Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02-04-2024 10:08
Static task
static1
Behavioral task
behavioral1
Sample
10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe
Resource
win10v2004-20240226-en
General
-
Target
10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe
-
Size
798KB
-
MD5
202dd42eee0197f8951ca6b115432b30
-
SHA1
5d1a4fb62b88e28a46f1988cf0f7b035b28d424d
-
SHA256
10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952
-
SHA512
3a844c0493df3521fce56d454aab73221bda5a3a65f98b14d36975537b9df2fe5209e1c884736b5b3da5ae2b4a76225b4ffa751674d3802dfcef75cc5573d15b
-
SSDEEP
12288:uafx644Z97eXJM/0bsXGwCqjwEDBlf9plvnSAq:zA44bSPs2wwEDBnplaAq
Malware Config
Signatures
-
Avaddon
Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.
-
Avaddon payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4792-2-0x0000000002070000-0x000000000217E000-memory.dmp family_avaddon behavioral2/memory/4792-3-0x0000000000400000-0x0000000001B30000-memory.dmp family_avaddon behavioral2/memory/4792-319-0x0000000000400000-0x0000000001B30000-memory.dmp family_avaddon behavioral2/memory/4792-322-0x0000000002070000-0x000000000217E000-memory.dmp family_avaddon -
Processes:
10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe -
Renames multiple (154) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe -
Drops desktop.ini file(s) 1 IoCs
Processes:
10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exedescription ioc process File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-3270530367-132075249-2153716227-1000\desktop.ini 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exedescription ioc process File opened (read-only) \??\S: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe File opened (read-only) \??\B: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe File opened (read-only) \??\J: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe File opened (read-only) \??\N: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe File opened (read-only) \??\P: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe File opened (read-only) \??\V: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe File opened (read-only) \??\W: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe File opened (read-only) \??\X: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe File opened (read-only) \??\Z: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe File opened (read-only) \??\A: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe File opened (read-only) \??\I: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe File opened (read-only) \??\K: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe File opened (read-only) \??\M: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe File opened (read-only) \??\U: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe File opened (read-only) \??\L: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe File opened (read-only) \??\O: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe File opened (read-only) \??\Q: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe File opened (read-only) \??\R: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe File opened (read-only) \??\T: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe File opened (read-only) \??\E: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe File opened (read-only) \??\G: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe File opened (read-only) \??\H: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe File opened (read-only) \??\Y: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe File opened (read-only) \??\F: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 15 api.myip.com 16 api.myip.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 15 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 376 4792 WerFault.exe 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4432 4792 WerFault.exe 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 1596 4792 WerFault.exe 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 1616 4792 WerFault.exe 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 1872 4792 WerFault.exe 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 440 4792 WerFault.exe 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 2888 4792 WerFault.exe 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 952 4792 WerFault.exe 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 3988 4792 WerFault.exe 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4416 4792 WerFault.exe 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 3676 4792 WerFault.exe 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 2044 4792 WerFault.exe 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 2280 4792 WerFault.exe 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4824 4792 WerFault.exe 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 2804 4792 WerFault.exe 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exepid process 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe -
Suspicious use of AdjustPrivilegeToken 63 IoCs
Processes:
wmic.exewmic.exewmic.exedescription pid process Token: SeIncreaseQuotaPrivilege 3376 wmic.exe Token: SeSecurityPrivilege 3376 wmic.exe Token: SeTakeOwnershipPrivilege 3376 wmic.exe Token: SeLoadDriverPrivilege 3376 wmic.exe Token: SeSystemProfilePrivilege 3376 wmic.exe Token: SeSystemtimePrivilege 3376 wmic.exe Token: SeProfSingleProcessPrivilege 3376 wmic.exe Token: SeIncBasePriorityPrivilege 3376 wmic.exe Token: SeCreatePagefilePrivilege 3376 wmic.exe Token: SeBackupPrivilege 3376 wmic.exe Token: SeRestorePrivilege 3376 wmic.exe Token: SeShutdownPrivilege 3376 wmic.exe Token: SeDebugPrivilege 3376 wmic.exe Token: SeSystemEnvironmentPrivilege 3376 wmic.exe Token: SeRemoteShutdownPrivilege 3376 wmic.exe Token: SeUndockPrivilege 3376 wmic.exe Token: SeManageVolumePrivilege 3376 wmic.exe Token: 33 3376 wmic.exe Token: 34 3376 wmic.exe Token: 35 3376 wmic.exe Token: 36 3376 wmic.exe Token: SeIncreaseQuotaPrivilege 4936 wmic.exe Token: SeSecurityPrivilege 4936 wmic.exe Token: SeTakeOwnershipPrivilege 4936 wmic.exe Token: SeLoadDriverPrivilege 4936 wmic.exe Token: SeSystemProfilePrivilege 4936 wmic.exe Token: SeSystemtimePrivilege 4936 wmic.exe Token: SeProfSingleProcessPrivilege 4936 wmic.exe Token: SeIncBasePriorityPrivilege 4936 wmic.exe Token: SeCreatePagefilePrivilege 4936 wmic.exe Token: SeBackupPrivilege 4936 wmic.exe Token: SeRestorePrivilege 4936 wmic.exe Token: SeShutdownPrivilege 4936 wmic.exe Token: SeDebugPrivilege 4936 wmic.exe Token: SeSystemEnvironmentPrivilege 4936 wmic.exe Token: SeRemoteShutdownPrivilege 4936 wmic.exe Token: SeUndockPrivilege 4936 wmic.exe Token: SeManageVolumePrivilege 4936 wmic.exe Token: 33 4936 wmic.exe Token: 34 4936 wmic.exe Token: 35 4936 wmic.exe Token: 36 4936 wmic.exe Token: SeIncreaseQuotaPrivilege 2112 wmic.exe Token: SeSecurityPrivilege 2112 wmic.exe Token: SeTakeOwnershipPrivilege 2112 wmic.exe Token: SeLoadDriverPrivilege 2112 wmic.exe Token: SeSystemProfilePrivilege 2112 wmic.exe Token: SeSystemtimePrivilege 2112 wmic.exe Token: SeProfSingleProcessPrivilege 2112 wmic.exe Token: SeIncBasePriorityPrivilege 2112 wmic.exe Token: SeCreatePagefilePrivilege 2112 wmic.exe Token: SeBackupPrivilege 2112 wmic.exe Token: SeRestorePrivilege 2112 wmic.exe Token: SeShutdownPrivilege 2112 wmic.exe Token: SeDebugPrivilege 2112 wmic.exe Token: SeSystemEnvironmentPrivilege 2112 wmic.exe Token: SeRemoteShutdownPrivilege 2112 wmic.exe Token: SeUndockPrivilege 2112 wmic.exe Token: SeManageVolumePrivilege 2112 wmic.exe Token: 33 2112 wmic.exe Token: 34 2112 wmic.exe Token: 35 2112 wmic.exe Token: 36 2112 wmic.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exedescription pid process target process PID 4792 wrote to memory of 3376 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe wmic.exe PID 4792 wrote to memory of 3376 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe wmic.exe PID 4792 wrote to memory of 3376 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe wmic.exe PID 4792 wrote to memory of 4936 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe wmic.exe PID 4792 wrote to memory of 4936 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe wmic.exe PID 4792 wrote to memory of 4936 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe wmic.exe PID 4792 wrote to memory of 2112 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe wmic.exe PID 4792 wrote to memory of 2112 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe wmic.exe PID 4792 wrote to memory of 2112 4792 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe wmic.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe"C:\Users\Admin\AppData\Local\Temp\10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 8762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 8842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 9282⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 9362⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 10322⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 10322⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 15522⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 16562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 18402⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 18282⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 16722⤵
- Program crash
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 16602⤵
- Program crash
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 16562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 17282⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 10322⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 4792 -ip 47921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4792 -ip 47921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4792 -ip 47921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4792 -ip 47921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4792 -ip 47921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4792 -ip 47921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4792 -ip 47921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4792 -ip 47921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4792 -ip 47921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4792 -ip 47921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4792 -ip 47921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4792 -ip 47921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4792 -ip 47921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 4792 -ip 47921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4792 -ip 47921⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4792-1-0x0000000001C80000-0x0000000001D80000-memory.dmpFilesize
1024KB
-
memory/4792-2-0x0000000002070000-0x000000000217E000-memory.dmpFilesize
1.1MB
-
memory/4792-3-0x0000000000400000-0x0000000001B30000-memory.dmpFilesize
23.2MB
-
memory/4792-319-0x0000000000400000-0x0000000001B30000-memory.dmpFilesize
23.2MB
-
memory/4792-321-0x0000000001C80000-0x0000000001D80000-memory.dmpFilesize
1024KB
-
memory/4792-322-0x0000000002070000-0x000000000217E000-memory.dmpFilesize
1.1MB