Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
04-06-2024 02:05
Static task
static1
Behavioral task
behavioral1
Sample
b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe
Resource
win10v2004-20240426-en
General
-
Target
b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe
-
Size
1.9MB
-
MD5
b1a1b801d4d4cd9a69432cbac0a53393
-
SHA1
0ca06e648515de6973846fbd1d3c2ddd67af0157
-
SHA256
b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c
-
SHA512
3b8c5bb38009e03b45c99e207170847bc91c7691624663602d14b417e2f20266a3098e67e13c2e6a5a77bdbabe98058c3adbd89adad0674e5860bedb746db034
-
SSDEEP
24576:mxWVeyRYcR0Ow9HMobQi3AlbWAcAYDgWlZiibmwa+5v0DmZlbmw7orwi1KxOqO:m8Yc2zsobQrhRR+mibhv0DmT6I6DkO
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
serverinterfaces.exemsinfowindows6.1.7600.163857.0907131255.exesqlxmlxmicrosoft.exemicrosoftvisual.exepid process 1552 serverinterfaces.exe 2968 msinfowindows6.1.7600.163857.0907131255.exe 940 sqlxmlxmicrosoft.exe 2600 microsoftvisual.exe -
Loads dropped DLL 4 IoCs
Processes:
b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exepid process 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe -
Adds Run key to start application 2 TTPs 9 IoCs
Processes:
b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\EngineSource = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe" b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BCSSync = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\BCSSync.exe\" /DelayServices" b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Operatingmsinfo = "c:\\program files (x86)\\common files\\microsoft shared\\msinfo\\en-us\\msinfowindows6.1.7600.163857.0907131255.exe" b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BuildingBuiltIn = "c:\\program files (x86)\\microsoft office\\office14\\document parts\\1033\\14\\builtinbuilding.exe" b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsSystem = "c:\\program files (x86)\\common files\\system\\ole db\\en-us\\sqlxmlxmicrosoft.exe" b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\EngineOffice = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe" b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\msolap100Microsoft = "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\serverinterfaces.exe" b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\Microsoftmslid = "c:\\program files (x86)\\common files\\microsoft shared\\proof\\languagemicrosoft3.1.14709.exe" b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VisualVisual = "c:\\program files (x86)\\common files\\microsoft shared\\vsta\\8.0\\x86\\microsoftvisual.exe" b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
Processes:
b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exeserverinterfaces.exemsinfowindows6.1.7600.163857.0907131255.exesqlxmlxmicrosoft.exemicrosoftvisual.exedescription ioc process File created C:\Windows\SysWOW64\ntdll.dll.dll b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\SysWOW64\ntdll.dll.dll serverinterfaces.exe File created C:\Windows\SysWOW64\ntdll.dll.dll msinfowindows6.1.7600.163857.0907131255.exe File created C:\Windows\SysWOW64\ntdll.dll.dll sqlxmlxmicrosoft.exe File created C:\Windows\SysWOW64\ntdll.dll.dll microsoftvisual.exe -
Drops file in Program Files directory 14 IoCs
Processes:
b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exedescription ioc process File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\PROOF\RCX57F3.tmp b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\en-US\sqlxmlxMicrosoft.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\1033\14\RCX420F.tmp b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\MicrosoftVisual.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\1033\14\BuiltInBuilding.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\ServerInterfaces.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\RCX426E.tmp b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\msinfoWindows6.1.7600.163857.0907131255.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Program Files (x86)\Common Files\microsoft shared\PROOF\LanguageMicrosoft3.1.14709.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\de-DE\MSTTSLocEngine.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\1033\14\BuiltInBuilding.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\RCX428E.tmp b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\RCX5803.tmp b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\en-US\RCX5823.tmp b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe -
Checks processor information in registry 2 TTPs 15 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
sqlxmlxmicrosoft.exemicrosoftvisual.exeb91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exeserverinterfaces.exemsinfowindows6.1.7600.163857.0907131255.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier sqlxmlxmicrosoft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier microsoftvisual.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier serverinterfaces.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString msinfowindows6.1.7600.163857.0907131255.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 sqlxmlxmicrosoft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString sqlxmlxmicrosoft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString serverinterfaces.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 serverinterfaces.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msinfowindows6.1.7600.163857.0907131255.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier msinfowindows6.1.7600.163857.0907131255.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 microsoftvisual.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString microsoftvisual.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exeserverinterfaces.exemsinfowindows6.1.7600.163857.0907131255.exesqlxmlxmicrosoft.exemicrosoftvisual.exepid process 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 1552 serverinterfaces.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 2968 msinfowindows6.1.7600.163857.0907131255.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 940 sqlxmlxmicrosoft.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 2600 microsoftvisual.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exedescription pid process target process PID 620 wrote to memory of 1552 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe serverinterfaces.exe PID 620 wrote to memory of 1552 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe serverinterfaces.exe PID 620 wrote to memory of 1552 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe serverinterfaces.exe PID 620 wrote to memory of 1552 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe serverinterfaces.exe PID 620 wrote to memory of 1552 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe serverinterfaces.exe PID 620 wrote to memory of 1552 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe serverinterfaces.exe PID 620 wrote to memory of 1552 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe serverinterfaces.exe PID 620 wrote to memory of 2968 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe msinfowindows6.1.7600.163857.0907131255.exe PID 620 wrote to memory of 2968 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe msinfowindows6.1.7600.163857.0907131255.exe PID 620 wrote to memory of 2968 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe msinfowindows6.1.7600.163857.0907131255.exe PID 620 wrote to memory of 2968 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe msinfowindows6.1.7600.163857.0907131255.exe PID 620 wrote to memory of 2968 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe msinfowindows6.1.7600.163857.0907131255.exe PID 620 wrote to memory of 2968 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe msinfowindows6.1.7600.163857.0907131255.exe PID 620 wrote to memory of 2968 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe msinfowindows6.1.7600.163857.0907131255.exe PID 620 wrote to memory of 940 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe sqlxmlxmicrosoft.exe PID 620 wrote to memory of 940 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe sqlxmlxmicrosoft.exe PID 620 wrote to memory of 940 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe sqlxmlxmicrosoft.exe PID 620 wrote to memory of 940 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe sqlxmlxmicrosoft.exe PID 620 wrote to memory of 940 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe sqlxmlxmicrosoft.exe PID 620 wrote to memory of 940 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe sqlxmlxmicrosoft.exe PID 620 wrote to memory of 940 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe sqlxmlxmicrosoft.exe PID 620 wrote to memory of 2600 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe microsoftvisual.exe PID 620 wrote to memory of 2600 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe microsoftvisual.exe PID 620 wrote to memory of 2600 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe microsoftvisual.exe PID 620 wrote to memory of 2600 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe microsoftvisual.exe PID 620 wrote to memory of 2600 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe microsoftvisual.exe PID 620 wrote to memory of 2600 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe microsoftvisual.exe PID 620 wrote to memory of 2600 620 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe microsoftvisual.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe"C:\Users\Admin\AppData\Local\Temp\b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:620 -
\??\c:\program files (x86)\microsoft analysis services\as oledb\10\serverinterfaces.exe"c:\program files (x86)\microsoft analysis services\as oledb\10\serverinterfaces.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1552
-
-
\??\c:\program files (x86)\common files\microsoft shared\msinfo\en-us\msinfowindows6.1.7600.163857.0907131255.exe"c:\program files (x86)\common files\microsoft shared\msinfo\en-us\msinfowindows6.1.7600.163857.0907131255.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2968
-
-
\??\c:\program files (x86)\common files\system\ole db\en-us\sqlxmlxmicrosoft.exe"c:\program files (x86)\common files\system\ole db\en-us\sqlxmlxmicrosoft.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:940
-
-
\??\c:\program files (x86)\common files\microsoft shared\vsta\8.0\x86\microsoftvisual.exe"c:\program files (x86)\common files\microsoft shared\vsta\8.0\x86\microsoftvisual.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2600
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD5d8a6a5fb6b811fd15418f70f4c778236
SHA1c5ae7353ddaef65ff939428becff6b72cf5c0775
SHA2560c938f62b4e6d5b7b44ad9833a29c5ad6bbccfe6e41c18ba0c39187e6180ee05
SHA51259b4750b671341a69e35585f6a7ba0d278c40e463eb7ce53979f527327c2ef7717f3280b379fbd9b3b30462cd573b7e50d3a8ef4026fb437be94fd145c2f13d5
-
Filesize
1.9MB
MD5b1a1b801d4d4cd9a69432cbac0a53393
SHA10ca06e648515de6973846fbd1d3c2ddd67af0157
SHA256b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c
SHA5123b8c5bb38009e03b45c99e207170847bc91c7691624663602d14b417e2f20266a3098e67e13c2e6a5a77bdbabe98058c3adbd89adad0674e5860bedb746db034