Overview
overview
10Static
static
1007ba533a69...53.exe
windows7-x64
107ba533a69...53.exe
windows10-2004-x64
10e971ff0e7...8d.exe
windows7-x64
80e971ff0e7...8d.exe
windows10-2004-x64
8111fb06de8...8b.exe
windows7-x64
9111fb06de8...8b.exe
windows10-2004-x64
92de3cea3eb...a8.exe
windows7-x64
12de3cea3eb...a8.exe
windows10-2004-x64
1327a2a4916...ca.exe
windows7-x64
8327a2a4916...ca.exe
windows10-2004-x64
836c10a3e1f...d9.exe
windows7-x64
136c10a3e1f...d9.exe
windows10-2004-x64
867bf260c3e...10.exe
windows7-x64
867bf260c3e...10.exe
windows10-2004-x64
870ec1874cf...ac.exe
windows7-x64
170ec1874cf...ac.exe
windows10-2004-x64
1817f5b0fcc...99.exe
windows7-x64
7817f5b0fcc...99.exe
windows10-2004-x64
7875a6185aa...f0.exe
windows7-x64
1875a6185aa...f0.exe
windows10-2004-x64
1887d386d2e...c6.exe
windows7-x64
1887d386d2e...c6.exe
windows10-2004-x64
1902afe35c6...16.exe
windows7-x64
10902afe35c6...16.exe
windows10-2004-x64
1097b6e51df2...0a.exe
windows7-x64
797b6e51df2...0a.exe
windows10-2004-x64
7a4704be3a7...72.exe
windows7-x64
1a4704be3a7...72.exe
windows10-2004-x64
1b21f34ecfa...73.exe
windows7-x64
9b21f34ecfa...73.exe
windows10-2004-x64
9b75b3ff656...52.exe
windows7-x64
8b75b3ff656...52.exe
windows10-2004-x64
8Analysis
-
max time kernel
361s -
max time network
368s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
01-01-2024 14:39
Behavioral task
behavioral1
Sample
07ba533a694e1733f8ef1c18ac191867382f4ca7a51244cda6ef5ec119fbfe53.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral2
Sample
07ba533a694e1733f8ef1c18ac191867382f4ca7a51244cda6ef5ec119fbfe53.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral4
Sample
0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral6
Sample
111fb06de858ef843c882e40f34caf958054b0eeaeea877c49a23b1111916e8b.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
2de3cea3eb6eedbec7436f426a5259d4f65374b326823feee17175407f08e7a8.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral8
Sample
2de3cea3eb6eedbec7436f426a5259d4f65374b326823feee17175407f08e7a8.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
327a2a49164bc38c88a2d030ece9a7487b82e8a34d3f398e071654e5fcc4d7ca.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral10
Sample
327a2a49164bc38c88a2d030ece9a7487b82e8a34d3f398e071654e5fcc4d7ca.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
36c10a3e1f93c4d50fb617ab7cd629bebea7ca5f827239ba98156ff88d27f7d9.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral12
Sample
36c10a3e1f93c4d50fb617ab7cd629bebea7ca5f827239ba98156ff88d27f7d9.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
67bf260c3ea1e11df9c162b370cb5182d6d9d66392d90f11729c90e911404c10.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral14
Sample
67bf260c3ea1e11df9c162b370cb5182d6d9d66392d90f11729c90e911404c10.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
70ec1874cf1304960c0b1b828216a22704caaff23ea514c1067efe9ce4b69aac.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral16
Sample
70ec1874cf1304960c0b1b828216a22704caaff23ea514c1067efe9ce4b69aac.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
817f5b0fcccda6756c485e463b3f0ea43bb894f866ce5cac9f7d1f065e3e1999.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral18
Sample
817f5b0fcccda6756c485e463b3f0ea43bb894f866ce5cac9f7d1f065e3e1999.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
875a6185aa50896f96a40c75005c849b320ef27f7332e7a2c0c2c1d3d55faff0.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral20
Sample
875a6185aa50896f96a40c75005c849b320ef27f7332e7a2c0c2c1d3d55faff0.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
887d386d2ea9af0c079f4010311069045df5c51d658921b2c9de81c4378b4bc6.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral22
Sample
887d386d2ea9af0c079f4010311069045df5c51d658921b2c9de81c4378b4bc6.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
902afe35c6ca794e8b436dad7edf142d2492abe3907055e4bd5e85ce6f617016.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral24
Sample
902afe35c6ca794e8b436dad7edf142d2492abe3907055e4bd5e85ce6f617016.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
97b6e51df2a1187481fa28ada65be40fb6d727e0fa3b40cc6796780d680b300a.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral26
Sample
97b6e51df2a1187481fa28ada65be40fb6d727e0fa3b40cc6796780d680b300a.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
a4704be3a77f989693188a4a505b62719ffe87718f8891ab5d3e1de1b1a57572.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral28
Sample
a4704be3a77f989693188a4a505b62719ffe87718f8891ab5d3e1de1b1a57572.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral30
Sample
b21f34ecfa7135153d506b3fde2a0d0bd23b44eccedc635cbfa474e321040273.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
b75b3ff65632b65d1d641075bd2f5ed0ede93da3a35d7f50068b9371ee5c4552.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral32
Sample
b75b3ff65632b65d1d641075bd2f5ed0ede93da3a35d7f50068b9371ee5c4552.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
General
-
Target
0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe
-
Size
179KB
-
MD5
8e0e472d93c3ebeb725099bc1bbe0a9a
-
SHA1
7229e11205e794c75a65587bcef040ed345b3322
-
SHA256
0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d
-
SHA512
74a63a29a6ea5cfd2f7983b9828dd7a78b3d16072f5e044e795404eb67a2178ac091e15c9a29bafa7b9e7426c6aa709697cb9705ff25f7e40c9597ad1758eda3
-
SSDEEP
3072:2Rb6HWdU1NByFMuIBRC0eXLfQzueFsB0yxfWolUJFMXNsz5SkE+pbt8ICjGs:IbeBRmXLP0yJAJFMXNXyC
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 64 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\TNEMG9GL\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Public\Desktop\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Public\Recorded TV\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Public\Music\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Admin\Contacts\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0SFQZHYD\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Admin\Downloads\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Public\Pictures\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SHU28U5R\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Public\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\EW3J74TG\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Admin\Documents\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Admin\Favorites\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Public\Recorded TV\Sample Media\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Public\Libraries\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Admin\Favorites\Links\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Admin\Videos\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\VFIJ47B3\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Admin\Saved Games\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Admin\Desktop\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XH1ZG1MF\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Admin\Searches\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HUTPJXSG\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\All Users\Microsoft\Windows\Ringtones\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Public\Documents\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Public\Videos\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Public\Videos\Sample Videos\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\V17S5RKJ\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Admin\Links\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe File created C:\Users\Admin\Pictures\desktop.ini 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 612 2052 WerFault.exe 17 -
Modifies Control Panel 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Control Panel\Desktop\WallpaperStyle = "1" 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Control Panel\Desktop\TileWallpaper = "0" 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2052 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2052 wrote to memory of 612 2052 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe 30 PID 2052 wrote to memory of 612 2052 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe 30 PID 2052 wrote to memory of 612 2052 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe 30 PID 2052 wrote to memory of 612 2052 0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe"C:\Users\Admin\AppData\Local\Temp\0e971ff0e7f4cd4714931ac6bb685d91e28b34070866c9e7c976817aa5f6eb8d.exe"1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 15162⤵
- Program crash
PID:612
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD5ed90ea3c480cedd49b1ea9d09bc3594b
SHA1987f6ce7b5d2432167cfcf129f800bc4e42d50d5
SHA2562ccd2fecb70615bd21d3d7517b12271e5523642c5efeb443a7354a98c1bae860
SHA5128deeeefeaa2542dc55da5cc6d184fd20c2b9f751903daf01db30ae0431d43eac3df90fad02f18012cfd7349ef230e2dcf7c42e2d3524f594572686048fef35eb
-
C:\ProgramData\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi
Filesize140KB
MD55c8d1f25fa219557d1258b9c93783fd9
SHA1359eabd8c7884b4893f59238191b5ed570cdd6ca
SHA2567a35ddc1a8df5ddb55f282800693da33646e05670f4aab082e01913e5a75ac14
SHA5120ae2fb4c4ad1134084ea7b49c920c17909ce93b426a820d9f2fe5a8667c8d9520741e14dfcc62eee5b00c59c1561a846f9da6d1eb716246a0fe424d1ff3278fa
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db-journal
Filesize16B
MD5b4a9117719656f6534c921c67700dbf0
SHA156773c00a1bfebecaeb06b25d2e3845181e45f82
SHA256edb9e310ffb5d1a7a341d906812a1ac785a20e2e527bafb5ffcc048bca37931a
SHA5128838b686a4865db8e523add549790ce1df8fcfb15c775fa4836ac05dc2ae7f2620c8761c9e8fe0859ed2570d0821fdc5626dee43db4d3e703b14cea5128e00de
-
Filesize
32B
MD59746006aa6d195a3127df78872c132cf
SHA1ecf53b5877c444510e14247abfdf98c55a472e0b
SHA256e22729824fb6f814ad34623be79fc79dcff8a63a2e3721e7110a0140227eda91
SHA512cda4ebbf069cf710b9f90d3f380705f70ee86f5fd1e8da51088c37ffe9df56bb6f464f30cc3b49a4aefa67b944846a953fe6ebec95ab07d54b6b3900adb9e9e4
-
Filesize
28KB
MD5e8448b35709cf055b117e4b3d15e95ea
SHA15598e9c8f590fdfac78f4710d4d7234b194e98ae
SHA256887c3a40b0cff5665493e53f5a84925b2f5513910c64587fbf66d8d322261370
SHA51261b82db72f0ef0887678f81f2588f1dce41a50e49ee9c35b1f8cc479481321c758e11e41803ed26745c313afe11e435bdb76ad958d9c364baa4d510edad921b0
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z2ud2i1e.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite
Filesize48KB
MD53e50ca8928b768f1ac0ab7f42e54d4fb
SHA15e8bb145dc51579fd17d715bf7a3eade13cc1c90
SHA256adb4fe32e7c38e727b4c07d4fc34262832aeec45a84ccb012456e1816a29d9d4
SHA5128a175e62e93a17e6a6e450a1ad06259713e6a981e47616410943c3eff90f2a504d0ac6d2534f8e77f06e0e077497645811b187a502beb3d5b024064acfebc88d