67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01

Analysis

max time kernel
154s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 23:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe
Size 29KB
Sample240602-2zcv9abd38
SHA256 67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01
MD5 60457e8da3f34b1a9d8ae13a4ec08a00
SHA1 ce8884ae8685828037fadfe49d2e2ea6d3680134
SHA512 46ad6b908ddfc96aeb73f56bba7c38fac1ff38788d6d637350ca989334ea77195ea135460d0bceeb3c3aac03c5f86531a5fb9ea922c266f5f79690b8de87e352
SSDEEP 768:g5BOFKksO1mE9B77777J77c77c77c71utY/SiO9nK:g8Fs+DB77777J77c77c77c71JS/K
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe \"C:\\Windows\\5F02C5.exe\""	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe \"C:\\Windows\\5F02C5.exe\""	5F02C5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe \"C:\\Windows\\5F02C5.exe\""	5F02C5STQRQV.exe

Executes dropped EXE 5 IoCs

pid	Process
2540	5F02C5.exe
4128	5F02C5STQRQV.exe
5132	5F02C5STQRQV.exe
5432	5F02C5.exe
5604	5F02C5.exe

UPX packed file 39 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4768-0-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/files/0x000800000002324f-6.dat	upx
behavioral2/files/0x0008000000023251-14.dat	upx
behavioral2/memory/4128-17-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/4768-16-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/5132-21-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/5132-28-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/5432-31-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/5604-37-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/4768-39-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/2540-40-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/4128-41-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/2540-42-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/2540-43-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/4128-44-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/4128-45-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/2540-46-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/4128-47-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/2540-48-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/4128-49-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/2540-50-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/4128-51-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/2540-52-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/4128-53-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/2540-54-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/4128-55-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/2540-56-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/4128-57-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/2540-58-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/4128-59-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/2540-60-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/4128-61-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/2540-62-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/4128-63-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/2540-64-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/4128-65-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/2540-66-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/4128-67-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral2/memory/2540-68-0x0000000000400000-0x000000000040F000-memory.dmp	upx

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5F02C5.exe = "C:\\Windows\\5F02C5.exe"	5F02C5STQRQV.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5F02C5.exe = "C:\\Windows\\5F02C5.exe"	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5F02C5.exe = "C:\\Windows\\5F02C5.exe"	5F02C5.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\5F02C5.exe	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe
File opened for modification	C:\Windows\5F02C5STQRQV.exe	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe

Kills process with taskkill 42 IoCs

evasion

pid	Process
1572	TASKKILL.exe
696	TASKKILL.exe
4648	TASKKILL.exe
2948	TASKKILL.exe
3396	TASKKILL.exe
1096	TASKKILL.exe
2088	TASKKILL.exe
2716	TASKKILL.exe
1992	TASKKILL.exe
2856	TASKKILL.exe
464	TASKKILL.exe
1860	TASKKILL.exe
3488	TASKKILL.exe
4488	TASKKILL.exe
4080	TASKKILL.exe
4532	TASKKILL.exe
4924	TASKKILL.exe
4796	TASKKILL.exe
4788	TASKKILL.exe
544	TASKKILL.exe
4044	TASKKILL.exe
5080	TASKKILL.exe
1056	TASKKILL.exe
3460	TASKKILL.exe
3548	TASKKILL.exe
4020	TASKKILL.exe
3528	TASKKILL.exe
5076	TASKKILL.exe
1240	TASKKILL.exe
3156	TASKKILL.exe
4092	TASKKILL.exe
32	TASKKILL.exe
1212	TASKKILL.exe
2608	TASKKILL.exe
1884	TASKKILL.exe
4400	TASKKILL.exe
1596	TASKKILL.exe
3992	TASKKILL.exe
3604	TASKKILL.exe
1844	TASKKILL.exe
4988	TASKKILL.exe
4664	TASKKILL.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeDebugPrivilege	1056	TASKKILL.exe
Token: SeDebugPrivilege	1596	TASKKILL.exe
Token: SeDebugPrivilege	1572	TASKKILL.exe
Token: SeDebugPrivilege	4044	TASKKILL.exe
Token: SeDebugPrivilege	4080	TASKKILL.exe
Token: SeDebugPrivilege	32	TASKKILL.exe
Token: SeDebugPrivilege	3604	TASKKILL.exe
Token: SeDebugPrivilege	696	TASKKILL.exe
Token: SeDebugPrivilege	3992	TASKKILL.exe
Token: SeDebugPrivilege	4400	TASKKILL.exe
Token: SeDebugPrivilege	5076	TASKKILL.exe
Token: SeDebugPrivilege	4532	TASKKILL.exe
Token: SeDebugPrivilege	3528	TASKKILL.exe
Token: SeDebugPrivilege	4648	TASKKILL.exe
Token: SeDebugPrivilege	2948	TASKKILL.exe
Token: SeDebugPrivilege	5080	TASKKILL.exe
Token: SeDebugPrivilege	4488	TASKKILL.exe
Token: SeDebugPrivilege	1096	TASKKILL.exe
Token: SeDebugPrivilege	3396	TASKKILL.exe
Token: SeDebugPrivilege	1240	TASKKILL.exe
Token: SeDebugPrivilege	1884	TASKKILL.exe
Token: SeDebugPrivilege	2608	TASKKILL.exe
Token: SeDebugPrivilege	4988	TASKKILL.exe
Token: SeDebugPrivilege	2716	TASKKILL.exe
Token: SeDebugPrivilege	1844	TASKKILL.exe
Token: SeDebugPrivilege	1992	TASKKILL.exe
Token: SeDebugPrivilege	3460	TASKKILL.exe
Token: SeDebugPrivilege	2856	TASKKILL.exe
Token: SeDebugPrivilege	3488	TASKKILL.exe
Token: SeDebugPrivilege	1212	TASKKILL.exe
Token: SeDebugPrivilege	4796	TASKKILL.exe
Token: SeDebugPrivilege	2088	TASKKILL.exe
Token: SeDebugPrivilege	464	TASKKILL.exe
Token: SeDebugPrivilege	3548	TASKKILL.exe
Token: SeDebugPrivilege	4092	TASKKILL.exe
Token: SeDebugPrivilege	1860	TASKKILL.exe
Token: SeDebugPrivilege	544	TASKKILL.exe
Token: SeDebugPrivilege	4020	TASKKILL.exe
Token: SeDebugPrivilege	3156	TASKKILL.exe
Token: SeDebugPrivilege	4924	TASKKILL.exe
Token: SeDebugPrivilege	4788	TASKKILL.exe
Token: SeDebugPrivilege	4664	TASKKILL.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe
2540	5F02C5.exe
4128	5F02C5STQRQV.exe
5132	5F02C5STQRQV.exe
5432	5F02C5.exe
5604	5F02C5.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 4400	4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe	92
PID 4768 wrote to memory of 4400	4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe	92
PID 4768 wrote to memory of 4400	4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe	92
PID 4768 wrote to memory of 1596	4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe	93
PID 4768 wrote to memory of 1596	4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe	93
PID 4768 wrote to memory of 1596	4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe	93
PID 4768 wrote to memory of 3528	4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe	94
PID 4768 wrote to memory of 3528	4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe	94
PID 4768 wrote to memory of 3528	4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe	94
PID 4768 wrote to memory of 3992	4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe	95
PID 4768 wrote to memory of 3992	4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe	95
PID 4768 wrote to memory of 3992	4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe	95
PID 4768 wrote to memory of 1572	4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe	96
PID 4768 wrote to memory of 1572	4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe	96
PID 4768 wrote to memory of 1572	4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe	96
PID 4768 wrote to memory of 4488	4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe	97
PID 4768 wrote to memory of 4488	4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe	97
PID 4768 wrote to memory of 4488	4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe	97
PID 4768 wrote to memory of 4080	4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe	98
PID 4768 wrote to memory of 4080	4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe	98
PID 4768 wrote to memory of 4080	4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe	98
PID 4768 wrote to memory of 696	4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe	99
PID 4768 wrote to memory of 696	4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe	99
PID 4768 wrote to memory of 696	4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe	99
PID 4768 wrote to memory of 4044	4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe	100
PID 4768 wrote to memory of 4044	4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe	100
PID 4768 wrote to memory of 4044	4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe	100
PID 4768 wrote to memory of 32	4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe	101
PID 4768 wrote to memory of 32	4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe	101
PID 4768 wrote to memory of 32	4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe	101
PID 4768 wrote to memory of 4532	4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe	102
PID 4768 wrote to memory of 4532	4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe	102
PID 4768 wrote to memory of 4532	4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe	102
PID 4768 wrote to memory of 3604	4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe	103
PID 4768 wrote to memory of 3604	4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe	103
PID 4768 wrote to memory of 3604	4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe	103
PID 4768 wrote to memory of 4648	4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe	104
PID 4768 wrote to memory of 4648	4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe	104
PID 4768 wrote to memory of 4648	4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe	104
PID 4768 wrote to memory of 5076	4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe	105
PID 4768 wrote to memory of 5076	4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe	105
PID 4768 wrote to memory of 5076	4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe	105
PID 4768 wrote to memory of 2540	4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe	120
PID 4768 wrote to memory of 2540	4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe	120
PID 4768 wrote to memory of 2540	4768	67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe	120
PID 2540 wrote to memory of 5080	2540	5F02C5.exe	121
PID 2540 wrote to memory of 5080	2540	5F02C5.exe	121
PID 2540 wrote to memory of 5080	2540	5F02C5.exe	121
PID 2540 wrote to memory of 1240	2540	5F02C5.exe	122
PID 2540 wrote to memory of 1240	2540	5F02C5.exe	122
PID 2540 wrote to memory of 1240	2540	5F02C5.exe	122
PID 2540 wrote to memory of 1096	2540	5F02C5.exe	123
PID 2540 wrote to memory of 1096	2540	5F02C5.exe	123
PID 2540 wrote to memory of 1096	2540	5F02C5.exe	123
PID 2540 wrote to memory of 2856	2540	5F02C5.exe	124
PID 2540 wrote to memory of 2856	2540	5F02C5.exe	124
PID 2540 wrote to memory of 2856	2540	5F02C5.exe	124
PID 2540 wrote to memory of 1992	2540	5F02C5.exe	125
PID 2540 wrote to memory of 1992	2540	5F02C5.exe	125
PID 2540 wrote to memory of 1992	2540	5F02C5.exe	125
PID 2540 wrote to memory of 3460	2540	5F02C5.exe	126
PID 2540 wrote to memory of 3460	2540	5F02C5.exe	126
PID 2540 wrote to memory of 3460	2540	5F02C5.exe	126
PID 2540 wrote to memory of 1056	2540	5F02C5.exe	127

C:\Users\Admin\AppData\Local\Temp\67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe
"C:\Users\Admin\AppData\Local\Temp\67f66ba2f2f0fe00cbf6d2f2ad040e9b6ab7bcba459ceb426dbbcce7cabcca01.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /S COMPUTERNAME /F /IM winlogon.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4400
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /S COMPUTERNAME /F /IM services.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1596
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /S COMPUTERNAME /F /IM lsass.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3528
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /S COMPUTERNAME /F /IM csrss.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3992
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /S COMPUTERNAME /F /IM smss.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1572
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /S COMPUTERNAME /F /IM inetinfo.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4488
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /S COMPUTERNAME /F /IM svchost.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4080
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /S COMPUTERNAME /F /IM winlogon.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:696
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /S COMPUTERNAME /F /IM services.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4044
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /S COMPUTERNAME /F /IM lsass.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:32
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /S COMPUTERNAME /F /IM csrss.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4532
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /S COMPUTERNAME /F /IM smss.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3604
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /S COMPUTERNAME /F /IM inetinfo.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4648
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /S COMPUTERNAME /F /IM svchost.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5076
- C:\Windows\5F02C5.exe
  C:\Windows\5F02C5.exe
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /S COMPUTERNAME /F /IM winlogon.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5080
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /S COMPUTERNAME /F /IM services.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1240
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /S COMPUTERNAME /F /IM lsass.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1096
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /S COMPUTERNAME /F /IM csrss.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2856
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /S COMPUTERNAME /F /IM smss.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1992
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /S COMPUTERNAME /F /IM inetinfo.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3460
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /S COMPUTERNAME /F /IM svchost.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1056
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /S COMPUTERNAME /F /IM winlogon.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1844
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /S COMPUTERNAME /F /IM services.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2948
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /S COMPUTERNAME /F /IM lsass.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3396
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /S COMPUTERNAME /F /IM csrss.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1884
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /S COMPUTERNAME /F /IM smss.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2716
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /S COMPUTERNAME /F /IM inetinfo.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4988
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /S COMPUTERNAME /F /IM svchost.exe /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2608
- - C:\Windows\5F02C5STQRQV.exe
    C:\Windows\5F02C5STQRQV.exe
    3⤵
    - Modifies WinLogon for persistence
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetWindowsHookEx
    PID:4128
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM winlogon.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:464
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM services.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3548
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM lsass.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2088
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM csrss.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1212
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM smss.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3156
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM inetinfo.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4924
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM svchost.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4020
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM winlogon.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4796
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM services.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:544
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM lsass.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4092
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM csrss.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4788
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM smss.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1860
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM inetinfo.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4664
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /S COMPUTERNAME /F /IM svchost.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3488
  - - C:\Windows\5F02C5STQRQV.exe
      C:\Windows\5F02C5STQRQV.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5132
  - - C:\Windows\5F02C5.exe
      C:\Windows\5F02C5.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5432
- - C:\Windows\5F02C5.exe
    C:\Windows\5F02C5.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4144 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:7152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5F02C5.exe

Path C:\Windows\5F02C5.exe
Size 18KB
SHA256 11c36b331c84ecfa63d7e2c25743b697a98caac8204fbacd9b4c179dbefe6034
MD5 1ad022908cc318c91622b0282d1ee1d5
SHA1 b19ce6d115a9bb5dc31af8da51b5ff1f85147b44
SHA512 949594ca919995df6034d28cbc37c38ae5697a22dbabd7e17660a9ad071f737b0f15dbc9fa59c5425d10406b8ba3df3a38adec48b09646ef9c19cb884db496dc
SSDEEP 384:g58AcUoUQKNRYELxQUHDvmk3E+KDvB77777J77c77c77c72qh5gc545o:g5BOFKksO1mE9B77777J77c77c77c71z
MD5 SHA1 SHA512 SSDEEP

Submit Download

5F02C5STQRQV.exe

Path C:\Windows\5F02C5STQRQV.exe
Size 24KB
SHA256 9b56361042c6aa7476116d059a1500a7716468da15f07368358575109ebc2fb2
MD5 45f86e0826628628cc8ae44fb2181030
SHA1 79e854c979cae2bc2560bf20f2e76ef467fe4664
SHA512 3551a675a30a9a5e17c42ddd06ad55b2e484a15d4e4b16b8419b0f6d6e7deda967bc2ae2b111b4527e3dd75295ecfb25fd7f2a98bfbdae3b9cc19d0585d3c9fc
SSDEEP 768:g5BOFKksO1mE9B77777J77c77c77c71CvVCP2415hjl:g8Fs+DB77777J77c77c77c71cVv4vhjl
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2540-58-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2540-68-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2540-66-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2540-64-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2540-62-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2540-60-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2540-48-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2540-56-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2540-40-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2540-54-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2540-42-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2540-43-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2540-52-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2540-50-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2540-46-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4128-57-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4128-63-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4128-49-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4128-45-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4128-51-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4128-44-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4128-53-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4128-41-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4128-55-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4128-17-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4128-67-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4128-65-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4128-59-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4128-47-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4128-61-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4768-16-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4768-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4768-39-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5132-28-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5132-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5432-31-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5604-37-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads