Analysis
-
max time kernel
94s -
max time network
106s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
14-05-2024 20:27
Static task
static1
Behavioral task
behavioral1
Sample
683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
unpacked.exe
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
unpacked.exe
Resource
win10v2004-20240426-en
Errors
General
-
Target
683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe
-
Size
49KB
-
MD5
46bfd4f1d581d7c0121d2b19a005d3df
-
SHA1
5b063298bbd1670b4d39e1baef67f854b8dcba9d
-
SHA256
683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96
-
SHA512
b52aa090f689765d099689700be7e18922137e7a860a00113e3f72aa6553e94a870bbb741e52de9617506a236a2a59198fb224fcd128576d76642eec9d715df5
-
SSDEEP
768:AbFw10RFnAwJM7MiqwecUaX5h4IuCdYa+XLXTGY1idL2WYiwtDj:Apw10vnAOIUaJh4IXdWXLXTWLfuFj
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\!satana!.txt
Signatures
-
Satana
Ransomware family which also encrypts the system's Master Boot Record (MBR).
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Deletes itself 1 IoCs
Processes:
bkolqmd.exepid process 2516 bkolqmd.exe -
Executes dropped EXE 2 IoCs
Processes:
bkolqmd.exebkolqmd.exepid process 2712 bkolqmd.exe 2516 bkolqmd.exe -
Loads dropped DLL 6 IoCs
Processes:
683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exebkolqmd.exebkolqmd.exepid process 2884 683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe 2884 683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe 2884 683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe 2884 683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe 2712 bkolqmd.exe 2516 bkolqmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfgdobk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\!satana!.txt" 683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
bkolqmd.exedescription ioc process File opened for modification \??\PHYSICALDRIVE0 bkolqmd.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exebkolqmd.exedescription pid process target process PID 1048 set thread context of 2884 1048 683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe 683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe PID 2712 set thread context of 2516 2712 bkolqmd.exe bkolqmd.exe -
Drops file in Program Files directory 64 IoCs
Processes:
bkolqmd.exedescription ioc process File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_left_hover.png bkolqmd.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\css\!satana!.txt bkolqmd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotsdarkoverlay.png bkolqmd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_ButtonGraphic.png bkolqmd.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\(120DPI)notConnectedStateIcon.png bkolqmd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\DataListIconImages.jpg bkolqmd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormToolImages.jpg bkolqmd.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_left_disabled.png bkolqmd.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\!satana!.txt bkolqmd.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\!satana!.txt bkolqmd.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\!satana!.txt bkolqmd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576_91n92.png bkolqmd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\UnreadIconImagesMask.bmp bkolqmd.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_divider.png bkolqmd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml bkolqmd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml bkolqmd.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\!satana!.txt bkolqmd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\1047x576black.png bkolqmd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-uihandler.xml bkolqmd.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_blue_snow.png bkolqmd.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\images\dial_sml.png bkolqmd.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\alertIcon.png bkolqmd.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt bkolqmd.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\!satana!.txt bkolqmd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-progress-ui.xml bkolqmd.exe File created C:\Program Files\Microsoft Games\Mahjong\de-DE\!satana!.txt bkolqmd.exe File created C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\!satana!.txt bkolqmd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif bkolqmd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_SelectionSubpicture.png bkolqmd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-over-select.png bkolqmd.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\!satana!.txt bkolqmd.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\css\!satana!.txt bkolqmd.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\item_hover_flyout.png bkolqmd.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\!satana!.txt bkolqmd.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\!satana!.txt bkolqmd.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_SelectionSubpicture.png bkolqmd.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\play_hov.png bkolqmd.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\!satana!.txt bkolqmd.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\!satana!.txt bkolqmd.exe File opened for modification C:\Program Files\7-Zip\License.txt bkolqmd.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\!satana!.txt bkolqmd.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\!satana!.txt bkolqmd.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\!satana!.txt bkolqmd.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_issue.gif bkolqmd.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\!satana!.txt bkolqmd.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\!satana!.txt bkolqmd.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\!satana!.txt bkolqmd.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\!satana!.txt bkolqmd.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\19.png bkolqmd.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\form_responses.gif bkolqmd.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\!satana!.txt bkolqmd.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt bkolqmd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_alignleft.gif bkolqmd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Verve.xml bkolqmd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsIncomingImageMask.bmp bkolqmd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml bkolqmd.exe File created C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\!satana!.txt bkolqmd.exe File created C:\Program Files (x86)\!satana!.txt bkolqmd.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\stop_collection_data.gif bkolqmd.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\submission_history.gif bkolqmd.exe File created C:\Program Files (x86)\Common Files\DESIGNER\!satana!.txt bkolqmd.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml bkolqmd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-nodes.xml bkolqmd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-progress.xml bkolqmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
VSSADMIN.EXEpid process 2504 VSSADMIN.EXE -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
bkolqmd.exevssvc.exedescription pid process Token: SeIncBasePriorityPrivilege 2516 bkolqmd.exe Token: SeBackupPrivilege 1660 vssvc.exe Token: SeRestorePrivilege 1660 vssvc.exe Token: SeAuditPrivilege 1660 vssvc.exe Token: SeShutdownPrivilege 2516 bkolqmd.exe -
Suspicious use of WriteProcessMemory 59 IoCs
Processes:
683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exebkolqmd.exebkolqmd.exedescription pid process target process PID 1048 wrote to memory of 2884 1048 683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe 683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe PID 1048 wrote to memory of 2884 1048 683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe 683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe PID 1048 wrote to memory of 2884 1048 683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe 683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe PID 1048 wrote to memory of 2884 1048 683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe 683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe PID 1048 wrote to memory of 2884 1048 683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe 683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe PID 1048 wrote to memory of 2884 1048 683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe 683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe PID 1048 wrote to memory of 2884 1048 683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe 683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe PID 1048 wrote to memory of 2884 1048 683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe 683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe PID 1048 wrote to memory of 2884 1048 683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe 683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe PID 1048 wrote to memory of 2884 1048 683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe 683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe PID 2884 wrote to memory of 2712 2884 683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe bkolqmd.exe PID 2884 wrote to memory of 2712 2884 683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe bkolqmd.exe PID 2884 wrote to memory of 2712 2884 683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe bkolqmd.exe PID 2884 wrote to memory of 2712 2884 683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe bkolqmd.exe PID 2712 wrote to memory of 2516 2712 bkolqmd.exe bkolqmd.exe PID 2712 wrote to memory of 2516 2712 bkolqmd.exe bkolqmd.exe PID 2712 wrote to memory of 2516 2712 bkolqmd.exe bkolqmd.exe PID 2712 wrote to memory of 2516 2712 bkolqmd.exe bkolqmd.exe PID 2712 wrote to memory of 2516 2712 bkolqmd.exe bkolqmd.exe PID 2712 wrote to memory of 2516 2712 bkolqmd.exe bkolqmd.exe PID 2712 wrote to memory of 2516 2712 bkolqmd.exe bkolqmd.exe PID 2712 wrote to memory of 2516 2712 bkolqmd.exe bkolqmd.exe PID 2712 wrote to memory of 2516 2712 bkolqmd.exe bkolqmd.exe PID 2712 wrote to memory of 2516 2712 bkolqmd.exe bkolqmd.exe PID 2516 wrote to memory of 2504 2516 bkolqmd.exe VSSADMIN.EXE PID 2516 wrote to memory of 2504 2516 bkolqmd.exe VSSADMIN.EXE PID 2516 wrote to memory of 2504 2516 bkolqmd.exe VSSADMIN.EXE PID 2516 wrote to memory of 2504 2516 bkolqmd.exe VSSADMIN.EXE PID 2516 wrote to memory of 11544 2516 bkolqmd.exe NOTEPAD.EXE PID 2516 wrote to memory of 11544 2516 bkolqmd.exe NOTEPAD.EXE PID 2516 wrote to memory of 11544 2516 bkolqmd.exe NOTEPAD.EXE PID 2516 wrote to memory of 11544 2516 bkolqmd.exe NOTEPAD.EXE PID 2516 wrote to memory of 12048 2516 bkolqmd.exe rundll32.exe PID 2516 wrote to memory of 12048 2516 bkolqmd.exe rundll32.exe PID 2516 wrote to memory of 12048 2516 bkolqmd.exe rundll32.exe PID 2516 wrote to memory of 12048 2516 bkolqmd.exe rundll32.exe PID 2516 wrote to memory of 12048 2516 bkolqmd.exe rundll32.exe PID 2516 wrote to memory of 12048 2516 bkolqmd.exe rundll32.exe PID 2516 wrote to memory of 12048 2516 bkolqmd.exe rundll32.exe PID 2516 wrote to memory of 12048 2516 bkolqmd.exe rundll32.exe PID 2516 wrote to memory of 12048 2516 bkolqmd.exe rundll32.exe PID 2516 wrote to memory of 12004 2516 bkolqmd.exe rundll32.exe PID 2516 wrote to memory of 12004 2516 bkolqmd.exe rundll32.exe PID 2516 wrote to memory of 12004 2516 bkolqmd.exe rundll32.exe PID 2516 wrote to memory of 12004 2516 bkolqmd.exe rundll32.exe PID 2516 wrote to memory of 12004 2516 bkolqmd.exe rundll32.exe PID 2516 wrote to memory of 12004 2516 bkolqmd.exe rundll32.exe PID 2516 wrote to memory of 12004 2516 bkolqmd.exe rundll32.exe PID 2516 wrote to memory of 12004 2516 bkolqmd.exe rundll32.exe PID 2516 wrote to memory of 12004 2516 bkolqmd.exe rundll32.exe PID 2516 wrote to memory of 11844 2516 bkolqmd.exe rundll32.exe PID 2516 wrote to memory of 11844 2516 bkolqmd.exe rundll32.exe PID 2516 wrote to memory of 11844 2516 bkolqmd.exe rundll32.exe PID 2516 wrote to memory of 11844 2516 bkolqmd.exe rundll32.exe PID 2516 wrote to memory of 11844 2516 bkolqmd.exe rundll32.exe PID 2516 wrote to memory of 11844 2516 bkolqmd.exe rundll32.exe PID 2516 wrote to memory of 11844 2516 bkolqmd.exe rundll32.exe PID 2516 wrote to memory of 11844 2516 bkolqmd.exe rundll32.exe PID 2516 wrote to memory of 11844 2516 bkolqmd.exe rundll32.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe"C:\Users\Admin\AppData\Local\Temp\683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe"C:\Users\Admin\AppData\Local\Temp\683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\bkolqmd.exe"C:\Users\Admin\AppData\Local\Temp\bkolqmd.exe" {846ee340-7039-11de-9d20-806e6f6e6963} "C:\Users\Admin\AppData\Local\Temp\683A09~1.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\bkolqmd.exe"C:\Users\Admin\AppData\Local\Temp\bkolqmd.exe" {846ee340-7039-11de-9d20-806e6f6e6963} "C:\Users\Admin\AppData\Local\Temp\683A09~1.EXE"4⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\VSSADMIN.EXE"C:\Windows\system32\VSSADMIN.EXE" Delete Shadows /All /Quiet5⤵
- Interacts with shadow copies
PID:2504
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\!satana!.txt5⤵PID:11544
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe5⤵PID:12048
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe5⤵PID:12004
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe5⤵PID:11844
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1660
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:11780
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:14112
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a00cb451180ca90c598f4f0fd1c0ea22
SHA1ae7a4c7737b799aa6a47199769b88008fb908809
SHA25636bdda0b3c6ab093b712536547a74ee6e9e3fb5bb641f827b5420b7276f8440c
SHA512e2cf57c002b659e13713a74be9e0b90c8e2d0d39e4249a5b8267b441076151de979b5354db43a35ff8910913c1610d6649ad0d57d3be5cfc94c95cbe23c7927d
-
Filesize
49KB
MD546bfd4f1d581d7c0121d2b19a005d3df
SHA15b063298bbd1670b4d39e1baef67f854b8dcba9d
SHA256683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96
SHA512b52aa090f689765d099689700be7e18922137e7a860a00113e3f72aa6553e94a870bbb741e52de9617506a236a2a59198fb224fcd128576d76642eec9d715df5