Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/03/2024, 10:54
Static task
static1
Behavioral task
behavioral1
Sample
374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe
Resource
win10v2004-20240226-en
General
-
Target
374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe
-
Size
372KB
-
MD5
05f62ecabc68ee01d8274a3c97f5b101
-
SHA1
8128819b7fa55a7a331e933fce52051c66d5e72d
-
SHA256
374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a
-
SHA512
e53afc5c9f4cba52c521dbc6f24144bce4f182bdc40a39f94b0005d335cd5384472c48fb04b1e1f6e9dc0a94e58739d6ccda4eff9114f5020054a95c7b903df8
-
SSDEEP
6144:MfkWFheyVxcO8fo66ZYB9LEpvkWohWS4rNaLGU:BAVgfl6iYpcWot5
Malware Config
Extracted
\Device\HarddiskVolume1\HOW TO BACK FILES.txt
targetcompany
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion
Signatures
-
TargetCompany,Mallox
TargetCompany (aka Mallox) is a ransomware which encrypts files using a combination of ChaCha20, AES-128, and Curve25519, first seen in June 2021.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 2636 bcdedit.exe 2640 bcdedit.exe -
Renames multiple (2796) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened (read-only) \??\Q: 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened (read-only) \??\R: 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened (read-only) \??\U: 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened (read-only) \??\V: 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened (read-only) \??\Z: 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened (read-only) \??\I: 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened (read-only) \??\O: 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened (read-only) \??\G: 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened (read-only) \??\J: 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened (read-only) \??\M: 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened (read-only) \??\N: 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened (read-only) \??\D: 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened (read-only) \??\E: 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened (read-only) \??\S: 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened (read-only) \??\T: 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened (read-only) \??\W: 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened (read-only) \??\X: 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened (read-only) \??\Y: 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened (read-only) \??\K: 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened (read-only) \??\L: 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened (read-only) \??\H: 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened (read-only) \??\A: 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened (read-only) \??\B: 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 api.ipify.org -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\HOW TO BACK FILES.txt 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator.nl_ja_4.4.0.v20140623020002.jar 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkNoDrop32x32.gif 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Santarem 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Foundry.xml 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Assets.accdt 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\HOW TO BACK FILES.txt 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\HOW TO BACK FILES.txt 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Port-au-Prince 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Norfolk 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0250997.WMF 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-plaf.xml 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153514.WMF 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02435_.WMF 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01239K.JPG 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\2 Top.accdt 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files\Java\jre7\lib\jfr\HOW TO BACK FILES.txt 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files\Windows Media Player\Media Renderer\DMR_120.jpg 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02265_.WMF 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01236U.BMP 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\OLTASKR.FAE 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0296277.WMF 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14829_.GIF 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\HOW TO BACK FILES.txt 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files\Microsoft Games\HOW TO BACK FILES.txt 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\HOW TO BACK FILES.txt 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\HOW TO BACK FILES.txt 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\SEAMARBL.HTM 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\BlackTieMergeLetter.dotx 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\HOW TO BACK FILES.txt 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ia\HOW TO BACK FILES.txt 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_ja_4.4.0.v20140623020002.jar 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_pt_BR.properties 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\DataListIconImagesMask.bmp 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Tunis 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00512_.WMF 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR51F.GIF 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\PROG98.POC 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File created C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\HOW TO BACK FILES.txt 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME16.CSS 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Americana\TAB_OFF.GIF 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Americana\TAB_ON.GIF 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host-views.jar 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00814_.WMF 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01839_.GIF 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14828_.GIF 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\HOW TO BACK FILES.txt 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\1033\HOW TO BACK FILES.txt 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_100_eeeeee_1x100.png 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145212.JPG 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\HOW TO BACK FILES.txt 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File created C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\HOW TO BACK FILES.txt 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\IN00346_.WMF 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0212601.WMF 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Places\ALARM.WAV 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE03453_.WMF 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0222021.WMF 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Casual.css 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File created C:\Program Files\Microsoft Games\FreeCell\es-ES\HOW TO BACK FILES.txt 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.registry_3.5.400.v20140428-1507.jar 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\vlc.mo 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0252669.WMF 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01158_.WMF 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_alignleft.gif 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeDebugPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe Token: SeTakeOwnershipPrivilege 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2232 wrote to memory of 3016 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe 29 PID 2232 wrote to memory of 3016 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe 29 PID 2232 wrote to memory of 3016 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe 29 PID 2232 wrote to memory of 2520 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe 30 PID 2232 wrote to memory of 2520 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe 30 PID 2232 wrote to memory of 2520 2232 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe 30 PID 3016 wrote to memory of 2640 3016 cmd.exe 33 PID 3016 wrote to memory of 2640 3016 cmd.exe 33 PID 3016 wrote to memory of 2640 3016 cmd.exe 33 PID 2520 wrote to memory of 2636 2520 cmd.exe 34 PID 2520 wrote to memory of 2636 2520 cmd.exe 34 PID 2520 wrote to memory of 2636 2520 cmd.exe 34 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0" 374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe"C:\Users\Admin\AppData\Local\Temp\374a979d2b8b45d23e3310676256624ab96bd604c2eb11f327c3e5044a95654a.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2232 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\system32\bcdedit.exebcdedit /set {current} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:2640
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no2⤵
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\system32\bcdedit.exebcdedit /set {current} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:2636
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5447d3d5481e27e733a8e359af4db21f6
SHA1b8f897df111ffd0ee5cb17866acd4a6b470a2ed2
SHA256d79c4ca7122f4abbca3da3db70f2b2059e655ee3cfed35291d549bced27f5ba8
SHA512027cba8c6116ca3067f49b340819f269279b90e06eed9a2a6f2c01572a35a82a742e79852d67ceb86fd18f399441fcd0f91b6b70848ff46986773e1c1fd343bb
-
Filesize
4KB
MD58527e01b0a95bcb77890a7bbc27f2a88
SHA1690b19619aac200bf9f89e1aa6b1becbb67f0a48
SHA256a831fc9da8c4317b07b1d6e7c4a30fae138d644e39b9ac61672d6802c03bcc68
SHA5124ff52ffc13efcc742f0033bd73087a32c07b50519e4923ed99e81499e444f5d60bf181587d87e3164ab4e5a1e4caffeedf2a07041f31d3d9f9ba29df4cd4a029
-
Filesize
1KB
MD57f973021e38755a8d055a18782b1048f
SHA13e92e6edbb2ed92ae386dec7a569d1447b87bb2c
SHA256a530ca79c8e236c535cbe799050fa8150c8ac826989efb256f24654f7a447a33
SHA512c3951d2500102aca467fb73ba6faf539719108cb4b1b7f497f0236538fbcbd0da55b7657e343a44760297e892886bf926a9df25abeaeb6f60beedcf8e72b8fdf