Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
09-03-2024 05:16
Static task
static1
Behavioral task
behavioral1
Sample
8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe
Resource
win10v2004-20240226-en
General
-
Target
8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe
-
Size
371KB
-
MD5
5f450ed574e81038b7fe94edfb40834d
-
SHA1
0318ec8497436a97b7263f9138deefb01d4d9708
-
SHA256
8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848
-
SHA512
686d9fc0f9837e0ddf5f57892e04762aed828a960a983df6b6ab3c8e243d460e1d8c8bd80be0e7c7aa2593d8951cd2b20a1953856567b321e180e6edb8d49c0e
-
SSDEEP
6144:S0LeYyBiqCw5wLzsEtA6We/p14a0q/HJ5/fzCH:4YyB7Cw+MEtA6db4pq/pNC
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-2248906074-2862704502-246302768-1000\HOW TO BACK FILES.txt
targetcompany
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion
Signatures
-
TargetCompany,Mallox
TargetCompany (aka Mallox) is a ransomware which encrypts files using a combination of ChaCha20, AES-128, and Curve25519, first seen in June 2021.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 2560 bcdedit.exe 3056 bcdedit.exe -
Renames multiple (7284) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened (read-only) \??\D: 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened (read-only) \??\E: 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened (read-only) \??\A: 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened (read-only) \??\H: 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened (read-only) \??\O: 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened (read-only) \??\P: 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened (read-only) \??\S: 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened (read-only) \??\Y: 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened (read-only) \??\Z: 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened (read-only) \??\K: 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened (read-only) \??\L: 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened (read-only) \??\N: 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened (read-only) \??\B: 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened (read-only) \??\G: 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened (read-only) \??\J: 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened (read-only) \??\T: 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened (read-only) \??\U: 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened (read-only) \??\X: 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened (read-only) \??\I: 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened (read-only) \??\M: 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened (read-only) \??\Q: 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened (read-only) \??\R: 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened (read-only) \??\V: 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 api.ipify.org -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre7\COPYRIGHT 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02278_.WMF 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\OUTLOOK.HOL 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\STOPICON.JPG 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Salta 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\ECLIPSE_.SF 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-snaptracer.xml 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\EST 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Kiev 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\HOW TO BACK FILES.txt 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-core-kit.xml 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341636.JPG 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00913_.WMF 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WING2.WMF 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18218_.WMF 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.log 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107458.WMF 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_left_over.gif 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\HOW TO BACK FILES.txt 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01069_.WMF 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host_zh_CN.jar 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvmstat_ja.jar 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Angles.xml 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21422_.GIF 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\1033\HOW TO BACK FILES.txt 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher_1.3.0.v20140911-0143.jar 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.app_1.3.200.v20130910-1609.jar 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\OMSINTL.DLL.IDX_DLL 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsViewAttachmentIconsMask.bmp 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\HOW TO BACK FILES.txt 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dhaka 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SpringGreen\TAB_ON.GIF 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File created C:\Program Files\Microsoft Games\FreeCell\HOW TO BACK FILES.txt 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Magadan 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\POLICIES.FDT 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.SE.XML 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00148_.WMF 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152690.WMF 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsBrowserUpgrade.html 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files\Windows Media Player\it-IT\HOW TO BACK FILES.txt 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\jvm.lib 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\toc.xml 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\ED00172_.WMF 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00391_.WMF 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CALHM.POC 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File created C:\Program Files\Mozilla Firefox\browser\VisualElements\HOW TO BACK FILES.txt 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File created C:\Program Files\VideoLAN\VLC\locale\my\HOW TO BACK FILES.txt 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00276_.WMF 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\IN00351_.WMF 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0386267.JPG 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR32B.GIF 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CERT.XML 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File created C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\HOW TO BACK FILES.txt 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-applemenu_zh_CN.jar 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dubai 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105240.WMF 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152414.WMF 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Hardcover.eftx 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14692_.GIF 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\TAB_ON.GIF 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\HOW TO BACK FILES.txt 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files\DVD Maker\SecretST.TTF 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\MedianLetter.Dotx 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0090783.WMF 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeDebugPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe Token: SeTakeOwnershipPrivilege 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1756 wrote to memory of 2280 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe 28 PID 1756 wrote to memory of 2280 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe 28 PID 1756 wrote to memory of 2280 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe 28 PID 1756 wrote to memory of 2264 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe 29 PID 1756 wrote to memory of 2264 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe 29 PID 1756 wrote to memory of 2264 1756 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe 29 PID 2280 wrote to memory of 2560 2280 cmd.exe 32 PID 2280 wrote to memory of 2560 2280 cmd.exe 32 PID 2280 wrote to memory of 2560 2280 cmd.exe 32 PID 2264 wrote to memory of 3056 2264 cmd.exe 33 PID 2264 wrote to memory of 3056 2264 cmd.exe 33 PID 2264 wrote to memory of 3056 2264 cmd.exe 33 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0" 8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe"C:\Users\Admin\AppData\Local\Temp\8901cdfd0b12b47326ca4570c48fdafd6353aab3cfa2e6be3accdab6374ec848.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1756 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\system32\bcdedit.exebcdedit /set {current} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:2560
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no2⤵
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\system32\bcdedit.exebcdedit /set {current} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:3056
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD54474fcd0223c2a7ce406f6cccbfe870a
SHA131e58efd3bfe5a0ff38c1173a1645599948e2f8a
SHA256b76f6ba3b9ee4282a9ef72e229847f41f4dbd1b8e733d5c260f051538d204e5f
SHA5121b37ab4afa2ebcf51fdbc92b7855ac7f839fe2f2df61b5067ab199e40058cc412ad555398d4ec9bda3161017a9d31670caeefd925048d818950844da1eab1388