Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system -
submitted
20/03/2024, 10:55
Static task
static1
Behavioral task
behavioral1
Sample
90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe
Resource
win10v2004-20240226-en
General
-
Target
90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe
-
Size
370KB
-
MD5
68c18c6e22a5803ddd0844d8e55cf6c1
-
SHA1
ab98918ccfab525a92756dc5289e0af13e3a1d5d
-
SHA256
90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35
-
SHA512
8581ad22c0104777290837f977439f3d466926c62f741982abcec860ed5379ffaea99c15fcbc133495662f8a028fc7b487ab52338125a00bfd267a60867e24f8
-
SSDEEP
6144:l0gfMLaZd9sw69XKKDH308uOGKP/bxXuIrEL3/zBg:NiaZd9xXKDHhJGulX6S
Malware Config
Extracted
F:\HOW TO BACK FILES.txt
targetcompany
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion
Signatures
-
TargetCompany,Mallox
TargetCompany (aka Mallox) is a ransomware which encrypts files using a combination of ChaCha20, AES-128, and Curve25519, first seen in June 2021.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 2356 bcdedit.exe 2960 bcdedit.exe -
Renames multiple (4996) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened (read-only) \??\M: 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened (read-only) \??\U: 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened (read-only) \??\Y: 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened (read-only) \??\P: 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened (read-only) \??\T: 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened (read-only) \??\X: 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened (read-only) \??\B: 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened (read-only) \??\H: 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened (read-only) \??\J: 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened (read-only) \??\K: 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened (read-only) \??\O: 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened (read-only) \??\W: 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened (read-only) \??\Z: 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened (read-only) \??\G: 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened (read-only) \??\L: 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened (read-only) \??\R: 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened (read-only) \??\S: 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened (read-only) \??\V: 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened (read-only) \??\D: 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened (read-only) \??\E: 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened (read-only) \??\A: 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened (read-only) \??\N: 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened (read-only) \??\Q: 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 api.ipify.org -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\mobile.css 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File created C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\HOW TO BACK FILES.txt 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File created C:\Program Files\VideoLAN\VLC\plugins\mux\HOW TO BACK FILES.txt 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File created C:\Program Files\Windows Media Player\HOW TO BACK FILES.txt 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.nl_zh_4.4.0.v20140623020002.jar 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files\Microsoft Games\HOW TO BACK FILES.txt 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightYellow\HOW TO BACK FILES.txt 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-lib-uihandler_zh_CN.jar 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_zh_CN.jar 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\vlc.mo 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152702.WMF 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\HOW TO BACK FILES.txt 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files\DVD Maker\de-DE\HOW TO BACK FILES.txt 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\HOW TO BACK FILES.txt 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Ushuaia 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sm\HOW TO BACK FILES.txt 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\HOW TO BACK FILES.txt 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs_ja.jar 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files (x86)\Windows Media Player\Network Sharing\HOW TO BACK FILES.txt 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01630_.WMF 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107152.WMF 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0286068.WMF 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\HOW TO BACK FILES.txt 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File created C:\Program Files\Java\jre7\lib\security\HOW TO BACK FILES.txt 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\HOW TO BACK FILES.txt 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1036\HOW TO BACK FILES.txt 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\HOW TO BACK FILES.txt 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-threaddump.xml 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-12 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.jpg 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Equity.thmx 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Tahiti 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files\Windows Media Player\es-ES\WMPDMCCore.dll.mui 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\RECYCLE.WMF 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File created C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\HOW TO BACK FILES.txt 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\HOW TO BACK FILES.txt 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_ButtonGraphic.png 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.STD 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD00160_.WMF 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099165.JPG 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105288.WMF 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\HOW TO BACK FILES.txt 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_ButtonGraphic.png 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files\Windows Media Player\fr-FR\WMPMediaSharing.dll.mui 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099161.JPG 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Hermosillo 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zurich 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\Mendoza 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\HOW TO BACK FILES.txt 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\HOW TO BACK FILES.txt 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\HOW TO BACK FILES.txt 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\jfluid-server_zh_CN.jar 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\HOW TO BACK FILES.txt 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\CAGCAT10.MMW 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH03014_.GIF 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File created C:\Program Files\VideoLAN\VLC\lua\http\HOW TO BACK FILES.txt 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-io-ui_zh_CN.jar 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105292.WMF 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0216112.JPG 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\HOW TO BACK FILES.txt 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Vincennes 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239941.WMF 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Brisbane 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Paris 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeDebugPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe Token: SeTakeOwnershipPrivilege 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2884 wrote to memory of 1268 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe 28 PID 2884 wrote to memory of 1268 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe 28 PID 2884 wrote to memory of 1268 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe 28 PID 2884 wrote to memory of 2176 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe 30 PID 2884 wrote to memory of 2176 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe 30 PID 2884 wrote to memory of 2176 2884 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe 30 PID 1268 wrote to memory of 2356 1268 cmd.exe 32 PID 1268 wrote to memory of 2356 1268 cmd.exe 32 PID 1268 wrote to memory of 2356 1268 cmd.exe 32 PID 2176 wrote to memory of 2960 2176 cmd.exe 33 PID 2176 wrote to memory of 2960 2176 cmd.exe 33 PID 2176 wrote to memory of 2960 2176 cmd.exe 33 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0" 90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe"C:\Users\Admin\AppData\Local\Temp\90570f4d0c891fa402ebd9e717f2e336cdadaffc408b345e4d347a2f84265f35.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2884 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\system32\bcdedit.exebcdedit /set {current} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:2356
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no2⤵
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\system32\bcdedit.exebcdedit /set {current} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:2960
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD55718503cdc896b3f8c23eb855a608a3e
SHA197bd640162e5275d21196d3d20b7ed25653213a6
SHA256e24e70638656ec2ea3e55d7c75daadb9207afa33d6fe9ade508e7292c79c9318
SHA512ff4e520b8a1e3a410026da3d89637c4d8a79a507f1c86ade61ccf8c14fd6e72bfa68e4615dd53b2fcdbc43b83bc55a8b640f2705fb17fb26fb1ec2de43218a61