Analysis
-
max time kernel
122s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
18-04-2024 12:16
Static task
static1
Behavioral task
behavioral1
Sample
c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
Resource
win7-20240215-en
General
-
Target
c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
-
Size
3.9MB
-
MD5
68ae6ccb3c5a879ea7d350372fe1f637
-
SHA1
fda8df32fac91f400aebc9f1f12fe2b7874c41c4
-
SHA256
c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74
-
SHA512
aa8741fba30bfe5a1c6e7fe357d719f67b66c1348f0f6072b2cc96d0b4cccf5f982a0979aa5b46bb2c7a9310d6904cc5f0357ecd6b053b607946704ab6ad7fdc
-
SSDEEP
98304:Yws2ANlKXOaeOgmhIFValfyCwwDK4F0Fc:O0XbeO75OK
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Processes:
resource yara_rule behavioral2/memory/4120-39-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4120-40-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4100-48-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4100-49-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4120-51-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/4100-63-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/64-67-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/64-69-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral2/memory/64-72-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 10 IoCs
Processes:
resource yara_rule C:\Windows\SysWOW64\240595906.txt family_gh0strat behavioral2/memory/4120-39-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4120-40-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4100-48-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4100-49-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4120-51-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/4100-63-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/64-67-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/64-69-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral2/memory/64-72-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe -
Processes:
c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe -
Processes:
c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe -
Drops file in Drivers directory 1 IoCs
Processes:
TXPlatfor.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys TXPlatfor.exe -
Sets DLL path for service in the registry 2 TTPs 1 IoCs
Processes:
R.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Remote Data\Parameters\ServiceDll = "C:\\Windows\\system32\\240595906.txt" R.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
TXPlatfor.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatfor.exe -
Executes dropped EXE 6 IoCs
Processes:
R.exeN.exeTXPlatfor.exeHD_c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exeTXPlatfor.exeRemote Data.exepid process 5060 R.exe 4120 N.exe 4100 TXPlatfor.exe 4148 HD_c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe 64 TXPlatfor.exe 1220 Remote Data.exe -
Loads dropped DLL 3 IoCs
Processes:
R.exesvchost.exeRemote Data.exepid process 5060 R.exe 4544 svchost.exe 1220 Remote Data.exe -
Processes:
resource yara_rule behavioral2/memory/3544-1-0x00000000025C0000-0x000000000364E000-memory.dmp upx behavioral2/memory/3544-3-0x00000000025C0000-0x000000000364E000-memory.dmp upx behavioral2/memory/3544-12-0x00000000025C0000-0x000000000364E000-memory.dmp upx behavioral2/memory/3544-14-0x00000000025C0000-0x000000000364E000-memory.dmp upx behavioral2/memory/3544-19-0x00000000025C0000-0x000000000364E000-memory.dmp upx behavioral2/memory/3544-23-0x00000000025C0000-0x000000000364E000-memory.dmp upx behavioral2/memory/4120-35-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3544-32-0x00000000025C0000-0x000000000364E000-memory.dmp upx behavioral2/memory/4120-39-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4120-40-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3544-37-0x00000000025C0000-0x000000000364E000-memory.dmp upx behavioral2/memory/3544-41-0x00000000025C0000-0x000000000364E000-memory.dmp upx behavioral2/memory/4100-46-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4100-48-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4100-49-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/4120-51-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3544-50-0x00000000025C0000-0x000000000364E000-memory.dmp upx behavioral2/memory/3544-58-0x00000000025C0000-0x000000000364E000-memory.dmp upx behavioral2/memory/4100-63-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/64-67-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/64-69-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/64-72-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral2/memory/3544-74-0x00000000025C0000-0x000000000364E000-memory.dmp upx behavioral2/memory/3544-75-0x00000000025C0000-0x000000000364E000-memory.dmp upx behavioral2/memory/3544-76-0x00000000025C0000-0x000000000364E000-memory.dmp upx behavioral2/memory/3544-82-0x00000000025C0000-0x000000000364E000-memory.dmp upx behavioral2/memory/3544-83-0x00000000025C0000-0x000000000364E000-memory.dmp upx behavioral2/memory/3544-84-0x00000000025C0000-0x000000000364E000-memory.dmp upx behavioral2/memory/3544-86-0x00000000025C0000-0x000000000364E000-memory.dmp upx behavioral2/memory/3544-87-0x00000000025C0000-0x000000000364E000-memory.dmp upx behavioral2/memory/3544-94-0x00000000025C0000-0x000000000364E000-memory.dmp upx behavioral2/memory/3544-96-0x00000000025C0000-0x000000000364E000-memory.dmp upx behavioral2/memory/3544-99-0x00000000025C0000-0x000000000364E000-memory.dmp upx behavioral2/memory/3544-101-0x00000000025C0000-0x000000000364E000-memory.dmp upx behavioral2/memory/3544-104-0x00000000025C0000-0x000000000364E000-memory.dmp upx behavioral2/memory/3544-106-0x00000000025C0000-0x000000000364E000-memory.dmp upx behavioral2/memory/3544-108-0x00000000025C0000-0x000000000364E000-memory.dmp upx -
Processes:
c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe -
Processes:
c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exedescription ioc process File opened (read-only) \??\Y: c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe File opened (read-only) \??\W: c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe File opened (read-only) \??\H: c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe File opened (read-only) \??\J: c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe File opened (read-only) \??\K: c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe File opened (read-only) \??\L: c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe File opened (read-only) \??\M: c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe File opened (read-only) \??\O: c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe File opened (read-only) \??\P: c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe File opened (read-only) \??\G: c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe File opened (read-only) \??\V: c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe File opened (read-only) \??\X: c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe File opened (read-only) \??\Z: c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe File opened (read-only) \??\U: c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe File opened (read-only) \??\N: c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe File opened (read-only) \??\R: c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe File opened (read-only) \??\T: c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe File opened (read-only) \??\E: c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe File opened (read-only) \??\Q: c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe File opened (read-only) \??\S: c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe File opened (read-only) \??\I: c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exedescription ioc process File opened for modification F:\autorun.inf c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe File opened for modification C:\autorun.inf c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe -
Drops file in System32 directory 6 IoCs
Processes:
R.exesvchost.exeN.exedescription ioc process File created C:\Windows\SysWOW64\240595906.txt R.exe File opened for modification C:\Windows\SysWOW64\ini.ini R.exe File created C:\Windows\SysWOW64\Remote Data.exe svchost.exe File opened for modification C:\Windows\SysWOW64\Remote Data.exe svchost.exe File created C:\Windows\SysWOW64\TXPlatfor.exe N.exe File opened for modification C:\Windows\SysWOW64\TXPlatfor.exe N.exe -
Drops file in Program Files directory 11 IoCs
Processes:
c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exedescription ioc process File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe -
Drops file in Windows directory 1 IoCs
Processes:
c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exepid process 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
TXPlatfor.exepid process 64 TXPlatfor.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exedescription pid process Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Token: SeDebugPrivilege 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exeHD_c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exepid process 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe 4148 HD_c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe 4148 HD_c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exeN.exeTXPlatfor.execmd.exesvchost.exedescription pid process target process PID 3544 wrote to memory of 5060 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe R.exe PID 3544 wrote to memory of 5060 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe R.exe PID 3544 wrote to memory of 5060 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe R.exe PID 3544 wrote to memory of 780 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe fontdrvhost.exe PID 3544 wrote to memory of 784 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe fontdrvhost.exe PID 3544 wrote to memory of 316 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe dwm.exe PID 3544 wrote to memory of 2920 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe sihost.exe PID 3544 wrote to memory of 3000 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe svchost.exe PID 3544 wrote to memory of 3172 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe taskhostw.exe PID 3544 wrote to memory of 3388 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Explorer.EXE PID 3544 wrote to memory of 3568 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe svchost.exe PID 3544 wrote to memory of 3760 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe DllHost.exe PID 3544 wrote to memory of 3876 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe StartMenuExperienceHost.exe PID 3544 wrote to memory of 3940 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe RuntimeBroker.exe PID 3544 wrote to memory of 4016 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe SearchApp.exe PID 3544 wrote to memory of 4080 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe RuntimeBroker.exe PID 3544 wrote to memory of 2968 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe TextInputHost.exe PID 3544 wrote to memory of 3180 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe RuntimeBroker.exe PID 3544 wrote to memory of 3240 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe backgroundTaskHost.exe PID 3544 wrote to memory of 3872 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe backgroundTaskHost.exe PID 3544 wrote to memory of 2084 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe backgroundTaskHost.exe PID 3544 wrote to memory of 5060 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe R.exe PID 3544 wrote to memory of 5060 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe R.exe PID 3544 wrote to memory of 4120 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe N.exe PID 3544 wrote to memory of 4120 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe N.exe PID 3544 wrote to memory of 4120 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe N.exe PID 4120 wrote to memory of 3168 4120 N.exe cmd.exe PID 4120 wrote to memory of 3168 4120 N.exe cmd.exe PID 4120 wrote to memory of 3168 4120 N.exe cmd.exe PID 3544 wrote to memory of 4148 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe HD_c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe PID 3544 wrote to memory of 4148 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe HD_c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe PID 3544 wrote to memory of 4148 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe HD_c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe PID 4100 wrote to memory of 64 4100 TXPlatfor.exe TXPlatfor.exe PID 4100 wrote to memory of 64 4100 TXPlatfor.exe TXPlatfor.exe PID 4100 wrote to memory of 64 4100 TXPlatfor.exe TXPlatfor.exe PID 3168 wrote to memory of 1580 3168 cmd.exe PING.EXE PID 3168 wrote to memory of 1580 3168 cmd.exe PING.EXE PID 3168 wrote to memory of 1580 3168 cmd.exe PING.EXE PID 4544 wrote to memory of 1220 4544 svchost.exe Remote Data.exe PID 4544 wrote to memory of 1220 4544 svchost.exe Remote Data.exe PID 4544 wrote to memory of 1220 4544 svchost.exe Remote Data.exe PID 3544 wrote to memory of 780 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe fontdrvhost.exe PID 3544 wrote to memory of 784 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe fontdrvhost.exe PID 3544 wrote to memory of 316 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe dwm.exe PID 3544 wrote to memory of 2920 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe sihost.exe PID 3544 wrote to memory of 3000 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe svchost.exe PID 3544 wrote to memory of 3172 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe taskhostw.exe PID 3544 wrote to memory of 3388 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe Explorer.EXE PID 3544 wrote to memory of 3568 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe svchost.exe PID 3544 wrote to memory of 3760 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe DllHost.exe PID 3544 wrote to memory of 3876 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe StartMenuExperienceHost.exe PID 3544 wrote to memory of 3940 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe RuntimeBroker.exe PID 3544 wrote to memory of 4016 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe SearchApp.exe PID 3544 wrote to memory of 4080 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe RuntimeBroker.exe PID 3544 wrote to memory of 2968 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe TextInputHost.exe PID 3544 wrote to memory of 3180 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe RuntimeBroker.exe PID 3544 wrote to memory of 3240 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe backgroundTaskHost.exe PID 3544 wrote to memory of 3872 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe backgroundTaskHost.exe PID 3544 wrote to memory of 4148 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe HD_c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe PID 3544 wrote to memory of 4148 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe HD_c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe PID 3544 wrote to memory of 1464 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe RuntimeBroker.exe PID 3544 wrote to memory of 3112 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe RuntimeBroker.exe PID 3544 wrote to memory of 780 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe fontdrvhost.exe PID 3544 wrote to memory of 784 3544 c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe fontdrvhost.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe"C:\Users\Admin\AppData\Local\Temp\c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe3⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.15⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\HD_c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exeC:\Users\Admin\AppData\Local\Temp\HD_c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remote Data"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remote Data"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Remote Data.exe"C:\Windows\system32\Remote Data.exe" "c:\windows\system32\240595906.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Modify Registry
7Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\0E578A8D_Rar\c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exeFilesize
3.9MB
MD5b460f9a898a55bbc6f3bfc7906669425
SHA1e5c8109b55c134e9707707ccbc80bedc410cea1b
SHA25692c4bb6c17cd83c620ed45e8c273319a89e6cd93ef89333d4ba6df326ee60aa7
SHA5122dee9b38c3f68c0ef80605158ebe61abb09ee70942d858dc05862de68568411424ad147a25f1c778f20fe81f3eb437567ba82d5af2b201123a6bf8cc9cb329df
-
C:\Users\Admin\AppData\Local\Temp\HD_c3036a32460ece48445924f49c350e3efb7e136fe6b6f569320bea45fc383f74.exeFilesize
1.3MB
MD59af4ff55c1c5aefe42bc22a6283f3c86
SHA1629b290a8ee422211eb513d5fc91efcbb0d0f8ff
SHA256eb9e892b792b8057aba8aa8a012ae18993011e261558e86eac5b5e835bfeb332
SHA5123fd9c94ec4d2ca17b1a360a4d0f878ebc69655b91f645a294fb42908eaf4cae9b2daba2eb0f747b8904a4b77992ecf90666a5d79c2b3ba77127176d331e14f5e
-
C:\Users\Admin\AppData\Local\Temp\N.exeFilesize
377KB
MD54a36a48e58829c22381572b2040b6fe0
SHA1f09d30e44ff7e3f20a5de307720f3ad148c6143b
SHA2563de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8
SHA5125d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0
-
C:\Users\Admin\AppData\Local\Temp\R.exeFilesize
941KB
MD58dc3adf1c490211971c1e2325f1424d2
SHA14eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5
SHA256bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c
SHA512ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d
-
C:\Windows\SysWOW64\240595906.txtFilesize
899KB
MD54a61f73a7faca57a57d183a51ab9f9f4
SHA1707abccbce3da5b06cb8fc4e590e9c0559505c5e
SHA256b174d3a954d9acd730dbf6f472fd0b4033de2bd964b701abab3507fae637d55b
SHA512714a5abbf6c03c361e2cf8f5da35142258296cf77743793fe9dbba877e54d9b45d8c710499bb6639a27068a7a6ad1aaec865030615db846d6d251a9d77231364
-
C:\Windows\SysWOW64\Remote Data.exeFilesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
-
F:\ycvxqk.pifFilesize
100KB
MD57137201a01ee87d6cb09dc2d4ee4fd9f
SHA1a8d6f4a122a39ed1968a485e2cdedc7525afd6e6
SHA256cc925de4401027d5b2d1a803a16a9e9997d25bac3ab511baf428132bee7d8dd3
SHA512227e311d59ffd9e01c1e26f1415fc6bd45d46da6e6623f7559025d5d83ab7d85bedb51641d7b9bd9c2e6620198e0af85e8d1c005d090451c1f1288eea59e7e9f
-
memory/64-72-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/64-69-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/64-67-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/3544-58-0x00000000025C0000-0x000000000364E000-memory.dmpFilesize
16.6MB
-
memory/3544-50-0x00000000025C0000-0x000000000364E000-memory.dmpFilesize
16.6MB
-
memory/3544-23-0x00000000025C0000-0x000000000364E000-memory.dmpFilesize
16.6MB
-
memory/3544-1-0x00000000025C0000-0x000000000364E000-memory.dmpFilesize
16.6MB
-
memory/3544-3-0x00000000025C0000-0x000000000364E000-memory.dmpFilesize
16.6MB
-
memory/3544-32-0x00000000025C0000-0x000000000364E000-memory.dmpFilesize
16.6MB
-
memory/3544-108-0x00000000025C0000-0x000000000364E000-memory.dmpFilesize
16.6MB
-
memory/3544-106-0x00000000025C0000-0x000000000364E000-memory.dmpFilesize
16.6MB
-
memory/3544-37-0x00000000025C0000-0x000000000364E000-memory.dmpFilesize
16.6MB
-
memory/3544-104-0x00000000025C0000-0x000000000364E000-memory.dmpFilesize
16.6MB
-
memory/3544-41-0x00000000025C0000-0x000000000364E000-memory.dmpFilesize
16.6MB
-
memory/3544-101-0x00000000025C0000-0x000000000364E000-memory.dmpFilesize
16.6MB
-
memory/3544-17-0x0000000003670000-0x0000000003672000-memory.dmpFilesize
8KB
-
memory/3544-99-0x00000000025C0000-0x000000000364E000-memory.dmpFilesize
16.6MB
-
memory/3544-96-0x00000000025C0000-0x000000000364E000-memory.dmpFilesize
16.6MB
-
memory/3544-93-0x0000000003670000-0x0000000003672000-memory.dmpFilesize
8KB
-
memory/3544-19-0x00000000025C0000-0x000000000364E000-memory.dmpFilesize
16.6MB
-
memory/3544-0-0x0000000000400000-0x00000000006CC000-memory.dmpFilesize
2.8MB
-
memory/3544-94-0x00000000025C0000-0x000000000364E000-memory.dmpFilesize
16.6MB
-
memory/3544-14-0x00000000025C0000-0x000000000364E000-memory.dmpFilesize
16.6MB
-
memory/3544-15-0x0000000003680000-0x0000000003681000-memory.dmpFilesize
4KB
-
memory/3544-13-0x0000000003670000-0x0000000003672000-memory.dmpFilesize
8KB
-
memory/3544-74-0x00000000025C0000-0x000000000364E000-memory.dmpFilesize
16.6MB
-
memory/3544-75-0x00000000025C0000-0x000000000364E000-memory.dmpFilesize
16.6MB
-
memory/3544-76-0x00000000025C0000-0x000000000364E000-memory.dmpFilesize
16.6MB
-
memory/3544-12-0x00000000025C0000-0x000000000364E000-memory.dmpFilesize
16.6MB
-
memory/3544-82-0x00000000025C0000-0x000000000364E000-memory.dmpFilesize
16.6MB
-
memory/3544-83-0x00000000025C0000-0x000000000364E000-memory.dmpFilesize
16.6MB
-
memory/3544-84-0x00000000025C0000-0x000000000364E000-memory.dmpFilesize
16.6MB
-
memory/3544-86-0x00000000025C0000-0x000000000364E000-memory.dmpFilesize
16.6MB
-
memory/3544-87-0x00000000025C0000-0x000000000364E000-memory.dmpFilesize
16.6MB
-
memory/4100-48-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4100-46-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4100-49-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4100-63-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4120-51-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4120-40-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4120-39-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4120-35-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/4148-92-0x00000000020E0000-0x00000000020E2000-memory.dmpFilesize
8KB
-
memory/4148-91-0x00000000020E0000-0x00000000020E2000-memory.dmpFilesize
8KB
-
memory/4148-90-0x0000000002220000-0x0000000002221000-memory.dmpFilesize
4KB
-
memory/4148-140-0x00000000020E0000-0x00000000020E2000-memory.dmpFilesize
8KB
-
memory/5060-103-0x0000000000630000-0x0000000000632000-memory.dmpFilesize
8KB
-
memory/5060-29-0x0000000000630000-0x0000000000632000-memory.dmpFilesize
8KB
-
memory/5060-20-0x0000000000640000-0x0000000000641000-memory.dmpFilesize
4KB