Overview
overview
10Static
static
1008751be484...2d.dll
windows7-x64
1008751be484...2d.dll
windows10-2004-x64
100a9f79abd4...51.exe
windows7-x64
30a9f79abd4...51.exe
windows10-2004-x64
30di3x.exe
windows7-x64
100di3x.exe
windows10-2004-x64
102019-09-02...10.exe
windows7-x64
102019-09-02...10.exe
windows10-2004-x64
102c01b00772...eb.exe
windows7-x64
72c01b00772...eb.exe
windows10-2004-x64
1031.exe
windows7-x64
1031.exe
windows10-2004-x64
103DMark 11 ...on.exe
windows7-x64
13DMark 11 ...on.exe
windows10-2004-x64
142f9729255...61.exe
windows7-x64
1042f9729255...61.exe
windows10-2004-x64
105da0116af4...18.exe
windows7-x64
75da0116af4...18.exe
windows10-2004-x64
1069c56d12ed...6b.exe
windows7-x64
1069c56d12ed...6b.exe
windows10-2004-x64
10905d572f23...50.exe
windows7-x64
10905d572f23...50.exe
windows10-2004-x64
10948340be97...54.exe
windows7-x64
10948340be97...54.exe
windows10-2004-x64
1095560f1a46...f9.dll
windows7-x64
195560f1a46...f9.dll
windows10-2004-x64
5Archive.zi...3e.exe
windows7-x64
8Archive.zi...3e.exe
windows10-2004-x64
8[email protected]
windows7-x64
4[email protected]
windows10-2004-x64
4[email protected]
windows7-x64
1[email protected]
windows10-2004-x64
1Resubmissions
10-05-2024 16:25
240510-tw1h5shh47 1024-08-2023 11:16
230824-nda8msdf8z 1005-08-2023 22:52
230805-2tn2bsfa82 1024-07-2023 06:25
230724-g6s6laag35 1022-07-2023 15:57
230722-tee6wabg5w 1020-07-2023 23:19
230720-3bb5gsbf5v 1020-07-2023 23:06
230720-23f23sba63 1003-02-2021 11:43
210203-6bgge2nfan 10Analysis
-
max time kernel
4s -
max time network
7s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
10-05-2024 16:25
Static task
static1
Behavioral task
behavioral1
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
0di3x.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
0di3x.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
2019-09-02_22-41-10.exe
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
2019-09-02_22-41-10.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
31.exe
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
31.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
3DMark 11 Advanced Edition.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
42f972925508a82236e8533567487761.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
42f972925508a82236e8533567487761.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win7-20240419-en
Behavioral task
behavioral20
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win7-20240508-en
Behavioral task
behavioral24
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win10v2004-20240426-en
General
-
Target
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
-
Size
80KB
-
MD5
8152a3d0d76f7e968597f4f834fdfa9d
-
SHA1
c3cf05f3f79851d3c0d4266ab77c8e3e3f88c73e
-
SHA256
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b
-
SHA512
eb1a18cb03131466a4152fa2f6874b70c760317148684ca9b95044e50dc9cd19316d6e68e680ce18599114ba73e75264de5dab5afe611165b9c6c0b5f01002b4
-
SSDEEP
1536:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/suIicRtpNf8SgRXt+AacRDVX8C4OntD4acN:SHbigeMiIeMfZ7tOBbFv0CIG0dDh/su0
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mystartup.lnk 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exepid process 2612 sc.exe 2808 sc.exe 1712 sc.exe 2120 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 47 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 3008 taskkill.exe 2936 taskkill.exe 2696 taskkill.exe 1840 taskkill.exe 1252 taskkill.exe 2340 taskkill.exe 1136 taskkill.exe 2640 taskkill.exe 2580 taskkill.exe 2624 taskkill.exe 2644 taskkill.exe 1808 taskkill.exe 1524 taskkill.exe 2768 taskkill.exe 2888 taskkill.exe 2828 taskkill.exe 2720 taskkill.exe 2628 taskkill.exe 2024 taskkill.exe 1188 taskkill.exe 316 taskkill.exe 3012 taskkill.exe 2184 taskkill.exe 2592 taskkill.exe 2264 taskkill.exe 2692 taskkill.exe 2540 taskkill.exe 2748 taskkill.exe 1156 taskkill.exe 1984 taskkill.exe 564 taskkill.exe 1560 taskkill.exe 2820 taskkill.exe 2520 taskkill.exe 1340 taskkill.exe 788 taskkill.exe 2868 taskkill.exe 2856 taskkill.exe 2780 taskkill.exe 2800 taskkill.exe 2564 taskkill.exe 1628 taskkill.exe 2884 taskkill.exe 2776 taskkill.exe 2920 taskkill.exe 1676 taskkill.exe 2764 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exepid process 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepowershell.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exedescription pid process Token: SeDebugPrivilege 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe Token: SeDebugPrivilege 3012 taskkill.exe Token: SeDebugPrivilege 2264 taskkill.exe Token: SeDebugPrivilege 2936 taskkill.exe Token: SeDebugPrivilege 316 taskkill.exe Token: SeDebugPrivilege 564 taskkill.exe Token: SeDebugPrivilege 2868 taskkill.exe Token: SeDebugPrivilege 2776 taskkill.exe Token: SeDebugPrivilege 2768 taskkill.exe Token: SeDebugPrivilege 1676 taskkill.exe Token: SeDebugPrivilege 2232 powershell.exe Token: SeDebugPrivilege 2696 taskkill.exe Token: SeDebugPrivilege 1560 taskkill.exe Token: SeDebugPrivilege 2920 taskkill.exe Token: SeDebugPrivilege 2540 taskkill.exe Token: SeDebugPrivilege 2800 taskkill.exe Token: SeDebugPrivilege 2580 taskkill.exe Token: SeDebugPrivilege 2720 taskkill.exe Token: SeDebugPrivilege 2644 taskkill.exe Token: SeDebugPrivilege 2884 taskkill.exe Token: SeDebugPrivilege 2692 taskkill.exe Token: SeDebugPrivilege 1524 taskkill.exe Token: SeDebugPrivilege 1188 taskkill.exe Token: SeDebugPrivilege 2520 taskkill.exe Token: SeDebugPrivilege 2888 taskkill.exe Token: SeDebugPrivilege 1984 taskkill.exe Token: SeDebugPrivilege 1156 taskkill.exe Token: SeDebugPrivilege 2780 taskkill.exe Token: SeDebugPrivilege 2828 taskkill.exe Token: SeDebugPrivilege 1628 taskkill.exe Token: SeDebugPrivilege 1136 taskkill.exe Token: SeDebugPrivilege 2340 taskkill.exe Token: SeDebugPrivilege 2024 taskkill.exe Token: SeDebugPrivilege 2856 taskkill.exe Token: SeDebugPrivilege 2628 taskkill.exe Token: SeDebugPrivilege 1252 taskkill.exe Token: SeDebugPrivilege 1340 taskkill.exe Token: SeDebugPrivilege 1840 taskkill.exe Token: SeDebugPrivilege 2592 taskkill.exe Token: SeDebugPrivilege 2820 taskkill.exe Token: SeDebugPrivilege 2564 taskkill.exe Token: SeDebugPrivilege 2624 taskkill.exe Token: SeDebugPrivilege 2184 taskkill.exe Token: SeDebugPrivilege 2748 taskkill.exe Token: SeDebugPrivilege 1808 taskkill.exe Token: SeDebugPrivilege 2764 taskkill.exe Token: SeDebugPrivilege 788 taskkill.exe Token: SeDebugPrivilege 2640 taskkill.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exepid process 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exepid process 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exedescription pid process target process PID 1680 wrote to memory of 2120 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe sc.exe PID 1680 wrote to memory of 2120 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe sc.exe PID 1680 wrote to memory of 2120 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe sc.exe PID 1680 wrote to memory of 2912 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe cmd.exe PID 1680 wrote to memory of 2912 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe cmd.exe PID 1680 wrote to memory of 2912 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe cmd.exe PID 1680 wrote to memory of 1712 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe sc.exe PID 1680 wrote to memory of 1712 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe sc.exe PID 1680 wrote to memory of 1712 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe sc.exe PID 1680 wrote to memory of 2808 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe sc.exe PID 1680 wrote to memory of 2808 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe sc.exe PID 1680 wrote to memory of 2808 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe sc.exe PID 1680 wrote to memory of 2612 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe sc.exe PID 1680 wrote to memory of 2612 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe sc.exe PID 1680 wrote to memory of 2612 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe sc.exe PID 1680 wrote to memory of 2720 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 2720 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 2720 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 2936 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 2936 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 2936 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 2628 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 2628 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 2628 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 2624 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 2624 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 2624 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 2644 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 2644 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 2644 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 2776 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 2776 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 2776 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 2024 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 2024 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 2024 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 2920 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 2920 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 2920 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 2800 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 2800 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 2800 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 2748 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 2748 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 2748 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 2540 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 2540 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 2540 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 2264 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 2264 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 2264 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 2692 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 2692 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 2692 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 2564 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 2564 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 2564 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 1676 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 1676 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 1676 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 2520 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 2520 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 2520 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe PID 1680 wrote to memory of 2580 1680 69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"C:\Users\Admin\AppData\Local\Temp\69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe"1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exe"sc.exe" config SQLTELEMETRY start= disabled2⤵
- Launches sc.exe
-
C:\Windows\system32\cmd.exe"cmd.exe" /c rd /s /q %SYSTEMDRIVE%\$Recycle.bin2⤵
-
C:\Windows\system32\sc.exe"sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exe"sc.exe" config SQLWriter start= disabled2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exe"sc.exe" config SstpSvc start= disabled2⤵
- Launches sc.exe
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mysqld.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM sqbcoreservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM firefoxconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM agntsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM thebat.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM steam.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM encsvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM excel.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM CNTAoSMgr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM sqlwriter.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM tbirdconfig.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM dbeng50.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM thebat64.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM ocomm.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM infopath.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mbamtray.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM zoolz.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" IM thunderbird.exe /F2⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM dbsnmp.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM xfssvccon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mspub.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM Ntrtscan.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM isqlplussvc.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM onenote.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM PccNTMon.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM msaccess.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM outlook.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM tmlisten.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM msftesql.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM powerpnt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mydesktopqos.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM visio.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mydesktopservice.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM winword.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mysqld-nt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM wordpad.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM mysqld-opt.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM ocautoupds.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM ocssd.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM oracle.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM sqlagent.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM sqlbrowser.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM sqlservr.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /IM synctime.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1680-0-0x000007FEF5613000-0x000007FEF5614000-memory.dmpFilesize
4KB
-
memory/1680-1-0x0000000000B70000-0x0000000000B8A000-memory.dmpFilesize
104KB
-
memory/1680-2-0x000007FEF5610000-0x000007FEF5FFC000-memory.dmpFilesize
9.9MB
-
memory/2232-8-0x000000001B5B0000-0x000000001B892000-memory.dmpFilesize
2.9MB
-
memory/2232-9-0x00000000027E0000-0x00000000027E8000-memory.dmpFilesize
32KB