Analysis
-
max time kernel
163s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31-12-2023 00:12
Static task
static1
Behavioral task
behavioral1
Sample
213b4d4a3fa8742fd83229a8be042bb9.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
213b4d4a3fa8742fd83229a8be042bb9.exe
Resource
win10v2004-20231215-en
General
-
Target
213b4d4a3fa8742fd83229a8be042bb9.exe
-
Size
4.3MB
-
MD5
213b4d4a3fa8742fd83229a8be042bb9
-
SHA1
22a20207263c5f6aea6e2174fb4544714ddf4a32
-
SHA256
6e67e541d5801d97cb6fc3ec483b7b9dc302506c0f3a1ef0942ea3f7126e9e87
-
SHA512
ce420a54d1f319502aac71ffa6da7457eca4bf0be30b4c4d27ce0040205ecc62136f559d567362d277b1d3752d6bbc8756c9f919c2bd7b91ec78463920fee34d
-
SSDEEP
98304:yg14WrmAN+0luBsjjvyYc2duACqtp3K57aPkxAS3u6ItmYD:yRvAN+lsPvyYc2t5tFaaPeHk
Malware Config
Extracted
privateloader
http://37.0.10.214/proxies.txt
http://37.0.10.244/server.txt
http://wfsdragon.ru/api/setStats.php
37.0.10.237
Extracted
nullmixer
http://hsiens.xyz/
Extracted
smokeloader
pub5
Extracted
vidar
40.1
706
https://eduarroma.tumblr.com/
-
profile_id
706
Extracted
smokeloader
2020
http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/
Extracted
redline
pub1
viacetequn.site:80
Signatures
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3404-136-0x0000000004C90000-0x0000000004CB2000-memory.dmp family_redline behavioral2/memory/3404-169-0x0000000007360000-0x0000000007380000-memory.dmp family_redline -
SectopRAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3404-136-0x0000000004C90000-0x0000000004CB2000-memory.dmp family_sectoprat behavioral2/memory/3404-169-0x0000000007360000-0x0000000007380000-memory.dmp family_sectoprat -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Vidar Stealer 3 IoCs
Processes:
resource yara_rule behavioral2/memory/420-130-0x0000000002FA0000-0x000000000303D000-memory.dmp family_vidar behavioral2/memory/420-139-0x0000000000400000-0x0000000002D0E000-memory.dmp family_vidar behavioral2/memory/420-175-0x0000000002FA0000-0x000000000303D000-memory.dmp family_vidar -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zS85643C49\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS85643C49\libcurlpp.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS85643C49\libstdc++-6.dll aspack_v212_v242 -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
setup_installer.exeFri1925d9ac2c1.exe213b4d4a3fa8742fd83229a8be042bb9.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation setup_installer.exe Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation Fri1925d9ac2c1.exe Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation 213b4d4a3fa8742fd83229a8be042bb9.exe -
Executes dropped EXE 14 IoCs
Processes:
setup_installer.exesetup_install.exeFri196814a5b87cc7.exeFri1925d9ac2c1.exeFri19673ed1dece.exeFri19bba638b6340.exeFri19684b7c65.exeFri193178698e28d.exeFri19c8b39c17cf87d0d.exeFri199a782d2f821b345.exeFri19089f5589cd7fd.exeFri1925d9ac2c1.exePiu.exe.comPiu.exe.compid process 1624 setup_installer.exe 2604 setup_install.exe 2344 Fri196814a5b87cc7.exe 4380 Fri1925d9ac2c1.exe 3940 Fri19673ed1dece.exe 3404 Fri19bba638b6340.exe 4500 Fri19684b7c65.exe 3212 Fri193178698e28d.exe 420 Fri19c8b39c17cf87d0d.exe 3516 Fri199a782d2f821b345.exe 3736 Fri19089f5589cd7fd.exe 1632 Fri1925d9ac2c1.exe 1092 Piu.exe.com 4936 Piu.exe.com -
Loads dropped DLL 6 IoCs
Processes:
setup_install.exepid process 2604 setup_install.exe 2604 setup_install.exe 2604 setup_install.exe 2604 setup_install.exe 2604 setup_install.exe 2604 setup_install.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Fri19089f5589cd7fd.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" Fri19089f5589cd7fd.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 7 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4664 2604 WerFault.exe setup_install.exe 1376 420 WerFault.exe Fri19c8b39c17cf87d0d.exe 3528 420 WerFault.exe Fri19c8b39c17cf87d0d.exe 3624 420 WerFault.exe Fri19c8b39c17cf87d0d.exe 540 420 WerFault.exe Fri19c8b39c17cf87d0d.exe 1640 420 WerFault.exe Fri19c8b39c17cf87d0d.exe 1188 420 WerFault.exe Fri19c8b39c17cf87d0d.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
Fri19673ed1dece.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Fri19673ed1dece.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Fri19673ed1dece.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Fri19673ed1dece.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Fri19673ed1dece.exepid process 3940 Fri19673ed1dece.exe 3940 Fri19673ed1dece.exe 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 3520 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
Fri19673ed1dece.exepid process 3940 Fri19673ed1dece.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
Fri196814a5b87cc7.exeFri19684b7c65.exepowershell.exedescription pid process Token: SeDebugPrivilege 2344 Fri196814a5b87cc7.exe Token: SeDebugPrivilege 4500 Fri19684b7c65.exe Token: SeShutdownPrivilege 3520 Token: SeCreatePagefilePrivilege 3520 Token: SeShutdownPrivilege 3520 Token: SeCreatePagefilePrivilege 3520 Token: SeShutdownPrivilege 3520 Token: SeCreatePagefilePrivilege 3520 Token: SeShutdownPrivilege 3520 Token: SeCreatePagefilePrivilege 3520 Token: SeShutdownPrivilege 3520 Token: SeCreatePagefilePrivilege 3520 Token: SeShutdownPrivilege 3520 Token: SeCreatePagefilePrivilege 3520 Token: SeShutdownPrivilege 3520 Token: SeCreatePagefilePrivilege 3520 Token: SeDebugPrivilege 4440 powershell.exe Token: SeShutdownPrivilege 3520 Token: SeCreatePagefilePrivilege 3520 Token: SeShutdownPrivilege 3520 Token: SeCreatePagefilePrivilege 3520 Token: SeShutdownPrivilege 3520 Token: SeCreatePagefilePrivilege 3520 -
Suspicious use of FindShellTrayWindow 14 IoCs
Processes:
Piu.exe.comPiu.exe.compid process 1092 Piu.exe.com 3520 3520 1092 Piu.exe.com 1092 Piu.exe.com 3520 3520 4936 Piu.exe.com 3520 3520 4936 Piu.exe.com 4936 Piu.exe.com 3520 3520 -
Suspicious use of SendNotifyMessage 6 IoCs
Processes:
Piu.exe.comPiu.exe.compid process 1092 Piu.exe.com 1092 Piu.exe.com 1092 Piu.exe.com 4936 Piu.exe.com 4936 Piu.exe.com 4936 Piu.exe.com -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
pid process 3520 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
213b4d4a3fa8742fd83229a8be042bb9.exesetup_installer.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exeFri1925d9ac2c1.exedescription pid process target process PID 4432 wrote to memory of 1624 4432 213b4d4a3fa8742fd83229a8be042bb9.exe setup_installer.exe PID 4432 wrote to memory of 1624 4432 213b4d4a3fa8742fd83229a8be042bb9.exe setup_installer.exe PID 4432 wrote to memory of 1624 4432 213b4d4a3fa8742fd83229a8be042bb9.exe setup_installer.exe PID 1624 wrote to memory of 2604 1624 setup_installer.exe setup_install.exe PID 1624 wrote to memory of 2604 1624 setup_installer.exe setup_install.exe PID 1624 wrote to memory of 2604 1624 setup_installer.exe setup_install.exe PID 2604 wrote to memory of 2980 2604 setup_install.exe cmd.exe PID 2604 wrote to memory of 2980 2604 setup_install.exe cmd.exe PID 2604 wrote to memory of 2980 2604 setup_install.exe cmd.exe PID 2604 wrote to memory of 4744 2604 setup_install.exe cmd.exe PID 2604 wrote to memory of 4744 2604 setup_install.exe cmd.exe PID 2604 wrote to memory of 4744 2604 setup_install.exe cmd.exe PID 2604 wrote to memory of 5092 2604 setup_install.exe cmd.exe PID 2604 wrote to memory of 5092 2604 setup_install.exe cmd.exe PID 2604 wrote to memory of 5092 2604 setup_install.exe cmd.exe PID 2604 wrote to memory of 5088 2604 setup_install.exe cmd.exe PID 2604 wrote to memory of 5088 2604 setup_install.exe cmd.exe PID 2604 wrote to memory of 5088 2604 setup_install.exe cmd.exe PID 2604 wrote to memory of 3768 2604 setup_install.exe cmd.exe PID 2604 wrote to memory of 3768 2604 setup_install.exe cmd.exe PID 2604 wrote to memory of 3768 2604 setup_install.exe cmd.exe PID 2604 wrote to memory of 1700 2604 setup_install.exe cmd.exe PID 2604 wrote to memory of 1700 2604 setup_install.exe cmd.exe PID 2604 wrote to memory of 1700 2604 setup_install.exe cmd.exe PID 2604 wrote to memory of 8 2604 setup_install.exe cmd.exe PID 2604 wrote to memory of 8 2604 setup_install.exe cmd.exe PID 2604 wrote to memory of 8 2604 setup_install.exe cmd.exe PID 2604 wrote to memory of 4692 2604 setup_install.exe cmd.exe PID 2604 wrote to memory of 4692 2604 setup_install.exe cmd.exe PID 2604 wrote to memory of 4692 2604 setup_install.exe cmd.exe PID 2604 wrote to memory of 3308 2604 setup_install.exe cmd.exe PID 2604 wrote to memory of 3308 2604 setup_install.exe cmd.exe PID 2604 wrote to memory of 3308 2604 setup_install.exe cmd.exe PID 2604 wrote to memory of 4524 2604 setup_install.exe cmd.exe PID 2604 wrote to memory of 4524 2604 setup_install.exe cmd.exe PID 2604 wrote to memory of 4524 2604 setup_install.exe cmd.exe PID 4524 wrote to memory of 2344 4524 cmd.exe Fri196814a5b87cc7.exe PID 4524 wrote to memory of 2344 4524 cmd.exe Fri196814a5b87cc7.exe PID 4744 wrote to memory of 4380 4744 cmd.exe Fri1925d9ac2c1.exe PID 4744 wrote to memory of 4380 4744 cmd.exe Fri1925d9ac2c1.exe PID 4744 wrote to memory of 4380 4744 cmd.exe Fri1925d9ac2c1.exe PID 5092 wrote to memory of 3940 5092 cmd.exe Fri19673ed1dece.exe PID 5092 wrote to memory of 3940 5092 cmd.exe Fri19673ed1dece.exe PID 5092 wrote to memory of 3940 5092 cmd.exe Fri19673ed1dece.exe PID 1700 wrote to memory of 3404 1700 cmd.exe Fri19bba638b6340.exe PID 1700 wrote to memory of 3404 1700 cmd.exe Fri19bba638b6340.exe PID 1700 wrote to memory of 3404 1700 cmd.exe Fri19bba638b6340.exe PID 4692 wrote to memory of 4500 4692 cmd.exe Fri19684b7c65.exe PID 4692 wrote to memory of 4500 4692 cmd.exe Fri19684b7c65.exe PID 5088 wrote to memory of 3212 5088 cmd.exe Fri193178698e28d.exe PID 5088 wrote to memory of 3212 5088 cmd.exe Fri193178698e28d.exe PID 3768 wrote to memory of 420 3768 cmd.exe Fri19c8b39c17cf87d0d.exe PID 3768 wrote to memory of 420 3768 cmd.exe Fri19c8b39c17cf87d0d.exe PID 3768 wrote to memory of 420 3768 cmd.exe Fri19c8b39c17cf87d0d.exe PID 8 wrote to memory of 3516 8 cmd.exe Fri199a782d2f821b345.exe PID 8 wrote to memory of 3516 8 cmd.exe Fri199a782d2f821b345.exe PID 8 wrote to memory of 3516 8 cmd.exe Fri199a782d2f821b345.exe PID 3308 wrote to memory of 3736 3308 cmd.exe Fri19089f5589cd7fd.exe PID 3308 wrote to memory of 3736 3308 cmd.exe Fri19089f5589cd7fd.exe PID 3308 wrote to memory of 3736 3308 cmd.exe Fri19089f5589cd7fd.exe PID 2980 wrote to memory of 4440 2980 cmd.exe powershell.exe PID 2980 wrote to memory of 4440 2980 cmd.exe powershell.exe PID 2980 wrote to memory of 4440 2980 cmd.exe powershell.exe PID 4380 wrote to memory of 1632 4380 Fri1925d9ac2c1.exe Fri1925d9ac2c1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\213b4d4a3fa8742fd83229a8be042bb9.exe"C:\Users\Admin\AppData\Local\Temp\213b4d4a3fa8742fd83229a8be042bb9.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\7zS85643C49\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS85643C49\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
- Suspicious use of AdjustPrivilegeToken
PID:4440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri1925d9ac2c1.exe4⤵
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\7zS85643C49\Fri1925d9ac2c1.exeFri1925d9ac2c1.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\7zS85643C49\Fri1925d9ac2c1.exe"C:\Users\Admin\AppData\Local\Temp\7zS85643C49\Fri1925d9ac2c1.exe" -a6⤵
- Executes dropped EXE
PID:1632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri19673ed1dece.exe4⤵
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\7zS85643C49\Fri19673ed1dece.exeFri19673ed1dece.exe5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri19c8b39c17cf87d0d.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\7zS85643C49\Fri19c8b39c17cf87d0d.exeFri19c8b39c17cf87d0d.exe5⤵
- Executes dropped EXE
PID:420 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 420 -s 4806⤵
- Program crash
PID:1376 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 420 -s 8246⤵
- Program crash
PID:3528 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 420 -s 8326⤵
- Program crash
PID:3624 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 420 -s 8766⤵
- Program crash
PID:540 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 420 -s 11926⤵
- Program crash
PID:1640 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 420 -s 14966⤵
- Program crash
PID:1188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri19bba638b6340.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\7zS85643C49\Fri19bba638b6340.exeFri19bba638b6340.exe5⤵
- Executes dropped EXE
PID:3404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri193178698e28d.exe4⤵
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\7zS85643C49\Fri193178698e28d.exeFri193178698e28d.exe5⤵
- Executes dropped EXE
PID:3212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri199a782d2f821b345.exe4⤵
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\7zS85643C49\Fri199a782d2f821b345.exeFri199a782d2f821b345.exe5⤵
- Executes dropped EXE
PID:3516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri196814a5b87cc7.exe4⤵
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\7zS85643C49\Fri196814a5b87cc7.exeFri196814a5b87cc7.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri19089f5589cd7fd.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\7zS85643C49\Fri19089f5589cd7fd.exeFri19089f5589cd7fd.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3736 -
C:\Windows\SysWOW64\dllhost.exedllhost.exe6⤵PID:3624
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Abbassero.wmv6⤵PID:2568
-
C:\Windows\SysWOW64\cmd.execmd7⤵PID:2476
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^VHwgFRxzxxLcwcGoqrvwdRkyDDkqmNLTpdmTOMvFsotvynnSaSEGawtrcWKeGzUGIRjLVNzgHQJiNPZttzIGotBijvbSexZYgbNhjNWFndZB$" Rugiada.wmv8⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Piu.exe.comPiu.exe.com L8⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Piu.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Piu.exe.com L9⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4936 -
C:\Windows\SysWOW64\PING.EXEping NUPNSVML -n 308⤵
- Runs ping.exe
PID:4648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri19684b7c65.exe4⤵
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\7zS85643C49\Fri19684b7c65.exeFri19684b7c65.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4500 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 5684⤵
- Program crash
PID:4664
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2604 -ip 26041⤵PID:3456
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 420 -ip 4201⤵PID:2396
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 420 -ip 4201⤵PID:1240
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 420 -ip 4201⤵PID:4012
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 420 -ip 4201⤵PID:1248
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 420 -ip 4201⤵PID:5068
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 420 -ip 4201⤵PID:3576
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD59816173c0462753439780cd040d546e2
SHA1cb63512db6f800cc62dfe943a41613b4cbb15484
SHA256da65a761ea15c24fdb4e322e48d67f914c9399e6c804de75127424211551d51f
SHA512c9443baaf190b01b36d0d65103634d5f9492acd395ef2b9924e60822d7023dfc40692443362342534db284829ae36302f75d3ebc04d3ebf5bc3107e3b59e46bf
-
Filesize
768KB
MD529ceb1ffd59d562edb3afa8e2516d64e
SHA1f868dcd8dd943e857acfe4388af372bb1068b08d
SHA2566f1db0d5545050a45debd974f46f005b9ee9c1318dc9c4544a8bef9d7e9ca566
SHA5129bde4860d859ed730962f0cfe5c3bf6d267dd52ab93e7a900fb20fa8cde828e228178f0e04730200e2e6ce2570cafd93ada7619fc0e28ecfb2ff16793ffdd1a9
-
Filesize
56KB
MD5c0d18a829910babf695b4fdaea21a047
SHA1236a19746fe1a1063ebe077c8a0553566f92ef0f
SHA25678958d664b1c140f2b45e56c4706108eeb5f14756977e2efd3409f8a788d3c98
SHA512cca06a032d8232c0046c6160f47b8792370745b47885c2fa75308abc3df76dcc5965858b004c1aad05b8cd8fbb9a359077be1b97ec087a05d740145030675823
-
Filesize
900KB
MD50a0d22f1c9179a67d04166de0db02dbb
SHA1106e55bd898b5574f9bd33dac9f3c0b95cecd90d
SHA256a59457fbfaf3d1b2e17463d0ffd50680313b1905aff69f13694cfc3fffd5a4ac
SHA5128abf8dc0da25c0fdbaa1ca39db057db80b9a135728fed9cd0f45b0f06d5652cee8d309b92e7cb953c0c4e8b38ffa2427c33f4865f1eb985a621316f9eb187b8b
-
Filesize
146KB
MD5a1d3526515688c005dbc17c326ccf3c7
SHA161b5809228ca371834e6585a19baec6e1b7e487d
SHA25693d2248207bc1cd74d0ba89e7f507b08ebfd2a6f54ba5bee4157fcf048614bed
SHA5123a5e0c3aaecde273a7a66427059915a102ad8c525f08f1d5fc2e1f92377347f8be91f3b46083bd33e4cc3c9c35162b845d236eb4268630b4a7c51db9391c6953
-
Filesize
8KB
MD5d1d4b4d26a9b9714a02c252fb46b72ce
SHA1af9e34a28f8f408853d3cd504f03ae43c03cc24f
SHA2568a77dd50b720322088fbe92aeba219cc744bd664ff660058b1949c3b9b428bac
SHA512182929a5ff0414108f74283e77ba044ab359017ace35a06f9f3ebd8b69577c22ecc85705cb908d1aa99d3a20246076bc82a7f6de7e3c4424d4e1dc3a9a6954cd
-
Filesize
156KB
MD5cda12ae37191467d0a7d151664ed74aa
SHA12625b2e142c848092aa4a51584143ab7ed7d33d2
SHA2561e07bb767e9979d4afa4f8d69b68e33dd7c1a43f6863096a2b091047a10cdc2e
SHA51277c4429e22754e50828d9ec344cd63780acd31c350ef16ef69e2a396114df10e7c43d791440faee90e7f80be73e845ab579fd7b38efbd12f5de11bbc906f1c1d
-
Filesize
1.5MB
MD5df80b76857b74ae1b2ada8efb2a730ee
SHA15653be57533c6eb058fed4963a25a676488ef832
SHA2565545c43eb14b0519ab997673efa379343f98d2b6b1578d9fdeb369234789f9dd
SHA512060b04536003ce4a91e5847d487701eed7e093408e427198be552f0af37aee498929586f3a0110c78173873a28d95c6c0a4cdd01c7218274f5849a4730f9efdd
-
Filesize
248KB
MD5d23c06e25b4bd295e821274472263572
SHA19ad295ec3853dc465ae77f9479f8c4f76e2748b8
SHA256f02c1351a8b3dc296cf815bb4cd2bcc2d25b3b9a258ab2ad95e8be3d9602322c
SHA512122b0ef44682f83651d81df622bbff5ad9fa0f5bbd6b925e35add9568825c0316c0f9921dac21cf92cb44658fc854f7829c01ae3b84aa0745929f8ef5e6ae1ae
-
Filesize
513KB
MD561c8a2149f252302495834d749e1ec4a
SHA1a701cc1851212090a36c296794d35a535609708f
SHA2568f8d948716ff8ecdcaf251b41f032803e4d718acc03afcb906a4e19b36fcc8f9
SHA5125f8cad356044e1f0e272f9bb94f26aedaf72f06b7897af6c856bf1ecaa373df2b23b4bc4fd91b46297a7fb73913b1b4ab8010a83fc8180f5a2f570e8334b45b5
-
Filesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
Filesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
Filesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
Filesize
647KB
MD55e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
Filesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
Filesize
2.1MB
MD5a11eb2db217a321af5c6dafbc7e65d4e
SHA101f669895b5a9fe541078ff51ae694f94fdc58fc
SHA256987f6570dfc2e95d74187c8d4c6b3378aa24a920eb55489b94a213b956251975
SHA512401b7077560fe955d6f107b5fd0d38864577cfd1db6b84c84a3773edb512a787929b688c986b52b2ff66c3e65a7b89e88c60bdc9678a4c0a3a48b8d1c02d2a75
-
Filesize
534B
MD5697af31c63a3d02a3e39109027671e68
SHA18a7083bc918366b05f75e54853cc39a45cc0da7c
SHA2566cb806bec68db2c4f5aee59c4f604b502a4266f020cdf408e4dc543974b88036
SHA51212a0b4f4023e04afe7515da738a4574931ff1d7538e264c93eef6142675be6bf83cdd590bbdaa6f704da9a78addd6b111a0bf23542f5c11d65b213feeaf8a8b8
-
Filesize
872KB
MD5c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
Filesize
577KB
MD59d64d14627e79c6f733c74a2049c334d
SHA1771f3b69b8954df0134c5f750a92aa521a2d9a36
SHA2560d16e628415ab84ab9d56af4587fe1419acdb5806b7d9dda552a5bf66a5b56c6
SHA512433da42bd563ff43e5e4ce399b9bab8bb64a62fc67aea8114b49b4a1e8e4b0bdba68ade2e70b5a62cb4417e06200e2dfb5fe8bb6ca9141947148d22af09223db
-
Filesize
634KB
MD577b02472e42d7fdae3f1f39cfc5d9158
SHA1f5f4570b452b6554e0ac7c9ab476ca6db9320f29
SHA256111b913a0dab95cd7efaaca4676b1ea47113ebd0f8e3b4a6707af0fa62337a97
SHA512945a6727e0d0f98db230b93933e3fa20ea4b5e98d2e6e03374e6718d2cd5097a20f8a5dc4cb4e00a9f070286a623f7719cc1ee9a5f9910a6156fb29ce8f559d0
-
Filesize
872KB
MD548c3a0e572e8b258f5d9f4891278ea7a
SHA1db742db08c27bd7f74977d53ba532a5fae6e3cad
SHA256ed7cf7296658bc2aae125c803ce7e6242397f7ed783f8852708d2c558fc6e75e
SHA512615542411ff6fbec3ac03573ab6b975a10056b51541503ac9ee8f683b9f4875d7f5f00ed8c19a07d25b5daea0ef39fe7ef45414b1e6dc7d5d45147172c33f672
-
Filesize
4.2MB
MD5dff19d6730bfa6333c94422301b0f008
SHA1318cb6cae764201b6604049b60504256aed83d89
SHA2560c1941d8b2a89a9995f160d39fac8817dceb0a3a4597bcb87ae7969c33ca2cad
SHA512b833b137af7d244f014e3c4160d921b75cbbe09374c1956882fb9d292783a86ae23aeb73214d91e688c8d00ece1823208ace2fab4f11d88711cd3d1067f09606