Analysis
- max time kernel
146s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
04/06/2024, 02:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe
Resource
win7-20240508-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe
- Size 1.9MB
- Sample240604-chv8tshf6s
- SHA256 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c
- MD5 b1a1b801d4d4cd9a69432cbac0a53393
- SHA1 0ca06e648515de6973846fbd1d3c2ddd67af0157
- SHA512 3b8c5bb38009e03b45c99e207170847bc91c7691624663602d14b417e2f20266a3098e67e13c2e6a5a77bdbabe98058c3adbd89adad0674e5860bedb746db034
- SSDEEP 24576:mxWVeyRYcR0Ow9HMobQi3AlbWAcAYDgWlZiibmwa+5v0DmZlbmw7orwi1KxOqO:m8Yc2zsobQrhRR+mibhv0DmT6I6DkO
- MD5 SHA1 SHA512 SSDEEP
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\OneDriveSetupOneDrive = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe" b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\MicrosoftOneDriveSetup26962 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe" b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\ntdll.dll.dll b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe - Drops file in Program Files directory 33 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\tifffilttifffilt.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\RCX5078.tmp b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\AiodAcrobat.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\RCX60D8.tmp b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\RCX69E3.tmp b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\AcrobatAdobe.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\TipResdexploitation.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\RCX3D87.tmp b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\RCX3DE6.tmp b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\ToolsContract.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\RCX4683.tmp b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prcrPlugin.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\AcrobatAdobe.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ProjectionDynamic.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\RCX4653.tmp b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\RCX474F.tmp b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\RCX51F0.tmp b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\widevinecdmadapterdllDirectX.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCX5DD9.tmp b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\TipResdexploitation.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\AdobeHunspellPluginAdobeHunspellPlugin.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\AdobeAcrobat.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\widevinecdmadapterdllDirectX.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RCX6A51.tmp b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\SaveAsRTFAdobe.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\RCX5AFA.tmp b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\RCX521F.tmp b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\RCX6965.tmp b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ProjectionDynamic.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\RCX3D76.tmp b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\PowerShellMicrosoft.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\AcrobatAdobe.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\AdobeAcrobat.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Boot\PCAT\en-GB\bootmgrWindows.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File opened for modification C:\Windows\Branding\Basebrd\RCX3655.tmp b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-l..ker-winrt.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_65d349adc7a2c384\lockappbrokerMicrosoft.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-n..anagement-proxystub_31bf3856ad364e35_10.0.19041.1_none_9e6f38387d47c886\WindowsOperating.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\Boot\EFI\et-EE\bootmgrOperatsioonissteem.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\Boot\PCAT\fi-FI\kyttjrjestelmmemdiag.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\Boot\EFI\ja-JP\bootmgrmemdiag.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..agnostics.resources_31bf3856ad364e35_10.0.19041.1_en-us_a23b49aa54c858bd\WindowsMicrosoft.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..oningcore.resources_31bf3856ad364e35_10.0.19041.1_de-de_91d83e61e91defbb\provcoreprovcore.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\Boot\PCAT\fr-FR\Microsoftmemdiag.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\Boot\PCAT\lv-LV\Microsoftbootmgr10.0.19041.1.160101.0800.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\Boot\Resources\it-IT\Microsoftoperativo.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\Branding\Basebrd\BASEBRDWindows.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic.Runtime\v4.0_4.0.0.0__b03f5f7f11d50a3a\DynamicMicrosoft.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File opened for modification C:\Windows\Branding\Basebrd\fr-FR\RCX9FEA.tmp b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\WinSxS\amd64_wpf-presentationcffrasterizer_31bf3856ad364e35_10.0.19041.1_none_c368d2fec931c74c\PresentationCFFRasterizerMicrosoft.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_3d0229d17c310f10\OperatingWindows.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\it\resourcesMicrosoft.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\Boot\PCAT\hu-HU\rendszeropercis.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\ahclientBSAFE.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\Boot\PCAT\es-ES\MicrosoftSistema.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..-recovery.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_6555f45e11bdae94\MicrosoftWindows10.0.19041.1.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..rd-module.resources_31bf3856ad364e35_10.0.19041.1_en-us_d9534f94e0f0515f\Windowstpmvsc.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\Boot\PCAT\es-ES\bootmgrWindows.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\Boot\EFI\it-IT\Microsoftoperativo.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\Boot\EFI\en-US\memdiagOperating10.0.19041.1.160101.0800.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scheduleui.resources_31bf3856ad364e35_10.0.19041.1_en-us_593f7a7ea2a28e1b\WindowsMicrosoft.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\WinSxS\amd64_xamlbuildtask.resources_31bf3856ad364e35_4.0.15805.0_de-de_c00b369dc56fa632\Microsoftresources.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.19041.1_fi-fi_c8dbe15330ec9d29\kyttjrjestelmWindows.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\Boot\PCAT\zh-TW\Windowsbootmgr10.0.19041.1.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\Boot\EFI\hu-HU\bootmgropercis.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Utility.Activities.Resources\v4.0_3.0.0.0_es_31bf3856ad364e35\RCX565B.tmp b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\de-DE\MicrosoftServiceModelEvents4.8.4084.0.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\Boot\EFI\pt-BR\Windowsbootmgr10.0.19041.1.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\Boot\PCAT\nb-NO\memdiagOperativsystemet.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setx_31bf3856ad364e35_10.0.19041.1_none_6267e352b86de969\WindowsOperating.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File opened for modification C:\Windows\Branding\Basebrd\fr-FR\RCXEB5D.tmp b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\E39B69A3F3677E14587CF1C3CC73FE72\48.108.8828\RCXEBAD.tmp b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\Boot\EFI\tr-TR\bootmgrMicrosoft.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..r-wmerror.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_a1098e6d824abd2f\Windowsdexploitation12.0.19041.1.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\WinSxS\wow64_startupapp-task-data.resources_31bf3856ad364e35_10.0.19041.1_de-de_27922e70e9a44f76\Microsoftstartupscan.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\ahclientBSAFE.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\Boot\EFI\qps-ploc\u8YSicstfertng.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-onex.resources_31bf3856ad364e35_10.0.19041.1_de-de_7416c97e26554480\onexMicrosoft10.0.19041.1.160101.0800.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\diagnostics\system\Power\it-IT\MicrosoftPowerDiagPackage.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\Boot\PCAT\hr-HR\sustavbootmgr.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\Boot\EFI\fr-FR\Windowsdexploitation10.0.19041.1.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Speech.resources\v4.0_4.0.0.0_de_31bf3856ad364e35\SystemSpeech340.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\Boot\EFI\sk-SK\Windowsbootmgr.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\Boot\Resources\de-DE\bootresWindows10.0.19041.1.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\Boot\PCAT\ko-KR\bootmgrWindows.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\Boot\EFI\es-MX\MicrosoftWindows10.0.19041.1.160101.0800.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\Boot\PCAT\en-GB\Windowsbootmgr.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\Boot\EFI\es-ES\operativomemdiag.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Speech.resources\v4.0_4.0.0.0_de_31bf3856ad364e35\RCXDC6.tmp b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\WinSxS\amd64_umb_31bf3856ad364e35_10.0.19041.746_none_64b09337769b299e\WindowsMicrosoft.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\de-DE\RCX56BB.tmp b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\Boot\EFI\cs-CZ\memdiagsystm.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\Boot\PCAT\sk-SK\bootmgrOperating10.0.19041.1.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..emotepage.resources_31bf3856ad364e35_10.0.19041.1_en-us_6d08a39cd122d3e0\remotepgremotepg10.0.19041.1.160101.0800.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MUI\040C\RCXE34.tmp b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\Boot\EFI\zh-TW\SystemMicrosoft.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\Boot\EFI\pl-PL\memdiagMicrosoft.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe File created C:\Windows\WinSxS\amd64_security-octagon-enclave_31bf3856ad364e35_10.0.19041.1266_none_c5ebbfd4188c4c8d\SgrmEnclaveMicrosoft10.0.19041.1266.160101.0800.exe b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe 4248 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe"C:\Users\Admin\AppData\Local\Temp\b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4248
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prcrPlugin.exe
- Size 1.9MB
- SHA256 9f26bccdb96445a3b717f538ae64e2ab0dd001b3da95451eb6917979d5f17256
- MD5 74ff4246031397f0415ff4365582545c
- SHA1 36d670443d1cd48ee8431054f1b567f90f24a6f8
- SHA512 17dbd25667faf922670f3b0ed94c255150eb9fd424625c751a398a09cb062ceb271492e28b01829144a5f542e0c8be37203c13f44f213a179d2c0389552902a2
- SSDEEP 24576:ZxWVeyRYsy0Ow9HMobQi3AlbWAcAYDgWlZiibmwa+5v0DmZlbmw7orwi1KxOqK:Z8YsrzsobQrhRR+mibhv0DmT6I6DkK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\TipResdexploitation.exe
- Size 1.9MB
- SHA256 b91e77cdaa582335f5e2714d4f84910dfda1a272d2d568053c68b7738191be1c
- MD5 b1a1b801d4d4cd9a69432cbac0a53393
- SHA1 0ca06e648515de6973846fbd1d3c2ddd67af0157
- SHA512 3b8c5bb38009e03b45c99e207170847bc91c7691624663602d14b417e2f20266a3098e67e13c2e6a5a77bdbabe98058c3adbd89adad0674e5860bedb746db034
- SSDEEP 24576:mxWVeyRYcR0Ow9HMobQi3AlbWAcAYDgWlZiibmwa+5v0DmZlbmw7orwi1KxOqO:m8Yc2zsobQrhRR+mibhv0DmT6I6DkO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\RCX3DE6.tmp
- Size 1.9MB
- SHA256 351d44e4a1b35ff87a962d8529d1b6d60dc5f18e6fc9d8c8bf5fa0b89698e040
- MD5 b7b51c33a1abae87f0b95f46d7d99cc7
- SHA1 c8fc561911c9185c9b2b8f635ae4426a5b783cbf
- SHA512 205f5377aff836294380097893798001b2170265afb55b3c04f94be2f8f2f0444541ab72973620534d9f1d94935ca84c25ec40285ca4d2ce477fdc2bba1af38b
- SSDEEP 24576:hxWVeyRYuy0Ow9HMobQi3AlbWAcAYDgWlZiibmwa+5v0DmZlbmw7orwi1KxOqq:h8YurzsobQrhRR+mibhv0DmT6I6Dkq
- MD5 SHA1 SHA512 SSDEEP