fN2neMeqouctL.sys msdtc.exe File opened for modification C:\Windows\system32\drivers\hNjZPaE75bg.sys msdtc.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1067295379-1486014338-1703171060-1000\Control Panel\International\Geo\Nation 23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe -
Executes dropped EXE 1 IoCs
Processes:
msdtc.exepid process 2084 msdtc.exe -
Processes:
resource yara_rule behavioral2/memory/1848-0-0x0000000000C60000-0x0000000000CCE000-memory.dmp upx behavioral2/memory/1848-52-0x0000000000C60000-0x0000000000CCE000-memory.dmp upx behavioral2/memory/1848-54-0x0000000000C60000-0x0000000000CCE000-memory.dmp upx -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 114.114.114.114 -
Processes:
resource yara_rule C:\Windows\Wvpk8ZFeDLv.sys vmprotect C:\Windows\FAh9EvVHYcLJh2.sys vmprotect C:\Windows\9bI9sOdnNHvnsj.sys vmprotect C:\Windows\5UQL4XD0biI0G1.sys vmprotect -
Drops file in System32 directory 23 IoCs
Processes:
msdtc.exedescription ioc process File opened for modification C:\Windows\system32\qq4uFOF6AkjrL.zhd msdtc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 msdtc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 msdtc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AD5F118F7897046E8CA970AE6A6AB70B_ADB601E2C381343DA1163E5F08582475 msdtc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B msdtc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3 msdtc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\349D186F1CB5682FA0194D4F3754EF36_CE21678B3713ACF5F5ED4AAA700C6173 msdtc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D440AC65793A7BBE167BE882B99F465E msdtc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D440AC65793A7BBE167BE882B99F465E msdtc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3 msdtc.exe File created C:\Windows\system32\ \Windows\System32\8jGvJ6zAh.sys msdtc.exe File opened for modification C:\Windows\system32\DIsdUc1PR4hL.cme msdtc.exe File opened for modification C:\Windows\system32\dzEtJavzpXRS.qvm msdtc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_896832C6BC857CFAEA9E59E166B13E2C msdtc.exe File opened for modification C:\Windows\system32\Sa6BsLuuwH.sys msdtc.exe File opened for modification C:\Windows\system32\qXEZopU41QOTF.sys msdtc.exe File opened for modification C:\Windows\system32\2agxZ7GRGQ29S.dsy msdtc.exe File opened for modification C:\Windows\system32\2VJNaWeKhyjvK.sys msdtc.exe File opened for modification C:\Windows\system32\X6Dda1jkurz.sys msdtc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_896832C6BC857CFAEA9E59E166B13E2C msdtc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AD5F118F7897046E8CA970AE6A6AB70B_ADB601E2C381343DA1163E5F08582475 msdtc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B msdtc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\349D186F1CB5682FA0194D4F3754EF36_CE21678B3713ACF5F5ED4AAA700C6173 msdtc.exe -
Drops file in Program Files directory 26 IoCs
Processes:
msdtc.exeExplorer.EXEdescription ioc process File opened for modification C:\Program Files\gXRWrA9tqJGGA.sys msdtc.exe File opened for modification C:\Program Files\AjG2rn8c0IEIZ.sys msdtc.exe File opened for modification C:\Program Files\wtMZXXFvSUBpP.sys msdtc.exe File opened for modification C:\Program Files\46lzzfYOr2zDD.bhi msdtc.exe File opened for modification C:\Program Files (x86)\5eER9PusMHUU.sys msdtc.exe File opened for modification C:\Program Files\Windows Mail\5611d1b4.js msdtc.exe File opened for modification C:\Program Files\WindowsApps\lib\646a1fc2.js Explorer.EXE File opened for modification C:\Program Files\gghE1hNSpx.sys msdtc.exe File opened for modification C:\Program Files (x86)\0TOK3Mwg16gQd.ipr msdtc.exe File opened for modification C:\Program Files\gIYRDja1ly.kua msdtc.exe File opened for modification C:\Program Files (x86)\HWxxGv6fqtItv.npv msdtc.exe File opened for modification C:\Program Files (x86)\pSqtCMzN5vTRN.sys msdtc.exe File opened for modification C:\Program Files\WindowsApps\396136b8.js Explorer.EXE File opened for modification C:\Program Files (x86)\4W13lhgdAbvgs2.sys msdtc.exe File opened for modification C:\Program Files\WindowsApps\manifest.json Explorer.EXE File opened for modification C:\Program Files (x86)\FVifWtrVz8gdNT.tjx msdtc.exe File opened for modification C:\Program Files (x86)\ipc8UnSOnrYGB.sys msdtc.exe File opened for modification C:\Program Files\WindowsApps\47b98466.html Explorer.EXE File opened for modification C:\Program Files\PJ2oWg5mHptD5.ugk msdtc.exe File opened for modification C:\Program Files\Windows Mail\47b98416.html msdtc.exe File opened for modification C:\Program Files\6NHqVlNkZmxXW.mjq msdtc.exe File opened for modification C:\Program Files\Windows Mail\manifest.json msdtc.exe File opened for modification C:\Program Files\Windows Mail\39613678.js msdtc.exe File opened for modification C:\Program Files\Windows Mail\lib\646a1f52.js msdtc.exe File opened for modification C:\Program Files\WindowsApps\5611d214.js Explorer.EXE File opened for modification C:\Program Files (x86)\ETPm5scuTES.qtx msdtc.exe -
Drops file in Windows directory 11 IoCs
Processes:
Explorer.EXEmsdtc.exedescription ioc process File created C:\Windows\Help\msdtc.exe Explorer.EXE File opened for modification C:\Windows\Help\msdtc.exe Explorer.EXE File opened for modification C:\Windows\FAh9EvVHYcLJh2.sys msdtc.exe File opened for modification C:\Windows\9bI9sOdnNHvnsj.sys msdtc.exe File opened for modification C:\Windows\LvmXUxN1VRyAyc.otu msdtc.exe File created C:\Windows\SnmGbO.sys msdtc.exe File opened for modification C:\Windows\Wvpk8ZFeDLv.sys msdtc.exe File opened for modification C:\Windows\NZEz3ysPI14KJ.ovr msdtc.exe File opened for modification C:\Windows\rWMGh7n9vl.dlu msdtc.exe File opened for modification C:\Windows\bEbVx3OX4T.hwf msdtc.exe File opened for modification C:\Windows\5UQL4XD0biI0G1.sys msdtc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
msdtc.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 msdtc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 msdtc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName msdtc.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4920 timeout.exe -
Modifies data under HKEY_USERS 12 IoCs
Processes:
msdtc.exemsinfo32.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix msdtc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" msdtc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" msdtc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" msdtc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing msdtc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" msinfo32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" msdtc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ msdtc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" msdtc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" msdtc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix msinfo32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" msinfo32.exe -
Modifies registry class 3 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1067295379-1486014338-1703171060-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exeExplorer.EXEmsdtc.exemsinfo32.exepid process 1848 23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe 1848 23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe 1848 23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe 1848 23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe 1848 23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe 1848 23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe 1848 23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe 1848 23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe 3120 Explorer.EXE 3120 Explorer.EXE 3120 Explorer.EXE 3120 Explorer.EXE 1848 23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe 1848 23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe 2084 msdtc.exe 2084 msdtc.exe 4236 msinfo32.exe 4236 msinfo32.exe 2084 msdtc.exe 2084 msdtc.exe 2084 msdtc.exe 2084 msdtc.exe 2084 msdtc.exe 2084 msdtc.exe 2084 msdtc.exe 2084 msdtc.exe 2084 msdtc.exe 2084 msdtc.exe 2084 msdtc.exe 2084 msdtc.exe 2084 msdtc.exe 2084 msdtc.exe 2084 msdtc.exe 2084 msdtc.exe 2084 msdtc.exe 2084 msdtc.exe 2084 msdtc.exe 2084 msdtc.exe 2084 msdtc.exe 2084 msdtc.exe 2084 msdtc.exe 2084 msdtc.exe 2084 msdtc.exe 2084 msdtc.exe 2084 msdtc.exe 2084 msdtc.exe 2084 msdtc.exe 2084 msdtc.exe 2084 msdtc.exe 2084 msdtc.exe 2084 msdtc.exe 2084 msdtc.exe 2084 msdtc.exe 2084 msdtc.exe 2084 msdtc.exe 2084 msdtc.exe 2084 msdtc.exe 2084 msdtc.exe 2084 msdtc.exe 2084 msdtc.exe 2084 msdtc.exe 2084 msdtc.exe 2084 msdtc.exe 2084 msdtc.exe -
Suspicious behavior: LoadsDriver 59 IoCs
Processes:
pid process 656 656 656 656 656 656 656 656 656 656 656 656 656 656 656 656 656 656 656 656 656 656 656 656 656 656 656 656 656 656 656 656 656 656 656 656 656 656 656 656 656 656 656 656 656 656 656 656 656 656 656 656 656 656 656 656 656 656 656 -
Suspicious use of AdjustPrivilegeToken 27 IoCs
Processes:
23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exeExplorer.EXEmsdtc.exedwm.exesvchost.exedescription pid process Token: SeDebugPrivilege 1848 23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe Token: SeTcbPrivilege 1848 23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe Token: SeDebugPrivilege 1848 23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe Token: SeDebugPrivilege 3120 Explorer.EXE Token: SeDebugPrivilege 3120 Explorer.EXE Token: SeDebugPrivilege 1848 23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe Token: SeDebugPrivilege 2084 msdtc.exe Token: SeDebugPrivilege 2084 msdtc.exe Token: SeDebugPrivilege 2084 msdtc.exe Token: SeIncBasePriorityPrivilege 1848 23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe Token: SeShutdownPrivilege 3120 Explorer.EXE Token: SeCreatePagefilePrivilege 3120 Explorer.EXE Token: SeDebugPrivilege 2084 msdtc.exe Token: SeDebugPrivilege 2084 msdtc.exe Token: SeBackupPrivilege 2084 msdtc.exe Token: SeDebugPrivilege 2084 msdtc.exe Token: SeDebugPrivilege 2084 msdtc.exe Token: SeDebugPrivilege 2084 msdtc.exe Token: SeDebugPrivilege 3120 Explorer.EXE Token: SeBackupPrivilege 3120 Explorer.EXE Token: SeDebugPrivilege 316 dwm.exe Token: SeBackupPrivilege 316 dwm.exe Token: SeShutdownPrivilege 316 dwm.exe Token: SeCreatePagefilePrivilege 316 dwm.exe Token: SeManageVolumePrivilege 4800 svchost.exe Token: SeShutdownPrivilege 3120 Explorer.EXE Token: SeCreatePagefilePrivilege 3120 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 3120 Explorer.EXE 3120 Explorer.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Explorer.EXEpid process 3120 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3120 Explorer.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exeExplorer.EXEcmd.exemsdtc.exedescription pid process target process PID 1848 wrote to memory of 3120 1848 23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe Explorer.EXE PID 1848 wrote to memory of 3120 1848 23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe Explorer.EXE PID 1848 wrote to memory of 3120 1848 23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe Explorer.EXE PID 1848 wrote to memory of 3120 1848 23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe Explorer.EXE PID 1848 wrote to memory of 3120 1848 23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe Explorer.EXE PID 3120 wrote to memory of 2084 3120 Explorer.EXE msdtc.exe PID 3120 wrote to memory of 2084 3120 Explorer.EXE msdtc.exe PID 3120 wrote to memory of 2084 3120 Explorer.EXE msdtc.exe PID 3120 wrote to memory of 2084 3120 Explorer.EXE msdtc.exe PID 3120 wrote to memory of 2084 3120 Explorer.EXE msdtc.exe PID 3120 wrote to memory of 2084 3120 Explorer.EXE msdtc.exe PID 3120 wrote to memory of 2084 3120 Explorer.EXE msdtc.exe PID 1848 wrote to memory of 588 1848 23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe winlogon.exe PID 1848 wrote to memory of 588 1848 23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe winlogon.exe PID 1848 wrote to memory of 588 1848 23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe winlogon.exe PID 1848 wrote to memory of 588 1848 23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe winlogon.exe PID 1848 wrote to memory of 588 1848 23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe winlogon.exe PID 1848 wrote to memory of 3748 1848 23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe cmd.exe PID 1848 wrote to memory of 3748 1848 23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe cmd.exe PID 1848 wrote to memory of 3748 1848 23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe cmd.exe PID 3748 wrote to memory of 4920 3748 cmd.exe timeout.exe PID 3748 wrote to memory of 4920 3748 cmd.exe timeout.exe PID 3748 wrote to memory of 4920 3748 cmd.exe timeout.exe PID 2084 wrote to memory of 3120 2084 msdtc.exe Explorer.EXE PID 2084 wrote to memory of 3120 2084 msdtc.exe Explorer.EXE PID 2084 wrote to memory of 4236 2084 msdtc.exe msinfo32.exe PID 2084 wrote to memory of 4236 2084 msdtc.exe msinfo32.exe PID 2084 wrote to memory of 4236 2084 msdtc.exe msinfo32.exe PID 2084 wrote to memory of 4236 2084 msdtc.exe msinfo32.exe PID 2084 wrote to memory of 4236 2084 msdtc.exe msinfo32.exe PID 2084 wrote to memory of 4236 2084 msdtc.exe msinfo32.exe PID 2084 wrote to memory of 4236 2084 msdtc.exe msinfo32.exe PID 2084 wrote to memory of 3120 2084 msdtc.exe Explorer.EXE PID 2084 wrote to memory of 3120 2084 msdtc.exe Explorer.EXE PID 2084 wrote to memory of 3120 2084 msdtc.exe Explorer.EXE PID 2084 wrote to memory of 3120 2084 msdtc.exe Explorer.EXE PID 2084 wrote to memory of 3120 2084 msdtc.exe Explorer.EXE PID 2084 wrote to memory of 3120 2084 msdtc.exe Explorer.EXE PID 2084 wrote to memory of 3120 2084 msdtc.exe Explorer.EXE PID 2084 wrote to memory of 3120 2084 msdtc.exe Explorer.EXE PID 2084 wrote to memory of 3120 2084 msdtc.exe Explorer.EXE PID 2084 wrote to memory of 3120 2084 msdtc.exe Explorer.EXE PID 2084 wrote to memory of 3120 2084 msdtc.exe Explorer.EXE PID 2084 wrote to memory of 3120 2084 msdtc.exe Explorer.EXE PID 2084 wrote to memory of 3120 2084 msdtc.exe Explorer.EXE PID 2084 wrote to memory of 3120 2084 msdtc.exe Explorer.EXE PID 2084 wrote to memory of 3120 2084 msdtc.exe Explorer.EXE PID 2084 wrote to memory of 3120 2084 msdtc.exe Explorer.EXE PID 2084 wrote to memory of 3120 2084 msdtc.exe Explorer.EXE PID 2084 wrote to memory of 3120 2084 msdtc.exe Explorer.EXE PID 2084 wrote to memory of 3120 2084 msdtc.exe Explorer.EXE PID 2084 wrote to memory of 3120 2084 msdtc.exe Explorer.EXE PID 2084 wrote to memory of 3120 2084 msdtc.exe Explorer.EXE PID 2084 wrote to memory of 3120 2084 msdtc.exe Explorer.EXE PID 2084 wrote to memory of 3120 2084 msdtc.exe Explorer.EXE PID 2084 wrote to memory of 3120 2084 msdtc.exe Explorer.EXE PID 2084 wrote to memory of 3120 2084 msdtc.exe Explorer.EXE PID 2084 wrote to memory of 3120 2084 msdtc.exe Explorer.EXE PID 2084 wrote to memory of 3120 2084 msdtc.exe Explorer.EXE PID 2084 wrote to memory of 3120 2084 msdtc.exe Explorer.EXE PID 2084 wrote to memory of 3120 2084 msdtc.exe Explorer.EXE PID 2084 wrote to memory of 3120 2084 msdtc.exe Explorer.EXE PID 2084 wrote to memory of 3120 2084 msdtc.exe Explorer.EXE PID 2084 wrote to memory of 3120 2084 msdtc.exe Explorer.EXE
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Help\msdtc.exe"C:\Windows\Help\msdtc.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\msinfo32.exe"C:\Windows\system32\msinfo32.exe"3⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe"C:\Users\Admin\AppData\Local\Temp\23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\23f32f21c19d22034be2c95d2b4f560612b1002a8978529f2093c03c897911d8.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 14⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\5UQL4XD0biI0G1.sysFilesize
415KB
MD586dcce1f65f56babe1312b8d63018391
SHA1735bb7f6884a6b26f548dbb567351ea21497d28a
SHA2560b1117aec00b614ad6c684147bf76530a096d86db537a280dec6b044de1c701b
SHA51238e3a53f158c8ff409dd8aba0eba6105dd04bbcd54bd63e1234d71d6656fc84e70643dd915e0293f42c322710ab2f0c01470ec72bded290407a6f907df3f0ea3
-
C:\Windows\9bI9sOdnNHvnsj.sysFilesize
415KB
MD564bc1983743c584a9ad09dacf12792e5
SHA10f14098f523d21f11129c4df09451413ddff6d61
SHA256057ec356f1577fe86b706e5aeb74e3bdd6fe04d22586fecf69b866f8f72db7f5
SHA5129ab4ddb64bd97dd1a7ee15613a258edf1d2eba880a0896a91487c47a32c9bd1118cde18211053a5b081216d123d5f901b454a525cbba01d8067c31babd8c8c3c
-
C:\Windows\FAh9EvVHYcLJh2.sysFilesize
447KB
MD57ba2e5f80701b7c3c0d4a929f324de71
SHA1c91323cba3c0aaf968845ef750826f3fdadb4fde
SHA256d927f8e5073e0cc02ff0f29224390d2148268d6bec3a13c0052cb674c8d73ba9
SHA5129d0028f9857400bf9b4a3ac2d431ea79400072b82ae27ab434356ee0f61e55f31fee72301796d3d3e532b94d123c801c1c023a2d0eb0b7e14f679441e6ae951a
-
C:\Windows\Help\msdtc.exeFilesize
145KB
MD52ef846ac66e181be820b513dbc15b5d2
SHA18b4786eb9d864fc78bd99432ae0c78f887049461
SHA256edfe71025c352d0dabec7b9506c5945bb0ec11f8db540db8cb1116c2ea1648a8
SHA5122587acd723f515eb8fa1dd7016647079fd7af2a1c32f92ff344766803d524d9820bebaf21daa3b3d3556d2db8ab956a8a1682eaa46abb9b04a4c8e1e21321bdc
-
C:\Windows\Help\msdtc.exeFilesize
145KB
MD52ef846ac66e181be820b513dbc15b5d2
SHA18b4786eb9d864fc78bd99432ae0c78f887049461
SHA256edfe71025c352d0dabec7b9506c5945bb0ec11f8db540db8cb1116c2ea1648a8
SHA5122587acd723f515eb8fa1dd7016647079fd7af2a1c32f92ff344766803d524d9820bebaf21daa3b3d3556d2db8ab956a8a1682eaa46abb9b04a4c8e1e21321bdc
-
C:\Windows\Wvpk8ZFeDLv.sysFilesize
447KB
MD5d15f5f23df8036bd5089ce8d151b0e0d
SHA14066ff4d92ae189d92fcdfb8c11a82cc9db56bb2
SHA256f2c40dde6f40beaa3c283b66791ff27e6f06d66c8dd6eff5262f51e02ee26520
SHA512feaec8a00346b0a74c530859785e1b280da5833bf3113083bf4664ebee85b14ceca648499f36d266d329d602349f9ad0fc21a10e605377b3a2c24b456f3a9bd9
-
memory/316-343-0x0000020922270000-0x0000020922274000-memory.dmpFilesize
16KB
-
memory/316-339-0x0000020922120000-0x0000020922242000-memory.dmpFilesize
1.1MB
-
memory/316-340-0x0000020922260000-0x0000020922261000-memory.dmpFilesize
4KB
-
memory/316-346-0x0000020922120000-0x0000020922242000-memory.dmpFilesize
1.1MB
-
memory/588-66-0x000001DAEC160000-0x000001DAEC188000-memory.dmpFilesize
160KB
-
memory/588-17-0x000001DAEC150000-0x000001DAEC153000-memory.dmpFilesize
12KB
-
memory/588-19-0x000001DAEC160000-0x000001DAEC188000-memory.dmpFilesize
160KB
-
memory/588-20-0x000001DAEC1A0000-0x000001DAEC1A1000-memory.dmpFilesize
4KB
-
memory/588-67-0x000001DAEC1A0000-0x000001DAEC1A1000-memory.dmpFilesize
4KB
-
memory/1848-0-0x0000000000C60000-0x0000000000CCE000-memory.dmpFilesize
440KB
-
memory/1848-52-0x0000000000C60000-0x0000000000CCE000-memory.dmpFilesize
440KB
-
memory/1848-54-0x0000000000C60000-0x0000000000CCE000-memory.dmpFilesize
440KB
-
memory/2084-86-0x0000020E49EE0000-0x0000020E49EE1000-memory.dmpFilesize
4KB
-
memory/2084-149-0x0000020E49ED0000-0x0000020E49ED2000-memory.dmpFilesize
8KB
-
memory/2084-58-0x0000020E49EE0000-0x0000020E49EE1000-memory.dmpFilesize
4KB
-
memory/2084-57-0x0000020E49EF0000-0x0000020E49EF1000-memory.dmpFilesize
4KB
-
memory/2084-347-0x0000020E49CC0000-0x0000020E49CC1000-memory.dmpFilesize
4KB
-
memory/2084-10-0x0000020E47A20000-0x0000020E47A23000-memory.dmpFilesize
12KB
-
memory/2084-61-0x0000020E47CB0000-0x0000020E47D7B000-memory.dmpFilesize
812KB
-
memory/2084-62-0x0000020E49ED0000-0x0000020E49ED1000-memory.dmpFilesize
4KB
-
memory/2084-63-0x0000020E47D80000-0x0000020E47D81000-memory.dmpFilesize
4KB
-
memory/2084-64-0x0000020E49EE0000-0x0000020E49EEF000-memory.dmpFilesize
60KB
-
memory/2084-65-0x0000020E49F30000-0x0000020E49FE7000-memory.dmpFilesize
732KB
-
memory/2084-55-0x0000020E49ED0000-0x0000020E49ED1000-memory.dmpFilesize
4KB
-
memory/2084-53-0x0000020E49CC0000-0x0000020E49CC2000-memory.dmpFilesize
8KB
-
memory/2084-70-0x0000020E4A5A0000-0x0000020E4A5CE000-memory.dmpFilesize
184KB
-
memory/2084-332-0x0000020E49CC0000-0x0000020E49CC1000-memory.dmpFilesize
4KB
-
memory/2084-68-0x0000020E4B520000-0x0000020E4B642000-memory.dmpFilesize
1.1MB
-
memory/2084-76-0x0000020E49ED0000-0x0000020E49ED2000-memory.dmpFilesize
8KB
-
memory/2084-73-0x0000020E4A5D0000-0x0000020E4A5D1000-memory.dmpFilesize
4KB
-
memory/2084-80-0x0000020E4B950000-0x0000020E4BB1A000-memory.dmpFilesize
1.8MB
-
memory/2084-331-0x0000020E4B430000-0x0000020E4B43A000-memory.dmpFilesize
40KB
-
memory/2084-87-0x0000020E49EF0000-0x0000020E49EF1000-memory.dmpFilesize
4KB
-
memory/2084-51-0x00007FFA8ADE0000-0x00007FFA8ADF0000-memory.dmpFilesize
64KB
-
memory/2084-92-0x0000020E49ED0000-0x0000020E49ED2000-memory.dmpFilesize
8KB
-
memory/2084-94-0x0000020E49ED0000-0x0000020E49ED1000-memory.dmpFilesize
4KB
-
memory/2084-15-0x00007FFA8ADE0000-0x00007FFA8ADF0000-memory.dmpFilesize
64KB
-
memory/2084-135-0x0000020E49F30000-0x0000020E49FE7000-memory.dmpFilesize
732KB
-
memory/2084-145-0x0000020E4B520000-0x0000020E4B642000-memory.dmpFilesize
1.1MB
-
memory/2084-141-0x0000020E49ED0000-0x0000020E49ED1000-memory.dmpFilesize
4KB
-
memory/2084-13-0x0000020E47CB0000-0x0000020E47D7B000-memory.dmpFilesize
812KB
-
memory/2084-56-0x0000020E49EE0000-0x0000020E49EE1000-memory.dmpFilesize
4KB
-
memory/2084-14-0x0000020E47D80000-0x0000020E47D81000-memory.dmpFilesize
4KB
-
memory/2084-330-0x0000020E4A5E0000-0x0000020E4A5E1000-memory.dmpFilesize
4KB
-
memory/2084-323-0x0000020E4B430000-0x0000020E4B43A000-memory.dmpFilesize
40KB
-
memory/2084-11-0x0000020E47CB0000-0x0000020E47D7B000-memory.dmpFilesize
812KB
-
memory/3120-335-0x0000000002D20000-0x0000000002D23000-memory.dmpFilesize
12KB
-
memory/3120-1-0x0000000002EA0000-0x0000000002EA3000-memory.dmpFilesize
12KB
-
memory/3120-224-0x0000000002E70000-0x0000000002E71000-memory.dmpFilesize
4KB
-
memory/3120-324-0x0000000002E70000-0x0000000002E71000-memory.dmpFilesize
4KB
-
memory/3120-325-0x0000000002E70000-0x0000000002E71000-memory.dmpFilesize
4KB
-
memory/3120-326-0x0000000002E70000-0x0000000002E71000-memory.dmpFilesize
4KB
-
memory/3120-327-0x0000000002E70000-0x0000000002E71000-memory.dmpFilesize
4KB
-
memory/3120-328-0x0000000002E70000-0x0000000002E71000-memory.dmpFilesize
4KB
-
memory/3120-329-0x0000000002E70000-0x0000000002E71000-memory.dmpFilesize
4KB
-
memory/3120-212-0x0000000002E70000-0x0000000002E71000-memory.dmpFilesize
4KB
-
memory/3120-350-0x0000000008E80000-0x0000000008FA2000-memory.dmpFilesize
1.1MB
-
memory/3120-298-0x0000000002E70000-0x0000000002E71000-memory.dmpFilesize
4KB
-
memory/3120-60-0x0000000008580000-0x0000000008677000-memory.dmpFilesize
988KB
-
memory/3120-338-0x0000000002D50000-0x0000000002D51000-memory.dmpFilesize
4KB
-
memory/3120-311-0x0000000002E70000-0x0000000002E71000-memory.dmpFilesize
4KB
-
memory/3120-8-0x0000000008580000-0x0000000008677000-memory.dmpFilesize
988KB
-
memory/3120-341-0x0000000002D60000-0x0000000002D61000-memory.dmpFilesize
4KB
-
memory/3120-7-0x0000000002EC0000-0x0000000002EC1000-memory.dmpFilesize
4KB
-
memory/3120-2-0x0000000002EA0000-0x0000000002EA3000-memory.dmpFilesize
12KB
-
memory/3120-344-0x0000000008E80000-0x0000000008FA2000-memory.dmpFilesize
1.1MB
-
memory/3120-345-0x0000000008FB0000-0x0000000008FB4000-memory.dmpFilesize
16KB
-
memory/3120-72-0x0000000002E70000-0x0000000002E71000-memory.dmpFilesize
4KB
-
memory/3120-59-0x0000000002EC0000-0x0000000002EC1000-memory.dmpFilesize
4KB
-
memory/4236-82-0x0000018482410000-0x00000184825B6000-memory.dmpFilesize
1.6MB