Analysis
-
max time kernel
142s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-03-2024 00:43
Static task
static1
Behavioral task
behavioral1
Sample
dcd19eee4fabb093e3e5fd6ed05c845c.exe
Resource
win7-20240221-en
General
-
Target
dcd19eee4fabb093e3e5fd6ed05c845c.exe
-
Size
283KB
-
MD5
dcd19eee4fabb093e3e5fd6ed05c845c
-
SHA1
b0c6823a142435c8f20455c83797b820a4bff5d2
-
SHA256
ce1b526bd03a7d5dd0c4d5803ae9c3c881de4f2229cae4e6c01d07c81b2a6541
-
SHA512
84d6cdb4bba43c5e10dc963e3b106d002d14b495c40f7dd02ce560d2d53ed4eef696849eac437dc38f2431f70b7388e91f3611a169384c82d88c755d192c4d67
-
SSDEEP
6144:y/aIitjKYKKiYkuKcuuiRahdoZ1oiAcYS+U7MyXP2R0:yiIitGPuKcniYhdoZ1gRSL7dP2
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
Processes:
dcd19eee4fabb093e3e5fd6ed05c845c.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "3" dcd19eee4fabb093e3e5fd6ed05c845c.exe -
Disables taskbar notifications via registry modification
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Executes dropped EXE 1 IoCs
Processes:
89C9.tmppid process 1352 89C9.tmp -
Loads dropped DLL 2 IoCs
Processes:
dcd19eee4fabb093e3e5fd6ed05c845c.exepid process 2280 dcd19eee4fabb093e3e5fd6ed05c845c.exe 2280 dcd19eee4fabb093e3e5fd6ed05c845c.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/2280-1-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2280-11-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/1796-14-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/1796-13-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2280-81-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/872-83-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2280-180-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2280-200-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2280-204-0x0000000000400000-0x000000000046C000-memory.dmp upx behavioral1/memory/2280-244-0x0000000000400000-0x000000000046C000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
dcd19eee4fabb093e3e5fd6ed05c845c.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AC4.exe = "C:\\Program Files (x86)\\LP\\F2E6\\AC4.exe" dcd19eee4fabb093e3e5fd6ed05c845c.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 3 IoCs
Processes:
dcd19eee4fabb093e3e5fd6ed05c845c.exedescription ioc process File opened for modification C:\Program Files (x86)\LP\F2E6\89C9.tmp dcd19eee4fabb093e3e5fd6ed05c845c.exe File opened for modification C:\Program Files (x86)\LP\F2E6\AC4.exe dcd19eee4fabb093e3e5fd6ed05c845c.exe File created C:\Program Files (x86)\LP\F2E6\AC4.exe dcd19eee4fabb093e3e5fd6ed05c845c.exe -
Modifies registry class 5 IoCs
Processes:
explorer.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe -
Processes:
dcd19eee4fabb093e3e5fd6ed05c845c.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 dcd19eee4fabb093e3e5fd6ed05c845c.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a dcd19eee4fabb093e3e5fd6ed05c845c.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a dcd19eee4fabb093e3e5fd6ed05c845c.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a dcd19eee4fabb093e3e5fd6ed05c845c.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
dcd19eee4fabb093e3e5fd6ed05c845c.exepid process 2280 dcd19eee4fabb093e3e5fd6ed05c845c.exe 2280 dcd19eee4fabb093e3e5fd6ed05c845c.exe 2280 dcd19eee4fabb093e3e5fd6ed05c845c.exe 2280 dcd19eee4fabb093e3e5fd6ed05c845c.exe 2280 dcd19eee4fabb093e3e5fd6ed05c845c.exe 2280 dcd19eee4fabb093e3e5fd6ed05c845c.exe 2280 dcd19eee4fabb093e3e5fd6ed05c845c.exe 2280 dcd19eee4fabb093e3e5fd6ed05c845c.exe 2280 dcd19eee4fabb093e3e5fd6ed05c845c.exe 2280 dcd19eee4fabb093e3e5fd6ed05c845c.exe 2280 dcd19eee4fabb093e3e5fd6ed05c845c.exe 2280 dcd19eee4fabb093e3e5fd6ed05c845c.exe 2280 dcd19eee4fabb093e3e5fd6ed05c845c.exe 2280 dcd19eee4fabb093e3e5fd6ed05c845c.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 1396 explorer.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
Processes:
msiexec.exeexplorer.exedescription pid process Token: SeRestorePrivilege 2652 msiexec.exe Token: SeTakeOwnershipPrivilege 2652 msiexec.exe Token: SeSecurityPrivilege 2652 msiexec.exe Token: SeShutdownPrivilege 1396 explorer.exe Token: SeShutdownPrivilege 1396 explorer.exe Token: SeShutdownPrivilege 1396 explorer.exe Token: SeShutdownPrivilege 1396 explorer.exe Token: SeShutdownPrivilege 1396 explorer.exe Token: SeShutdownPrivilege 1396 explorer.exe Token: SeShutdownPrivilege 1396 explorer.exe Token: SeShutdownPrivilege 1396 explorer.exe Token: SeShutdownPrivilege 1396 explorer.exe Token: SeShutdownPrivilege 1396 explorer.exe Token: SeShutdownPrivilege 1396 explorer.exe Token: SeShutdownPrivilege 1396 explorer.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
Processes:
explorer.exepid process 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe -
Suspicious use of SendNotifyMessage 18 IoCs
Processes:
explorer.exepid process 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe 1396 explorer.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
dcd19eee4fabb093e3e5fd6ed05c845c.exedescription pid process target process PID 2280 wrote to memory of 1796 2280 dcd19eee4fabb093e3e5fd6ed05c845c.exe dcd19eee4fabb093e3e5fd6ed05c845c.exe PID 2280 wrote to memory of 1796 2280 dcd19eee4fabb093e3e5fd6ed05c845c.exe dcd19eee4fabb093e3e5fd6ed05c845c.exe PID 2280 wrote to memory of 1796 2280 dcd19eee4fabb093e3e5fd6ed05c845c.exe dcd19eee4fabb093e3e5fd6ed05c845c.exe PID 2280 wrote to memory of 1796 2280 dcd19eee4fabb093e3e5fd6ed05c845c.exe dcd19eee4fabb093e3e5fd6ed05c845c.exe PID 2280 wrote to memory of 872 2280 dcd19eee4fabb093e3e5fd6ed05c845c.exe dcd19eee4fabb093e3e5fd6ed05c845c.exe PID 2280 wrote to memory of 872 2280 dcd19eee4fabb093e3e5fd6ed05c845c.exe dcd19eee4fabb093e3e5fd6ed05c845c.exe PID 2280 wrote to memory of 872 2280 dcd19eee4fabb093e3e5fd6ed05c845c.exe dcd19eee4fabb093e3e5fd6ed05c845c.exe PID 2280 wrote to memory of 872 2280 dcd19eee4fabb093e3e5fd6ed05c845c.exe dcd19eee4fabb093e3e5fd6ed05c845c.exe PID 2280 wrote to memory of 1352 2280 dcd19eee4fabb093e3e5fd6ed05c845c.exe 89C9.tmp PID 2280 wrote to memory of 1352 2280 dcd19eee4fabb093e3e5fd6ed05c845c.exe 89C9.tmp PID 2280 wrote to memory of 1352 2280 dcd19eee4fabb093e3e5fd6ed05c845c.exe 89C9.tmp PID 2280 wrote to memory of 1352 2280 dcd19eee4fabb093e3e5fd6ed05c845c.exe 89C9.tmp -
System policy modification 1 TTPs 2 IoCs
Processes:
dcd19eee4fabb093e3e5fd6ed05c845c.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" dcd19eee4fabb093e3e5fd6ed05c845c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer dcd19eee4fabb093e3e5fd6ed05c845c.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\dcd19eee4fabb093e3e5fd6ed05c845c.exe"C:\Users\Admin\AppData\Local\Temp\dcd19eee4fabb093e3e5fd6ed05c845c.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\dcd19eee4fabb093e3e5fd6ed05c845c.exeC:\Users\Admin\AppData\Local\Temp\dcd19eee4fabb093e3e5fd6ed05c845c.exe startC:\Users\Admin\AppData\Roaming\6FD66\CFEF2.exe%C:\Users\Admin\AppData\Roaming\6FD662⤵
-
C:\Users\Admin\AppData\Local\Temp\dcd19eee4fabb093e3e5fd6ed05c845c.exeC:\Users\Admin\AppData\Local\Temp\dcd19eee4fabb093e3e5fd6ed05c845c.exe startC:\Program Files (x86)\6638E\lvvm.exe%C:\Program Files (x86)\6638E2⤵
-
C:\Program Files (x86)\LP\F2E6\89C9.tmp"C:\Program Files (x86)\LP\F2E6\89C9.tmp"2⤵
- Executes dropped EXE
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Cab85B6.tmpFilesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\Local\Temp\Tar85C9.tmpFilesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63
-
C:\Users\Admin\AppData\Roaming\6FD66\638E.FD6Filesize
1KB
MD5541dcc2436d4474a37289d9b7b17ccdc
SHA1cc6c3762b91fccc189a8a9176b988b4d08a5577e
SHA2566caad5795727738fd99b139e410839f9ce5c4bea37422cdb98498aed4d8b8fda
SHA512dbc6b2358be7e0d93d037651149b51f7c1160537e620f50babda077f863766b72442c627340a1805dd1bd87eb9eaaa2ad3fcbb5a4c66ab0baf3b2162a32b9c8a
-
C:\Users\Admin\AppData\Roaming\6FD66\638E.FD6Filesize
996B
MD5e22f64cb316e5a5d8d77b02728213ab1
SHA1268238f590bbde02a0e785530fa9311f9608e4fb
SHA256263324d70dc127ceaaa5ebf581624e711c65de0ccc393e79b0749e9a475afe55
SHA5123dd3a161f4dcfecba90732740ca7e2ec98b1a690c71f5d88024d6300895c1420af89275105d7b22bd3f721f58429bdca7949d4144ce419a3ac80946d16094cb7
-
C:\Users\Admin\AppData\Roaming\6FD66\638E.FD6Filesize
600B
MD5972d26efe4d0ae89692f3d8ebc279023
SHA18a2dcbdc4037aef90419ecd9ca728b440e774f80
SHA256eed2caae94ac2c569fbd8bd856a73391353e4618ce49fd747e8c40ea724b20f4
SHA512c47bb195f19f4186d33d56e8b61c60915b4f49aff60630e6627a3d40e34085e9137658fcd77737e73f7aa460b9f40e4e8352577e83cad64369812f0af7326d0b
-
\Program Files (x86)\LP\F2E6\89C9.tmpFilesize
99KB
MD59d83b6d4629b9d0e96bbdb171b0dc5db
SHA1e9bed14c44fe554e0e8385096bbacca494da30b1
SHA256d3a6060ff059a7724a483d82025a9231a61143839b633a6d3842a58ccb5a7d7d
SHA512301187bdcab5ca9942b2c7b7114e37e53e58b5661eef50c389622950d7691993a29f5a825132cf499ca73cdb6637d3f58afdc024cb04fac2b8e01f752209572c
-
memory/872-85-0x0000000000470000-0x00000000004B8000-memory.dmpFilesize
288KB
-
memory/872-83-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/1352-198-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/1352-196-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/1352-197-0x00000000002D0000-0x00000000003D0000-memory.dmpFilesize
1024KB
-
memory/1396-114-0x0000000004430000-0x0000000004431000-memory.dmpFilesize
4KB
-
memory/1396-202-0x0000000004430000-0x0000000004431000-memory.dmpFilesize
4KB
-
memory/1796-13-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/1796-14-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/1796-15-0x0000000001FF0000-0x0000000002038000-memory.dmpFilesize
288KB
-
memory/2280-81-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/2280-2-0x0000000000470000-0x0000000000570000-memory.dmpFilesize
1024KB
-
memory/2280-180-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/2280-200-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/2280-84-0x0000000000470000-0x0000000000570000-memory.dmpFilesize
1024KB
-
memory/2280-204-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/2280-11-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/2280-1-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/2280-244-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB