Analysis
-
max time kernel
15s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
21/04/2024, 01:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe
Resource
win7-20240215-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe
-
Size
74KB
-
MD5
4282fd4222138bfc7229a802d63d9146
-
SHA1
cdebdf832907a16dba3cb85c1cd60e1db1d31535
-
SHA256
02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7
-
SHA512
f6a1748789def0598f7c27c74594c6144777c714c929acc4180aa5cde000e871b1a887702dc86b2b4ceed4086201b113c2d7c26dc372bb4c41ba34a1e69e81d7
-
SSDEEP
768:fXqien69IBx4TOLRb56fh3NgBzIeOCP+MOFSIB/JPgi011UAbebp3EaPXHMV1jzB:/en69Wl1jX/YpgCqhj+Dib0k
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe -
Executes dropped EXE 2 IoCs
pid Process 3284 ServiceHub.IdentityHost.exe 2672 SQL Local Service.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SQL_Local_Service = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SQL Local Service.exe" SQL Local Service.exe Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ServiceHub_IdentityHost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ServiceHub.IdentityHost.exe" ServiceHub.IdentityHost.exe -
Drops desktop.ini file(s) 30 IoCs
description ioc Process File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini SQL Local Service.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini SQL Local Service.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini ServiceHub.IdentityHost.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini SQL Local Service.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini SQL Local Service.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini ServiceHub.IdentityHost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini ServiceHub.IdentityHost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini SQL Local Service.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1132431369-515282257-1998160155-1000\desktop.ini SQL Local Service.exe File opened for modification C:\Program Files\desktop.ini SQL Local Service.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini SQL Local Service.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini SQL Local Service.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini SQL Local Service.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini ServiceHub.IdentityHost.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini SQL Local Service.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini ServiceHub.IdentityHost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini ServiceHub.IdentityHost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini SQL Local Service.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI ServiceHub.IdentityHost.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini SQL Local Service.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini ServiceHub.IdentityHost.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1132431369-515282257-1998160155-1000\desktop.ini 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe File opened for modification C:\Program Files (x86)\desktop.ini ServiceHub.IdentityHost.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini SQL Local Service.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini ServiceHub.IdentityHost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini ServiceHub.IdentityHost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini SQL Local Service.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini ServiceHub.IdentityHost.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini SQL Local Service.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini SQL Local Service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA SQL Local Service.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\WideLogo.scale-125_contrast-white.png ServiceHub.IdentityHost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-white\WideTile.scale-200.png SQL Local Service.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-black\LargeTile.scale-200.png SQL Local Service.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-20_altform-unplated_contrast-black.png SQL Local Service.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-40_contrast-white.png SQL Local Service.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_06.jpg SQL Local Service.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-80.png ServiceHub.IdentityHost.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\resources.pri ServiceHub.IdentityHost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-32.png ServiceHub.IdentityHost.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\it-it SQL Local Service.exe File opened for modification C:\Program Files (x86)\Windows Defender\fr-FR ServiceHub.IdentityHost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-48_contrast-white.png SQL Local Service.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-32_altform-lightunplated.png ServiceHub.IdentityHost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookWideTile.scale-150.png ServiceHub.IdentityHost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-white\LargeTile.scale-100.png ServiceHub.IdentityHost.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ru-ru ServiceHub.IdentityHost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui SQL Local Service.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Exchange.scale-125.png ServiceHub.IdentityHost.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailLargeTile.scale-200.png ServiceHub.IdentityHost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.targetsize-256_altform-unplated_contrast-black_devicefamily-colorfulunplated.png SQL Local Service.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarSplashLogo.scale-200.png SQL Local Service.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white SQL Local Service.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Spacer\9px.png ServiceHub.IdentityHost.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml SQL Local Service.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\MedTile.scale-125_contrast-white.png ServiceHub.IdentityHost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\NavigationIcons\nav_icons_trending.targetsize-48.png SQL Local Service.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubLargeTile.scale-125_contrast-black.png SQL Local Service.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Images\contrast-black\Settings.png ServiceHub.IdentityHost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteWideTile.scale-150.png SQL Local Service.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\AttachmentPlaceholder-Light.png SQL Local Service.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-GoogleCloudCache.scale-200.png ServiceHub.IdentityHost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-30_altform-unplated.png ServiceHub.IdentityHost.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets SQL Local Service.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Images\contrast-white\Settings.png SQL Local Service.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\xaml\onenote\CaptureUIStyles.xaml SQL Local Service.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-40_contrast-black.png SQL Local Service.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-30.png ServiceHub.IdentityHost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white SQL Local Service.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-64_contrast-white.png SQL Local Service.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyView-Dark.scale-100.png SQL Local Service.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-32_altform-unplated_contrast-white.png ServiceHub.IdentityHost.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ru-ru ServiceHub.IdentityHost.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages SQL Local Service.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\WideTile.scale-200_contrast-white.png ServiceHub.IdentityHost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-24_contrast-white.png SQL Local Service.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationClient.resources.dll ServiceHub.IdentityHost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui ServiceHub.IdentityHost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-48.png SQL Local Service.exe File opened for modification C:\Program Files\Windows Media Player\de-DE SQL Local Service.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-48_altform-unplated.png ServiceHub.IdentityHost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x86__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat ServiceHub.IdentityHost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SplashScreen.scale-200.png ServiceHub.IdentityHost.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\LinkedInboxWideTile.scale-400.png ServiceHub.IdentityHost.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarBadge.scale-125.png SQL Local Service.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\music_offline_demo_page2.jpg ServiceHub.IdentityHost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-96_altform-lightunplated_devicefamily-colorfulunplated.png SQL Local Service.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-30_altform-fullcolor.png SQL Local Service.exe File opened for modification C:\Program Files (x86)\Windows Defender\it-IT SQL Local Service.exe File opened for modification C:\Program Files\Common Files\System\msadc\it-IT ServiceHub.IdentityHost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\WideTile.scale-100_contrast-white.png ServiceHub.IdentityHost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Standard.targetsize-20_contrast-black.png ServiceHub.IdentityHost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-white\MedTile.scale-200.png SQL Local Service.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-black\WideTile.scale-100.png SQL Local Service.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3956 wrote to memory of 3284 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 88 PID 3956 wrote to memory of 3284 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 88 PID 3956 wrote to memory of 3284 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 88 PID 3956 wrote to memory of 2672 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 89 PID 3956 wrote to memory of 2672 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 89 PID 3956 wrote to memory of 2672 3956 02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe"C:\Users\Admin\AppData\Local\Temp\02c81055545d2e262713b1e5d233c892db198943001ee869f46be1cd1e36abd7.exe"1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\ServiceHub.IdentityHost.exe"C:\Users\Admin\AppData\Local\Temp\ServiceHub.IdentityHost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:3284
-
-
C:\Users\Admin\AppData\Local\Temp\SQL Local Service.exe"C:\Users\Admin\AppData\Local\Temp\SQL Local Service.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:2672
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15KB
MD5e7a0ec44da1d22945130cbf0a1f90350
SHA10f863e45faa2a5931f729ef85dd8614e96f1b89e
SHA256684931cd4aa538c525368d2bdc724fc623009fb43ca3000bb654a64c46d0eeb9
SHA5123bb32e5f4d9f444f0a35decca4dcc88ec7008a6e81ac94a867b93685d343c0751a42bb905d1ff4f76f7e40e66083ff0c78f71dc1b1ccbd722753e1787ce5ce00
-
Filesize
15KB
MD532fd126f7a21663d4da346ca41344322
SHA1c98ec32a1f84de981df8395b14ab0259f5873bc5
SHA256d6f408d5f43a72efb311fcf9a63d7dd5b597985b16a8048d78666d5ea2f59c39
SHA5126487b9e1ec12072b467b6d61d41d87b652367dbf92b36442c2156d0101e1975ca3fe04a395128f3e4b70813024cf6b4a6793c03c65c813828fff5324260368b7