Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
09/03/2024, 03:14
Static task
static1
Behavioral task
behavioral1
Sample
1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe
Resource
win10v2004-20240226-en
General
-
Target
1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe
-
Size
370KB
-
MD5
0272d1999cb6fbf3515156af63069c09
-
SHA1
5cadbf8b6769a034d709dab997e6b3b919fcbaad
-
SHA256
1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584
-
SHA512
bb6eb1a92136d9423cabb684a37daaf5eafe1caa0dbc4d735f9b9532d2a2e0a2ef1507f5b3d6a822afa47dc23eb92f90fe1d1670611d5c398e32f6dad71c86a6
-
SSDEEP
6144:G0H9hC0Ad6SkwEcXDVVIrElO2Z3WhrGJpFxFe5/QZ2BCn:/hnAd6SJxhVIrELBWhGJpFCCEy
Malware Config
Extracted
C:\$Recycle.Bin\HOW TO BACK FILES.txt
targetcompany
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion
Signatures
-
TargetCompany,Mallox
TargetCompany (aka Mallox) is a ransomware which encrypts files using a combination of ChaCha20, AES-128, and Curve25519, first seen in June 2021.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 2500 bcdedit.exe 2976 bcdedit.exe -
Renames multiple (7290) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened (read-only) \??\P: 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened (read-only) \??\R: 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened (read-only) \??\S: 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened (read-only) \??\Z: 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened (read-only) \??\K: 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened (read-only) \??\N: 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened (read-only) \??\T: 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened (read-only) \??\W: 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened (read-only) \??\M: 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened (read-only) \??\O: 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened (read-only) \??\V: 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened (read-only) \??\X: 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened (read-only) \??\E: 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened (read-only) \??\G: 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened (read-only) \??\I: 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened (read-only) \??\L: 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened (read-only) \??\Q: 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened (read-only) \??\U: 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened (read-only) \??\Y: 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened (read-only) \??\D: 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened (read-only) \??\A: 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened (read-only) \??\B: 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened (read-only) \??\H: 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 api.ipify.org -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Fakaofo 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\HOW TO BACK FILES.txt 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_ButtonGraphic.png 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-annotations-common_ja.jar 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN01545_.WMF 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\TAB_ON.GIF 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\TYPE.WAV 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\HOW TO BACK FILES.txt 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HOW TO BACK FILES.txt 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\indxicon.gif 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.core_5.5.0.165303.jar 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01238_.GIF 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\VOLTAGE.WAV 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Explorer.zip 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-util-enumerations.jar 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0103058.WMF 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00050_.WMF 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\rjmx.jar 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-tools.xml 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0215718.WMF 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File created C:\Program Files\VideoLAN\VLC\locale\he\HOW TO BACK FILES.txt 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-over-DOT.png 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Urumqi 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21313_.GIF 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0188587.WMF 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01213K.JPG 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\GlobeButtonImageMask.bmp 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File created C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\HOW TO BACK FILES.txt 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\feature.properties 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert.zh_CN_5.5.0.165303.jar 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\com.jrockit.mc.console.ui.notification_contexts.xml 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions_Generic.css 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsHomePageStyle.css 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPreviewTemplateRTL.html 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files\7-Zip\Lang\ta.txt 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\vignettemask25.png 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0086478.WMF 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02097_.GIF 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\HOW TO BACK FILES.txt 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGCHKBRD.XML 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0158071.WMF 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\HOW TO BACK FILES.txt 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\HOW TO BACK FILES.txt 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\fr-FR\HOW TO BACK FILES.txt 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Boa_Vista 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-outline.xml 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-dialogs_ja.jar 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02446_.WMF 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Form.zip 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\La_Paz 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_CA.txt 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\HOW TO BACK FILES.txt 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files\Microsoft Games\More Games\HOW TO BACK FILES.txt 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files\Mozilla Firefox\dependentlibs.list 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\SIGN98.POC 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0183290.WMF 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Lime\TAB_OFF.GIF 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPTSFrame.png 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-applemenu.xml 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-cli_zh_CN.jar 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02958_.WMF 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsMacroTemplate.html 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\1033\14\HOW TO BACK FILES.txt 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeDebugPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe Token: SeTakeOwnershipPrivilege 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2860 wrote to memory of 2224 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe 28 PID 2860 wrote to memory of 2224 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe 28 PID 2860 wrote to memory of 2224 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe 28 PID 2860 wrote to memory of 2956 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe 30 PID 2860 wrote to memory of 2956 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe 30 PID 2860 wrote to memory of 2956 2860 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe 30 PID 2224 wrote to memory of 2500 2224 cmd.exe 32 PID 2224 wrote to memory of 2500 2224 cmd.exe 32 PID 2224 wrote to memory of 2500 2224 cmd.exe 32 PID 2956 wrote to memory of 2976 2956 cmd.exe 33 PID 2956 wrote to memory of 2976 2956 cmd.exe 33 PID 2956 wrote to memory of 2976 2956 cmd.exe 33 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0" 1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe"C:\Users\Admin\AppData\Local\Temp\1c615da28dac08f6434eb7737f6102484cef6c90564a6562320e1dc3fe48e584.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2860 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\system32\bcdedit.exebcdedit /set {current} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:2500
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no2⤵
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\system32\bcdedit.exebcdedit /set {current} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:2976
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5ce9386bbb88c6322cb8a66fb4022f57d
SHA1639078e584ed8295a4414bd8db3ef9c1a7c50a9e
SHA25677532382f3b37a21dac285495009d96ef5bbc5f54d8562350b2918b44ef8e6b0
SHA5128618af25c054742cdbad4580507799fe5c2b588f032f2bbeee3b61d215f51a3405454510b2627dde396879947eb31ce5a9ea7c15371b7cbc46c5ed34399aeb6c