Analysis

  • max time kernel
    158s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-01-2024 12:51

General

  • Target

    5b484a2ea446dc0b049554a45a7199e2.exe

  • Size

    842KB

  • MD5

    5b484a2ea446dc0b049554a45a7199e2

  • SHA1

    0e9b03648a491ed221c50026c77c61cf92108de8

  • SHA256

    2bac343d25b4c6b8a6f93682813b85735ca0325ab240a49a2abbc95492866fff

  • SHA512

    88e75e036526cb8d06cdca6d5ddeda3eb73bbb2449606228214ccf68a98431724c08aabb2e2974fef2e27e10c3e626af9223bae058ce6989d12cf34e46456153

  • SSDEEP

    24576:ZNLmjHYHfe+SBa8uzsiYWb+n3BsM8BYkRc37aOu:Zpmj4HW9Ba8EKuMcYDL

Score
8/10

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 29 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 12 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 56 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 60 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\5b484a2ea446dc0b049554a45a7199e2.exe
    "C:\Users\Admin\AppData\Local\Temp\5b484a2ea446dc0b049554a45a7199e2.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:3632
    • C:\ProgramData\isecurity.exe
      C:\ProgramData\isecurity.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Enumerates connected drives
      • Writes to the Master Boot Record (MBR)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:4440
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 784
        3⤵
        • Program crash
        PID:4488
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 828
        3⤵
        • Program crash
        PID:3796
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 1144
        3⤵
        • Program crash
        PID:3228
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 1152
        3⤵
        • Program crash
        PID:5036
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 1220
        3⤵
        • Program crash
        PID:1536
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 1228
        3⤵
        • Program crash
        PID:4996
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 1312
        3⤵
        • Program crash
        PID:1856
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 1320
        3⤵
        • Program crash
        PID:4976
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 1332
        3⤵
        • Program crash
        PID:4896
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 1848
        3⤵
        • Program crash
        PID:2432
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 2004
        3⤵
        • Program crash
        PID:3188
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 1300
        3⤵
        • Program crash
        PID:1440
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4440 -ip 4440
    1⤵
      PID:4476
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4440 -ip 4440
      1⤵
        PID:3692
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4440 -ip 4440
        1⤵
          PID:2400
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4440 -ip 4440
          1⤵
            PID:4748
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4440 -ip 4440
            1⤵
              PID:4104
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4440 -ip 4440
              1⤵
                PID:4860
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4440 -ip 4440
                1⤵
                  PID:3688
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4440 -ip 4440
                  1⤵
                    PID:4560
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4440 -ip 4440
                    1⤵
                      PID:4544
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of WriteProcessMemory
                      PID:1492
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                        • Modifies Installed Components in the registry
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        PID:4784
                    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                      1⤵
                      • Modifies data under HKEY_USERS
                      • Suspicious use of SetWindowsHookEx
                      PID:2744
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of WriteProcessMemory
                      PID:3484
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                        • Modifies Installed Components in the registry
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        PID:2168
                    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                      1⤵
                      • Modifies data under HKEY_USERS
                      • Suspicious use of SetWindowsHookEx
                      PID:2616
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of WriteProcessMemory
                      PID:1656
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                          PID:1664
                      • C:\Windows\system32\sihost.exe
                        sihost.exe
                        1⤵
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of WriteProcessMemory
                        PID:3672
                        • C:\Windows\explorer.exe
                          explorer.exe /LOADSAVEDWINDOWS
                          2⤵
                          • Modifies Installed Components in the registry
                          • Enumerates connected drives
                          • Checks SCSI registry key(s)
                          • Modifies registry class
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          PID:3920
                      • C:\Windows\system32\sihost.exe
                        sihost.exe
                        1⤵
                          PID:2280
                          • C:\Windows\explorer.exe
                            explorer.exe /LOADSAVEDWINDOWS
                            2⤵
                              PID:1984
                          • C:\Windows\system32\sihost.exe
                            sihost.exe
                            1⤵
                              PID:3428
                              • C:\Windows\explorer.exe
                                explorer.exe /LOADSAVEDWINDOWS
                                2⤵
                                  PID:372
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:4700
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:3848
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:3588
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:4476
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                        • Modifies Installed Components in the registry
                                        • Enumerates connected drives
                                        • Checks SCSI registry key(s)
                                        • Modifies registry class
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of SendNotifyMessage
                                        PID:1664
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:736
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                            PID:3208
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:2512
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:3996
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:1644
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:4360
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:3572
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:3116
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:4008
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:4952
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:3556
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:3384
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                  PID:4340
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:1212
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:1564
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                        PID:2420
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:1996
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:3800
                                                                          • C:\Windows\explorer.exe
                                                                            explorer.exe
                                                                            1⤵
                                                                              PID:4448
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                                PID:1228
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:2772
                                                                                • C:\Windows\explorer.exe
                                                                                  explorer.exe
                                                                                  1⤵
                                                                                    PID:3664
                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4440 -ip 4440
                                                                                    1⤵
                                                                                      PID:4444
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:4236
                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4440 -ip 4440
                                                                                        1⤵
                                                                                          PID:3744
                                                                                        • C:\Windows\explorer.exe
                                                                                          explorer.exe
                                                                                          1⤵
                                                                                            PID:1952
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:5036
                                                                                            • C:\Windows\explorer.exe
                                                                                              explorer.exe
                                                                                              1⤵
                                                                                                PID:3628
                                                                                              • C:\Windows\explorer.exe
                                                                                                explorer.exe
                                                                                                1⤵
                                                                                                  PID:4008
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                    PID:4452
                                                                                                  • C:\Windows\explorer.exe
                                                                                                    explorer.exe
                                                                                                    1⤵
                                                                                                      PID:1652
                                                                                                    • C:\Windows\explorer.exe
                                                                                                      explorer.exe
                                                                                                      1⤵
                                                                                                        PID:644
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe
                                                                                                        1⤵
                                                                                                          PID:4460
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          explorer.exe
                                                                                                          1⤵
                                                                                                            PID:2780
                                                                                                          • C:\Windows\explorer.exe
                                                                                                            explorer.exe
                                                                                                            1⤵
                                                                                                              PID:3528
                                                                                                            • C:\Windows\explorer.exe
                                                                                                              explorer.exe
                                                                                                              1⤵
                                                                                                                PID:4284
                                                                                                              • C:\Windows\explorer.exe
                                                                                                                explorer.exe
                                                                                                                1⤵
                                                                                                                  PID:716
                                                                                                                • C:\Windows\explorer.exe
                                                                                                                  explorer.exe
                                                                                                                  1⤵
                                                                                                                    PID:4032
                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                    explorer.exe
                                                                                                                    1⤵
                                                                                                                      PID:1808
                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                      explorer.exe
                                                                                                                      1⤵
                                                                                                                        PID:2196
                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                        explorer.exe
                                                                                                                        1⤵
                                                                                                                          PID:1588
                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                          explorer.exe
                                                                                                                          1⤵
                                                                                                                            PID:4192
                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                            explorer.exe
                                                                                                                            1⤵
                                                                                                                              PID:396
                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                              explorer.exe
                                                                                                                              1⤵
                                                                                                                                PID:1572
                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                explorer.exe
                                                                                                                                1⤵
                                                                                                                                  PID:1356
                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                  explorer.exe
                                                                                                                                  1⤵
                                                                                                                                    PID:4656
                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                    explorer.exe
                                                                                                                                    1⤵
                                                                                                                                      PID:2364
                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                      explorer.exe
                                                                                                                                      1⤵
                                                                                                                                        PID:1792
                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                        explorer.exe
                                                                                                                                        1⤵
                                                                                                                                          PID:1216
                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                          explorer.exe
                                                                                                                                          1⤵
                                                                                                                                            PID:1884
                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                            explorer.exe
                                                                                                                                            1⤵
                                                                                                                                              PID:4064
                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                              explorer.exe
                                                                                                                                              1⤵
                                                                                                                                                PID:3604
                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                explorer.exe
                                                                                                                                                1⤵
                                                                                                                                                  PID:4352
                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                  explorer.exe
                                                                                                                                                  1⤵
                                                                                                                                                    PID:4400
                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                    explorer.exe
                                                                                                                                                    1⤵
                                                                                                                                                      PID:4648
                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                      explorer.exe
                                                                                                                                                      1⤵
                                                                                                                                                        PID:4760
                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                        explorer.exe
                                                                                                                                                        1⤵
                                                                                                                                                          PID:1544
                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                          explorer.exe
                                                                                                                                                          1⤵
                                                                                                                                                            PID:2216
                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                            explorer.exe
                                                                                                                                                            1⤵
                                                                                                                                                              PID:4612
                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                              explorer.exe
                                                                                                                                                              1⤵
                                                                                                                                                                PID:4452
                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                explorer.exe
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:4444
                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                  explorer.exe
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:3832
                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                    explorer.exe
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:732
                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                      explorer.exe
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:4108
                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                        explorer.exe
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:2928
                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                          explorer.exe
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:4548
                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                            explorer.exe
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:4944
                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                              explorer.exe
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:3612
                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                explorer.exe
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:1856
                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                  explorer.exe
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:3840
                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                    explorer.exe
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:4876
                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                      explorer.exe
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:3076
                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                        explorer.exe
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:4348
                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                          explorer.exe
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:3492
                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                            explorer.exe
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:4292
                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                              explorer.exe
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:3452
                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                explorer.exe
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:1028
                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                  explorer.exe
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:4128
                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                    explorer.exe
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:2464
                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                      explorer.exe
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:3092
                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                        explorer.exe
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:656
                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                          explorer.exe
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:1736
                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                            explorer.exe
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:1668
                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                              explorer.exe
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:4296
                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                explorer.exe
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:3168
                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                  explorer.exe
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:3896
                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                    explorer.exe
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:1588
                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                      explorer.exe
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:1476
                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                        explorer.exe
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:4572
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 4440 -ip 4440
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:4972
                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                            explorer.exe
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:3624
                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                              explorer.exe
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:1068
                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                explorer.exe
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:3152
                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                  explorer.exe
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:716
                                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                                    explorer.exe
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:4372
                                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                                      explorer.exe
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:1808
                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                        explorer.exe
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:2700
                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                          explorer.exe
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:1072
                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                            explorer.exe
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                              PID:392
                                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                                              explorer.exe
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                PID:1120
                                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                explorer.exe
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                  PID:4584
                                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                  explorer.exe
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:480
                                                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                    explorer.exe
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                      PID:3352
                                                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                      explorer.exe
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:3356
                                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                        explorer.exe
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                          PID:808
                                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                          explorer.exe
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                            PID:3760
                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                            explorer.exe
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                              PID:2456
                                                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              explorer.exe
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                PID:4056
                                                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                explorer.exe
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                  PID:4444
                                                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                  explorer.exe
                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                    PID:4436
                                                                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                    explorer.exe
                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                      PID:4228
                                                                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                      explorer.exe
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                        PID:3980

                                                                                                                                                                                                                                                                      Network

                                                                                                                                                                                                                                                                      MITRE ATT&CK Matrix ATT&CK v13

                                                                                                                                                                                                                                                                      Persistence

                                                                                                                                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                      T1547

                                                                                                                                                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                      T1547.001

                                                                                                                                                                                                                                                                      Pre-OS Boot

                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                      T1542

                                                                                                                                                                                                                                                                      Bootkit

                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                      T1542.003

                                                                                                                                                                                                                                                                      Privilege Escalation

                                                                                                                                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                      T1547

                                                                                                                                                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                      T1547.001

                                                                                                                                                                                                                                                                      Defense Evasion

                                                                                                                                                                                                                                                                      Modify Registry

                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                      T1112

                                                                                                                                                                                                                                                                      Pre-OS Boot

                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                      T1542

                                                                                                                                                                                                                                                                      Bootkit

                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                      T1542.003

                                                                                                                                                                                                                                                                      Discovery

                                                                                                                                                                                                                                                                      Query Registry

                                                                                                                                                                                                                                                                      3
                                                                                                                                                                                                                                                                      T1012

                                                                                                                                                                                                                                                                      Peripheral Device Discovery

                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                      T1120

                                                                                                                                                                                                                                                                      System Information Discovery

                                                                                                                                                                                                                                                                      3
                                                                                                                                                                                                                                                                      T1082

                                                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                                                      • C:\ProgramData\isecurity.exe
                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        835KB

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        94f1bb632e23af11ab8d009cd68f6c39

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        426236401df0d42d13cd50dabceb370a90790989

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        7e28270e8dac6064b5b308ff11d4f725376ca59ae9cdcbf38014a3eecbb884c9

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        61885316becec706e0d4c3fa9dcc65ee3c74233de93ccfb681f7c962d5162b60abb67fa0dea0a8f458b2349930daab92ba3019523662737a05c6261a8a5fdb14

                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        471B

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        b26c8a72ff7f6e1792367a62479b63bb

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        c13a24bfce868763d8ace40a61b9271cf8df8524

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        e803d7491735608241ff2aa14af4ba36a88c062a8a845da3550322dea19416d7

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        a15ce1073160339d30b8d728e4a15c81d780ebec2598946cbb357b937fcccf0148f72b812cbd28f151caf7cea42bf9b415fae1a464a5062bd76bfa88ad9c682e

                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        412B

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        c92b6b0af5564eeed991a38a7c5312ba

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        d36251aecca8e94d728c352cdc96ce42f07318d4

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        6ecad41cd33106686ba6458243e40725110f713ad05edc8af2bf393922928cd8

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        88bb78d0dd7e86984640af9dceea86edc4ae06c55772c94489b3de20474e745ae14544dc2f2a29298a3dbc35ecd6dc021054c7aa7dfe144f1ddad41422f5971f

                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        1022B

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        47f050bbdc59b1cc5bf2731323c24ca3

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        7276b3d487863efddf1df928ce09c2a2f5d09e57

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        6099819d5b1733a4d91cf456592c2bb59769d53d073abcbc3f585d48981861ee

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        a664742a3f6feb0d0e46ac9359b040cf3a98827497a4aca02eff239e1b64f6d75b9bc282a9546f19435fef7014239d1351282befc5c978e48088c2b3850e4083

                                                                                                                                                                                                                                                                      • C:\Users\Public\Desktop\Internet Security.lnk
                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        682B

                                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                                        504fd787022e4cd9dcda2d4382eb982b

                                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                                        d1a985178099947b0c0a7024077c176b206a964a

                                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                                        cce9d9ee5449a0c9c3d8a1bbb98a0d3788740ef90e3ee01c27e09e85ca21146a

                                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                                        4845b98b741c11f8a77cec9a44d499ec4dccb3874fa0149b6fddfe5203b7fc91d0777043ccdc04776865b6f76c0e410bb33740a9bed5ea6b8b3c9694a551fd20

                                                                                                                                                                                                                                                                      • memory/3632-1-0x0000000002250000-0x0000000002251000-memory.dmp
                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                      • memory/3632-2-0x0000000000400000-0x0000000000505000-memory.dmp
                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        1.0MB

                                                                                                                                                                                                                                                                      • memory/3632-7-0x0000000000400000-0x0000000000505000-memory.dmp
                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        1.0MB

                                                                                                                                                                                                                                                                      • memory/3632-0-0x0000000000400000-0x0000000000505000-memory.dmp
                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        1.0MB

                                                                                                                                                                                                                                                                      • memory/3920-43-0x0000000004DB0000-0x0000000004DB1000-memory.dmp
                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                      • memory/4440-18-0x0000000000400000-0x0000000000A3E000-memory.dmp
                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        6.2MB

                                                                                                                                                                                                                                                                      • memory/4440-56-0x0000000000400000-0x0000000000A3E000-memory.dmp
                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        6.2MB

                                                                                                                                                                                                                                                                      • memory/4440-19-0x00000000025F0000-0x00000000025F1000-memory.dmp
                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                      • memory/4440-31-0x0000000000400000-0x0000000000A3E000-memory.dmp
                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        6.2MB

                                                                                                                                                                                                                                                                      • memory/4440-17-0x0000000000400000-0x0000000000A3E000-memory.dmp
                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        6.2MB

                                                                                                                                                                                                                                                                      • memory/4440-15-0x0000000000400000-0x0000000000A3E000-memory.dmp
                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        6.2MB

                                                                                                                                                                                                                                                                      • memory/4440-14-0x0000000000400000-0x0000000000A3E000-memory.dmp
                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        6.2MB

                                                                                                                                                                                                                                                                      • memory/4440-52-0x0000000000400000-0x0000000000A3E000-memory.dmp
                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        6.2MB

                                                                                                                                                                                                                                                                      • memory/4440-53-0x0000000000400000-0x0000000000A3E000-memory.dmp
                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        6.2MB

                                                                                                                                                                                                                                                                      • memory/4440-54-0x0000000000400000-0x0000000000A3E000-memory.dmp
                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        6.2MB

                                                                                                                                                                                                                                                                      • memory/4440-55-0x00000000025F0000-0x00000000025F1000-memory.dmp
                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                                      • memory/4440-68-0x0000000000400000-0x0000000000A3E000-memory.dmp
                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        6.2MB

                                                                                                                                                                                                                                                                      • memory/4440-58-0x0000000000400000-0x0000000000A3E000-memory.dmp
                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        6.2MB

                                                                                                                                                                                                                                                                      • memory/4440-59-0x0000000000400000-0x0000000000A3E000-memory.dmp
                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        6.2MB

                                                                                                                                                                                                                                                                      • memory/4440-60-0x0000000000400000-0x0000000000A3E000-memory.dmp
                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        6.2MB

                                                                                                                                                                                                                                                                      • memory/4440-61-0x0000000000400000-0x0000000000A3E000-memory.dmp
                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        6.2MB

                                                                                                                                                                                                                                                                      • memory/4440-62-0x0000000000400000-0x0000000000A3E000-memory.dmp
                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        6.2MB

                                                                                                                                                                                                                                                                      • memory/4440-63-0x0000000000400000-0x0000000000A3E000-memory.dmp
                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        6.2MB

                                                                                                                                                                                                                                                                      • memory/4440-64-0x0000000000400000-0x0000000000A3E000-memory.dmp
                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        6.2MB

                                                                                                                                                                                                                                                                      • memory/4440-65-0x0000000000400000-0x0000000000A3E000-memory.dmp
                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        6.2MB

                                                                                                                                                                                                                                                                      • memory/4440-66-0x0000000000400000-0x0000000000A3E000-memory.dmp
                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        6.2MB

                                                                                                                                                                                                                                                                      • memory/4440-67-0x0000000000400000-0x0000000000A3E000-memory.dmp
                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        6.2MB

                                                                                                                                                                                                                                                                      • memory/4784-29-0x0000000003FE0000-0x0000000003FE1000-memory.dmp
                                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                                        4KB