Analysis
-
max time kernel
122s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 10:16
Static task
static1
Behavioral task
behavioral1
Sample
0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe
Resource
win7-20240221-en
General
-
Target
0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe
-
Size
244KB
-
MD5
6db6d12e5dbc839b9c6858444a165bd4
-
SHA1
d17c5d289b884ea452d9cf0ca921ce6e4f498831
-
SHA256
0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8
-
SHA512
643f6f8a6b0e8509e43d1346102c028eda7df8275ee63975de71bc0a9ee93730c53b893fd799989f6c11cd44ab705e596b23a94af2281f8818d8700a1818868a
-
SSDEEP
3072:JmdrXoGCHt4JTKkZfLTuvfFo2mP1HniQdnAAMMoNH+TQYb8rbtXIGxsDSZLbRhG+:JmdZOi5gu9Pl8FHmQLrbJzSDaLFYoZW
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe -
Processes:
0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe -
Processes:
0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\LRmZyy.exe aspack_v212_v242 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
LRmZyy.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation LRmZyy.exe -
Executes dropped EXE 2 IoCs
Processes:
0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8mgr.exeLRmZyy.exepid process 3512 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8mgr.exe 3304 LRmZyy.exe -
Processes:
resource yara_rule behavioral2/memory/3512-5-0x0000000000400000-0x000000000045B000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8mgr.exe upx behavioral2/memory/4472-8-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-14-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-9-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-15-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-24-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-25-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-16-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-34-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-21-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-43-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-42-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-44-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-47-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-48-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-51-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-52-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-53-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-55-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-56-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-60-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-62-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-69-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-72-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-73-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-75-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-78-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-79-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-83-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-84-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-93-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-98-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-99-0x0000000002790000-0x000000000381E000-memory.dmp upx behavioral2/memory/4472-102-0x0000000002790000-0x000000000381E000-memory.dmp upx -
Processes:
0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe -
Processes:
0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exedescription ioc process File opened (read-only) \??\H: 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened (read-only) \??\M: 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened (read-only) \??\T: 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened (read-only) \??\X: 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened (read-only) \??\Y: 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened (read-only) \??\G: 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened (read-only) \??\Q: 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened (read-only) \??\L: 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened (read-only) \??\K: 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened (read-only) \??\O: 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened (read-only) \??\P: 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened (read-only) \??\I: 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened (read-only) \??\J: 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened (read-only) \??\N: 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened (read-only) \??\R: 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened (read-only) \??\S: 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened (read-only) \??\U: 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened (read-only) \??\V: 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened (read-only) \??\W: 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened (read-only) \??\E: 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened (read-only) \??\Z: 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exedescription ioc process File opened for modification C:\autorun.inf 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification F:\autorun.inf 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe -
Drops file in Program Files directory 64 IoCs
Processes:
LRmZyy.exe0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exedescription ioc process File opened for modification C:\Program Files\7-Zip\7z.exe LRmZyy.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe LRmZyy.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe LRmZyy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Time.exe LRmZyy.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe LRmZyy.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe LRmZyy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe LRmZyy.exe File created C:\Program Files\Cacrk\TXlogin.dll 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe LRmZyy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe LRmZyy.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe LRmZyy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE LRmZyy.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe LRmZyy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE LRmZyy.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe LRmZyy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe LRmZyy.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe LRmZyy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe LRmZyy.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe LRmZyy.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe LRmZyy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe LRmZyy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe LRmZyy.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe LRmZyy.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe LRmZyy.exe File opened for modification C:\Program Files\Internet Explorer\it-IT\ieinstal.exe.mui 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe LRmZyy.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe LRmZyy.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome.exe.sig 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe LRmZyy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE LRmZyy.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe LRmZyy.exe File opened for modification C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe LRmZyy.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe LRmZyy.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe LRmZyy.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe LRmZyy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe LRmZyy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe LRmZyy.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe LRmZyy.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe LRmZyy.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe LRmZyy.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe LRmZyy.exe -
Drops file in Windows directory 1 IoCs
Processes:
0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1368 3512 WerFault.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8mgr.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exepid process 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exedescription pid process Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Token: SeDebugPrivilege 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exedescription pid process target process PID 4472 wrote to memory of 3512 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8mgr.exe PID 4472 wrote to memory of 3512 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8mgr.exe PID 4472 wrote to memory of 3512 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8mgr.exe PID 4472 wrote to memory of 3304 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe LRmZyy.exe PID 4472 wrote to memory of 3304 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe LRmZyy.exe PID 4472 wrote to memory of 3304 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe LRmZyy.exe PID 4472 wrote to memory of 764 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe fontdrvhost.exe PID 4472 wrote to memory of 772 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe fontdrvhost.exe PID 4472 wrote to memory of 336 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe dwm.exe PID 4472 wrote to memory of 2524 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe sihost.exe PID 4472 wrote to memory of 2556 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe svchost.exe PID 4472 wrote to memory of 2660 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe taskhostw.exe PID 4472 wrote to memory of 3344 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Explorer.EXE PID 4472 wrote to memory of 3580 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe svchost.exe PID 4472 wrote to memory of 3772 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe DllHost.exe PID 4472 wrote to memory of 3916 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe StartMenuExperienceHost.exe PID 4472 wrote to memory of 3980 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe RuntimeBroker.exe PID 4472 wrote to memory of 4076 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe SearchApp.exe PID 4472 wrote to memory of 4044 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe RuntimeBroker.exe PID 4472 wrote to memory of 4440 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe RuntimeBroker.exe PID 4472 wrote to memory of 3004 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe TextInputHost.exe PID 4472 wrote to memory of 4000 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe backgroundTaskHost.exe PID 4472 wrote to memory of 1400 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe backgroundTaskHost.exe PID 4472 wrote to memory of 3512 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8mgr.exe PID 4472 wrote to memory of 3512 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8mgr.exe PID 4472 wrote to memory of 3304 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe LRmZyy.exe PID 4472 wrote to memory of 3304 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe LRmZyy.exe PID 4472 wrote to memory of 764 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe fontdrvhost.exe PID 4472 wrote to memory of 772 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe fontdrvhost.exe PID 4472 wrote to memory of 336 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe dwm.exe PID 4472 wrote to memory of 2524 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe sihost.exe PID 4472 wrote to memory of 2556 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe svchost.exe PID 4472 wrote to memory of 2660 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe taskhostw.exe PID 4472 wrote to memory of 3344 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Explorer.EXE PID 4472 wrote to memory of 3580 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe svchost.exe PID 4472 wrote to memory of 3772 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe DllHost.exe PID 4472 wrote to memory of 3916 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe StartMenuExperienceHost.exe PID 4472 wrote to memory of 3980 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe RuntimeBroker.exe PID 4472 wrote to memory of 4076 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe SearchApp.exe PID 4472 wrote to memory of 4044 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe RuntimeBroker.exe PID 4472 wrote to memory of 4440 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe RuntimeBroker.exe PID 4472 wrote to memory of 3004 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe TextInputHost.exe PID 4472 wrote to memory of 4000 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe backgroundTaskHost.exe PID 4472 wrote to memory of 1212 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe RuntimeBroker.exe PID 4472 wrote to memory of 3456 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe RuntimeBroker.exe PID 4472 wrote to memory of 764 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe fontdrvhost.exe PID 4472 wrote to memory of 772 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe fontdrvhost.exe PID 4472 wrote to memory of 336 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe dwm.exe PID 4472 wrote to memory of 2524 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe sihost.exe PID 4472 wrote to memory of 2556 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe svchost.exe PID 4472 wrote to memory of 2660 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe taskhostw.exe PID 4472 wrote to memory of 3344 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe Explorer.EXE PID 4472 wrote to memory of 3580 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe svchost.exe PID 4472 wrote to memory of 3772 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe DllHost.exe PID 4472 wrote to memory of 3916 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe StartMenuExperienceHost.exe PID 4472 wrote to memory of 3980 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe RuntimeBroker.exe PID 4472 wrote to memory of 4076 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe SearchApp.exe PID 4472 wrote to memory of 4044 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe RuntimeBroker.exe PID 4472 wrote to memory of 4440 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe RuntimeBroker.exe PID 4472 wrote to memory of 3004 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe TextInputHost.exe PID 4472 wrote to memory of 4000 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe backgroundTaskHost.exe PID 4472 wrote to memory of 1212 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe RuntimeBroker.exe PID 4472 wrote to memory of 3456 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe RuntimeBroker.exe PID 4472 wrote to memory of 764 4472 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe fontdrvhost.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe"C:\Users\Admin\AppData\Local\Temp\0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8mgr.exeC:\Users\Admin\AppData\Local\Temp\0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8mgr.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3512 -s 2644⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\LRmZyy.exeC:\Users\Admin\AppData\Local\Temp\LRmZyy.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\220a15d7.bat" "4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3512 -ip 35121⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\7-Zip\Uninstall.exeFilesize
36KB
MD5a783c5594a28eaf98e28027513455272
SHA1cf249a488ac741c4ccd2459c7123696d4d46e971
SHA256fa4851bdaef97811954b872730481d8cf12b983254fdb9439dfcc8e268326139
SHA512ed89c40fef3813e985b5f8ad109ea33d6f4d9bf753a538db08f3dff76cfe1cc9c663d73f2608ba1869d2fef6e8e9701f9c8e5a6996981068ce92d71de4c5f79c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GO42234Z\k2[1].rarFilesize
4B
MD5d3b07384d113edec49eaa6238ad5ff00
SHA1f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
SHA256b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
SHA5120cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6
-
C:\Users\Admin\AppData\Local\Temp\0ba6c143dea468a85bac811af2fd4b6c62a59c3530a15ab0fdd1099ef27edaa8mgr.exeFilesize
105KB
MD5dfb5daabb95dcfad1a5faf9ab1437076
SHA14a199569a9b52911bee7fb19ab80570cc5ff9ed1
SHA25654282ec29d4993ed6e9972122cfbb70bba4898a21d527bd9e72a166d7ec2fdc0
SHA5125d31c34403ab5f8db4a6d84f2b5579d4ea18673914b626d78e458a648ac20ddd8e342818e807331036d7bb064f596a02b9737acac42fbead29260343a30717e8
-
C:\Users\Admin\AppData\Local\Temp\15223A1D.exeFilesize
4B
MD520879c987e2f9a916e578386d499f629
SHA1c7b33ddcc42361fdb847036fc07e880b81935d5d
SHA2569f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
SHA512bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f
-
C:\Users\Admin\AppData\Local\Temp\220a15d7.batFilesize
187B
MD5df741305859584f29b2c7966c4b245ed
SHA14f341e102438871bf1078a8688ac34fee44a3648
SHA256eefe647306afa73f3b3ea015a2a9adda6b795da6cb3e548e1261f28ea7dba877
SHA5127480a4ef62ba23abe1c29b419a73ead7f3ceedc4a017d29e5858b4ad5a7626f0b78ec40ff7b57a4a57fd7db6afbc7b6e39e55714d1178d2c9b506c11737e465d
-
C:\Users\Admin\AppData\Local\Temp\LRmZyy.exeFilesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
-
F:\cymqm.pifFilesize
100KB
MD5eed031c9c7fa7ac7ca2b7f82d4437ca7
SHA13b815449b1545e1ec7fb313fb3ea9c31813b3636
SHA25615e0f8b2209cfd7515b0cdf942467dac01556775b13985c99cb7def13ce41eb3
SHA512e87eab813fdb7528e3d42d1ec5057789036efd680c400c9692fd2adf8ab44aa5743b277a054693f62d8305da92ef2146fc2592e8679d39cde96a79e676952f6e
-
memory/3304-33-0x00000000013A0000-0x00000000013A2000-memory.dmpFilesize
8KB
-
memory/3304-29-0x0000000001820000-0x0000000001821000-memory.dmpFilesize
4KB
-
memory/3304-35-0x00000000013A0000-0x00000000013A2000-memory.dmpFilesize
8KB
-
memory/3304-59-0x0000000000070000-0x0000000000079000-memory.dmpFilesize
36KB
-
memory/3304-120-0x00000000013A0000-0x00000000013A2000-memory.dmpFilesize
8KB
-
memory/3304-23-0x0000000000070000-0x0000000000079000-memory.dmpFilesize
36KB
-
memory/3512-20-0x00000000021D0000-0x00000000021D1000-memory.dmpFilesize
4KB
-
memory/3512-27-0x0000000000600000-0x0000000000602000-memory.dmpFilesize
8KB
-
memory/3512-65-0x0000000000600000-0x0000000000602000-memory.dmpFilesize
8KB
-
memory/3512-32-0x0000000000600000-0x0000000000602000-memory.dmpFilesize
8KB
-
memory/3512-5-0x0000000000400000-0x000000000045B000-memory.dmpFilesize
364KB
-
memory/3512-22-0x00000000004A0000-0x00000000004A1000-memory.dmpFilesize
4KB
-
memory/4472-44-0x0000000002790000-0x000000000381E000-memory.dmpFilesize
16.6MB
-
memory/4472-62-0x0000000002790000-0x000000000381E000-memory.dmpFilesize
16.6MB
-
memory/4472-17-0x0000000003DE0000-0x0000000003DE2000-memory.dmpFilesize
8KB
-
memory/4472-21-0x0000000002790000-0x000000000381E000-memory.dmpFilesize
16.6MB
-
memory/4472-18-0x00000000043F0000-0x00000000043F1000-memory.dmpFilesize
4KB
-
memory/4472-34-0x0000000002790000-0x000000000381E000-memory.dmpFilesize
16.6MB
-
memory/4472-43-0x0000000002790000-0x000000000381E000-memory.dmpFilesize
16.6MB
-
memory/4472-42-0x0000000002790000-0x000000000381E000-memory.dmpFilesize
16.6MB
-
memory/4472-0-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/4472-31-0x0000000003DE0000-0x0000000003DE2000-memory.dmpFilesize
8KB
-
memory/4472-47-0x0000000002790000-0x000000000381E000-memory.dmpFilesize
16.6MB
-
memory/4472-48-0x0000000002790000-0x000000000381E000-memory.dmpFilesize
16.6MB
-
memory/4472-51-0x0000000002790000-0x000000000381E000-memory.dmpFilesize
16.6MB
-
memory/4472-52-0x0000000002790000-0x000000000381E000-memory.dmpFilesize
16.6MB
-
memory/4472-53-0x0000000002790000-0x000000000381E000-memory.dmpFilesize
16.6MB
-
memory/4472-55-0x0000000002790000-0x000000000381E000-memory.dmpFilesize
16.6MB
-
memory/4472-56-0x0000000002790000-0x000000000381E000-memory.dmpFilesize
16.6MB
-
memory/4472-16-0x0000000002790000-0x000000000381E000-memory.dmpFilesize
16.6MB
-
memory/4472-60-0x0000000002790000-0x000000000381E000-memory.dmpFilesize
16.6MB
-
memory/4472-26-0x0000000003DE0000-0x0000000003DE2000-memory.dmpFilesize
8KB
-
memory/4472-25-0x0000000002790000-0x000000000381E000-memory.dmpFilesize
16.6MB
-
memory/4472-69-0x0000000002790000-0x000000000381E000-memory.dmpFilesize
16.6MB
-
memory/4472-72-0x0000000002790000-0x000000000381E000-memory.dmpFilesize
16.6MB
-
memory/4472-73-0x0000000002790000-0x000000000381E000-memory.dmpFilesize
16.6MB
-
memory/4472-75-0x0000000002790000-0x000000000381E000-memory.dmpFilesize
16.6MB
-
memory/4472-77-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/4472-78-0x0000000002790000-0x000000000381E000-memory.dmpFilesize
16.6MB
-
memory/4472-79-0x0000000002790000-0x000000000381E000-memory.dmpFilesize
16.6MB
-
memory/4472-83-0x0000000002790000-0x000000000381E000-memory.dmpFilesize
16.6MB
-
memory/4472-84-0x0000000002790000-0x000000000381E000-memory.dmpFilesize
16.6MB
-
memory/4472-24-0x0000000002790000-0x000000000381E000-memory.dmpFilesize
16.6MB
-
memory/4472-15-0x0000000002790000-0x000000000381E000-memory.dmpFilesize
16.6MB
-
memory/4472-93-0x0000000002790000-0x000000000381E000-memory.dmpFilesize
16.6MB
-
memory/4472-98-0x0000000002790000-0x000000000381E000-memory.dmpFilesize
16.6MB
-
memory/4472-99-0x0000000002790000-0x000000000381E000-memory.dmpFilesize
16.6MB
-
memory/4472-102-0x0000000002790000-0x000000000381E000-memory.dmpFilesize
16.6MB
-
memory/4472-103-0x0000000003DE0000-0x0000000003DE2000-memory.dmpFilesize
8KB
-
memory/4472-9-0x0000000002790000-0x000000000381E000-memory.dmpFilesize
16.6MB
-
memory/4472-14-0x0000000002790000-0x000000000381E000-memory.dmpFilesize
16.6MB
-
memory/4472-8-0x0000000002790000-0x000000000381E000-memory.dmpFilesize
16.6MB