Analysis
- max time kernel
16s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
07/06/2024, 00:58
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe
Resource
win7-20240221-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target 710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe
- Size 126KB
- Sample240607-bbyvpseg7s
- SHA256 710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115
- MD5 e7cffcd88d5abd6d17244f1932740726
- SHA1 8df4e256b72f5776139a0679c54533b05e9cfcb4
- SHA512 c8583b7f2d7af1f12582ed0fc3784c4b68dfb228760fc9775e21144a4de7f1386e459be1262cdb7df6510696f3a1942f176cd223041c5dbb3fe26c21a6654fff
- SSDEEP 3072:sEboFVlGAvwsgbpvYfMTc72L10fPsout6S:rBzsgbpvnTcyOPsoS6S
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- UPX dump on OEP (original entry point) 39 IoCs
resource yara_rule behavioral2/memory/3344-5-0x00000000006D0000-0x0000000000725000-memory.dmp UPX behavioral2/memory/3344-13-0x00000000006D0000-0x0000000000725000-memory.dmp UPX behavioral2/memory/3344-29-0x00000000006D0000-0x0000000000725000-memory.dmp UPX behavioral2/memory/3344-33-0x00000000006D0000-0x0000000000725000-memory.dmp UPX behavioral2/memory/3344-32-0x00000000006D0000-0x0000000000725000-memory.dmp UPX behavioral2/memory/3344-31-0x00000000006D0000-0x0000000000725000-memory.dmp UPX behavioral2/memory/3344-25-0x00000000006D0000-0x0000000000725000-memory.dmp UPX behavioral2/memory/3344-23-0x00000000006D0000-0x0000000000725000-memory.dmp UPX behavioral2/memory/3344-21-0x00000000006D0000-0x0000000000725000-memory.dmp UPX behavioral2/memory/3344-19-0x00000000006D0000-0x0000000000725000-memory.dmp UPX behavioral2/memory/3344-27-0x00000000006D0000-0x0000000000725000-memory.dmp UPX behavioral2/memory/3344-18-0x00000000006D0000-0x0000000000725000-memory.dmp UPX behavioral2/memory/3344-15-0x00000000006D0000-0x0000000000725000-memory.dmp UPX behavioral2/memory/3344-11-0x00000000006D0000-0x0000000000725000-memory.dmp UPX behavioral2/memory/3344-9-0x00000000006D0000-0x0000000000725000-memory.dmp UPX behavioral2/memory/3344-7-0x00000000006D0000-0x0000000000725000-memory.dmp UPX behavioral2/memory/3344-3-0x00000000006D0000-0x0000000000725000-memory.dmp UPX behavioral2/memory/3344-2-0x00000000006D0000-0x0000000000725000-memory.dmp UPX behavioral2/files/0x0007000000023434-99.dat UPX behavioral2/memory/4888-98-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral2/memory/4628-103-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral2/memory/4628-104-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral2/memory/4628-106-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral2/memory/4628-108-0x00000000029A0000-0x00000000029F5000-memory.dmp UPX behavioral2/memory/4628-118-0x00000000029A0000-0x00000000029F5000-memory.dmp UPX behavioral2/memory/4628-116-0x00000000029A0000-0x00000000029F5000-memory.dmp UPX behavioral2/memory/4628-114-0x00000000029A0000-0x00000000029F5000-memory.dmp UPX behavioral2/memory/4628-112-0x00000000029A0000-0x00000000029F5000-memory.dmp UPX behavioral2/memory/4628-110-0x00000000029A0000-0x00000000029F5000-memory.dmp UPX behavioral2/memory/4628-107-0x00000000029A0000-0x00000000029F5000-memory.dmp UPX behavioral2/memory/4628-128-0x00000000029A0000-0x00000000029F5000-memory.dmp UPX behavioral2/memory/4628-132-0x00000000029A0000-0x00000000029F5000-memory.dmp UPX behavioral2/files/0x000800000002342f-161.dat UPX behavioral2/memory/4628-130-0x00000000029A0000-0x00000000029F5000-memory.dmp UPX behavioral2/memory/4628-127-0x00000000029A0000-0x00000000029F5000-memory.dmp UPX behavioral2/memory/4628-124-0x00000000029A0000-0x00000000029F5000-memory.dmp UPX behavioral2/memory/4628-122-0x00000000029A0000-0x00000000029F5000-memory.dmp UPX behavioral2/memory/4628-120-0x00000000029A0000-0x00000000029F5000-memory.dmp UPX behavioral2/memory/4628-243-0x0000000000400000-0x000000000042D000-memory.dmp UPX - Deletes itself 1 IoCs
pid Process 4628 svchost.exe - Executes dropped EXE 1 IoCs
pid Process 2592 KVEIF.jpg - Loads dropped DLL 4 IoCs
pid Process 3344 710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe 4628 svchost.exe 2592 KVEIF.jpg 3716 svchost.exe -
resource yara_rule behavioral2/memory/3344-5-0x00000000006D0000-0x0000000000725000-memory.dmp upx behavioral2/memory/3344-13-0x00000000006D0000-0x0000000000725000-memory.dmp upx behavioral2/memory/3344-29-0x00000000006D0000-0x0000000000725000-memory.dmp upx behavioral2/memory/3344-33-0x00000000006D0000-0x0000000000725000-memory.dmp upx behavioral2/memory/3344-32-0x00000000006D0000-0x0000000000725000-memory.dmp upx behavioral2/memory/3344-31-0x00000000006D0000-0x0000000000725000-memory.dmp upx behavioral2/memory/3344-25-0x00000000006D0000-0x0000000000725000-memory.dmp upx behavioral2/memory/3344-23-0x00000000006D0000-0x0000000000725000-memory.dmp upx behavioral2/memory/3344-21-0x00000000006D0000-0x0000000000725000-memory.dmp upx behavioral2/memory/3344-19-0x00000000006D0000-0x0000000000725000-memory.dmp upx behavioral2/memory/3344-27-0x00000000006D0000-0x0000000000725000-memory.dmp upx behavioral2/memory/3344-18-0x00000000006D0000-0x0000000000725000-memory.dmp upx behavioral2/memory/3344-15-0x00000000006D0000-0x0000000000725000-memory.dmp upx behavioral2/memory/3344-11-0x00000000006D0000-0x0000000000725000-memory.dmp upx behavioral2/memory/3344-9-0x00000000006D0000-0x0000000000725000-memory.dmp upx behavioral2/memory/3344-7-0x00000000006D0000-0x0000000000725000-memory.dmp upx behavioral2/memory/3344-3-0x00000000006D0000-0x0000000000725000-memory.dmp upx behavioral2/memory/3344-2-0x00000000006D0000-0x0000000000725000-memory.dmp upx behavioral2/memory/4628-108-0x00000000029A0000-0x00000000029F5000-memory.dmp upx behavioral2/memory/4628-118-0x00000000029A0000-0x00000000029F5000-memory.dmp upx behavioral2/memory/4628-116-0x00000000029A0000-0x00000000029F5000-memory.dmp upx behavioral2/memory/4628-114-0x00000000029A0000-0x00000000029F5000-memory.dmp upx behavioral2/memory/4628-112-0x00000000029A0000-0x00000000029F5000-memory.dmp upx behavioral2/memory/4628-110-0x00000000029A0000-0x00000000029F5000-memory.dmp upx behavioral2/memory/4628-107-0x00000000029A0000-0x00000000029F5000-memory.dmp upx behavioral2/memory/4628-128-0x00000000029A0000-0x00000000029F5000-memory.dmp upx behavioral2/memory/4628-132-0x00000000029A0000-0x00000000029F5000-memory.dmp upx behavioral2/memory/4628-130-0x00000000029A0000-0x00000000029F5000-memory.dmp upx behavioral2/memory/4628-127-0x00000000029A0000-0x00000000029F5000-memory.dmp upx behavioral2/memory/4628-124-0x00000000029A0000-0x00000000029F5000-memory.dmp upx behavioral2/memory/4628-122-0x00000000029A0000-0x00000000029F5000-memory.dmp upx behavioral2/memory/4628-120-0x00000000029A0000-0x00000000029F5000-memory.dmp upx - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\kernel64.dll 710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe File opened for modification C:\Windows\SysWOW64\kernel64.dll 710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3344 set thread context of 4888 3344 710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe 91 PID 3344 set thread context of 4628 3344 710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe 94 PID 2592 set thread context of 3716 2592 KVEIF.jpg 97 - Drops file in Program Files directory 23 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\KVEIFmain.ini 710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe File created C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\1D11D1C123.IMD KVEIF.jpg File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\KVEIFs5.ini svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\KVEIF.jpg svchost.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\KVEIFss1.ini 710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\KVEIF.jpg 710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\1D11D1C123.IMD svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\1D11D1C123.IMD svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\FKC.WYA KVEIF.jpg File opened for modification C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\KVEIFs5.ini svchost.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\ok.txt 710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\FKC.WYA 710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe File opened for modification C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\FKC.WYA svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\KVEIF.jpg 710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\KVEIFmain.ini 710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\FKC.WYA svchost.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\KVEIFs1.ini svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\KVEIF.jpg svchost.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\$$.tmp svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\KVEIFs5.ini KVEIF.jpg - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\web\606C646364636479.tmp 710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe File opened for modification C:\Windows\web\606C646364636479.tmp 710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3344 710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe 3344 710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe 3344 710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe 3344 710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe 3344 710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe 3344 710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe 3344 710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe 3344 710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 4628 svchost.exe 2592 KVEIF.jpg 2592 KVEIF.jpg 2592 KVEIF.jpg 2592 KVEIF.jpg 2592 KVEIF.jpg 2592 KVEIF.jpg - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4628 svchost.exe - Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeDebugPrivilege 3344 710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe Token: SeDebugPrivilege 3344 710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe Token: SeDebugPrivilege 3344 710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe Token: SeDebugPrivilege 3344 710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe Token: SeDebugPrivilege 3344 710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe Token: SeDebugPrivilege 3344 710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe Token: SeDebugPrivilege 3344 710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe Token: SeDebugPrivilege 4628 svchost.exe Token: SeDebugPrivilege 4628 svchost.exe Token: SeDebugPrivilege 4628 svchost.exe Token: SeDebugPrivilege 4628 svchost.exe Token: SeDebugPrivilege 4628 svchost.exe Token: SeDebugPrivilege 4628 svchost.exe Token: SeDebugPrivilege 4628 svchost.exe Token: SeDebugPrivilege 2592 KVEIF.jpg Token: SeDebugPrivilege 2592 KVEIF.jpg Token: SeDebugPrivilege 2592 KVEIF.jpg Token: SeDebugPrivilege 3716 svchost.exe Token: SeDebugPrivilege 3716 svchost.exe Token: SeDebugPrivilege 3716 svchost.exe Token: SeDebugPrivilege 3716 svchost.exe Token: SeDebugPrivilege 3716 svchost.exe Token: SeDebugPrivilege 4628 svchost.exe Token: SeDebugPrivilege 4628 svchost.exe Token: SeDebugPrivilege 3716 svchost.exe Token: SeDebugPrivilege 3716 svchost.exe Token: SeDebugPrivilege 4628 svchost.exe Token: SeDebugPrivilege 4628 svchost.exe Token: SeDebugPrivilege 3716 svchost.exe Token: SeDebugPrivilege 3716 svchost.exe Token: SeDebugPrivilege 4628 svchost.exe Token: SeDebugPrivilege 4628 svchost.exe - Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 3344 wrote to memory of 2392 3344 710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe 83 PID 3344 wrote to memory of 2392 3344 710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe 83 PID 3344 wrote to memory of 2392 3344 710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe 83 PID 3344 wrote to memory of 704 3344 710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe 88 PID 3344 wrote to memory of 704 3344 710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe 88 PID 3344 wrote to memory of 704 3344 710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe 88 PID 3344 wrote to memory of 4888 3344 710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe 91 PID 3344 wrote to memory of 4888 3344 710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe 91 PID 3344 wrote to memory of 4888 3344 710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe 91 PID 3344 wrote to memory of 4628 3344 710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe 94 PID 3344 wrote to memory of 4628 3344 710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe 94 PID 3344 wrote to memory of 4628 3344 710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe 94 PID 3344 wrote to memory of 4628 3344 710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe 94 PID 3344 wrote to memory of 4628 3344 710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe 94 PID 3464 wrote to memory of 2592 3464 cmd.exe 96 PID 3464 wrote to memory of 2592 3464 cmd.exe 96 PID 3464 wrote to memory of 2592 3464 cmd.exe 96 PID 2592 wrote to memory of 3716 2592 KVEIF.jpg 97 PID 2592 wrote to memory of 3716 2592 KVEIF.jpg 97 PID 2592 wrote to memory of 3716 2592 KVEIF.jpg 97 PID 2592 wrote to memory of 3716 2592 KVEIF.jpg 97 PID 2592 wrote to memory of 3716 2592 KVEIF.jpg 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe"C:\Users\Admin\AppData\Local\Temp\710c7e68a4c8e51e3222fdc89ab57dc2d3c802fe566649c799212f96f168a115.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe -EMBEDDING 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530425D474A422F565840 02⤵PID:2392
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe -EMBEDDING 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530425D474A422F565840 02⤵PID:704
-
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe -EMBEDDING 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530425D474A422F565840 02⤵PID:4888
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe -EMBEDDING 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530425D474A422F565840 02⤵
- Deletes itself
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4628
-
-
C:\Windows\system32\cmd.execmd.exe /c call "C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530425D474A422F5658401⤵
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg"C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530425D474A422F5658402⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe -sys 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304530425D474A422F565840 03⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3716
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\1D11D1C123.IMD
- Size 127KB
- SHA256 c4a33b0c9eea50ff7d8b5218779ff77830753be2bf94fd2562e41b0e43b9f78b
- MD5 4686f92946100b99e255c08c0f88ffe9
- SHA1 8f722bf499a7864b1eda3113fda35b22647ccdf4
- SHA512 890b4f097af07ccc39c31388d1d42813eb50fa700b50b45bf2101d32baa15cc4c8fdae023ce182fb5a1bf79a1dcc834ac8d8ffe74532670f58f37b4667102a1a
- SSDEEP 3072:sOfHfI0MnX4MsoonthNQIYK0WXN11M3DsAItXucz3BdWsFG0nS:jfHA0MnqTtbQIYUr1SsB3BdWsFpnS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\KVEIFss1.ini
- Size 22B
- SHA256 8485a6ec9ad79a1ed2331a428944711c4064f0c607017dae51c7e7f65fe70ff7
- MD5 2056c975629bc764596c2ba68ab3c6da
- SHA1 35e3da93ce68d24c687e8c972f8fa2b903be75b8
- SHA512 c4d4932e81956578e505ac454d964ccd1d7d123e8393d532db15ba42e456ceff8394baba021e8ae7ae2f9aef0e51840aecef12252cf9c6766e8b247eb08e86ae
- MD5 SHA1 SHA512
- Path C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11D1C\ok.txt
- Size 104B
- SHA256 df5c9ca83778cb559a128f8a3035fca7877979451ae17ff731c035c3c08d34eb
- MD5 313cdbd79dc6103ad6f2100e210c770f
- SHA1 7b8943d950ec12d514209a2aa607664594d2ac8f
- SHA512 d09f73414423d584f923226d76c332a11c9852dadce06c20f8fd1d57c95ee63d123181c323fca39783f1dfe6ab07e1cb9cbd713b09487bf5a6b54c1ad3a3b851
- MD5 SHA1 SHA512
- Path C:\Program Files\Common Files\Microsoft\1D11D1C\KVEIF.jpg
- Size 126KB
- SHA256 a8f8035cf9de06aff216514727c2ec318d31f451dda06de16892314b6d2f9467
- MD5 831c8d2dc8d4bb750057fa887029d34e
- SHA1 a1a3db7449aac12f689d87f558d25ff38481cbb6
- SHA512 33efdb552af882a15b18c2f733a53790e22f7f7c59e2b578b2e7307cd7a96a548769fdcd3520535410962a9a4e07e94868a6b02d84a87e86f32773c3160445cc
- SSDEEP 3072:dEboFVlGAvwsgbpvYfMTc72L10fPsout6S:iBzsgbpvnTcyOPsoS6S
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\MSInfo\1D11D1C\KVEIF.jpg
- Size 126KB
- SHA256 3ece0327f2828c012a41df6743c35ba5b620dddd846a8ca58baad341fdfe6460
- MD5 e47e8146284231d10faa58d793f6e749
- SHA1 a32931d3713afc21127327d780853760bcb98982
- SHA512 81827706e60a56019bd4163f6dabd4df93cdb24d3a352d4410afcc7cb41d80c8ed9c07849ac312058b2fde4ecb91eae57a2f431cf4fde8c894e973970f6f4a0f
- SSDEEP 3072:SEboFVlGAvwsgbpvYfMTc72L10fPsout6S:hBzsgbpvnTcyOPsoS6S
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\MSInfo\1D11D1C\KVEIFmain.ini
- Size 960B
- SHA256 97a8d9b95aa6cc4396e69464bb09067710b237fda709e9f9b27c45925c8a3206
- MD5 5825d97dca04d8df6be0636c7d0273ec
- SHA1 1a18bc794b843703589c4442d0ec981253d46e82
- SHA512 538fe999c77b510fb40c71a37edbe2c8dfbd08ef38bc91dcfefb3b7c63d97eaed3f349f440b6024f37b8fea9a0856c6eb263befae25a00f49c70885b7dcb0539
- MD5 SHA1 SHA512
- Path C:\Program Files\Common Files\microsoft shared\MSInfo\1D11D1C\KVEIFmain.ini
- Size 1KB
- SHA256 b2780d30169ac1bf794800d3fb749b8b2b62d3fe6bab62a2573210d9c16f4f81
- MD5 5c0202386781d34c5fae1a04424be739
- SHA1 e56319a12c0187e22b81fec2cb1c748d43cae59c
- SHA512 06e0ae12f0b53ba9b643a5cd4f3777523fc70ed4f6e315baa9ff490c38a81cd5b3c02ae2e1592938aec1be8153f5469f3b7a7eb0c2ec17f9d0c3e796844d9bc7
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\kernel64.dll
- Size 625KB
- SHA256 820c83c0533cfce2928e29edeaf6c255bc19ac9718b25a5656d99ffac30a03d6
- MD5 eccf28d7e5ccec24119b88edd160f8f4
- SHA1 98509587a3d37a20b56b50fd57f823a1691a034c
- SHA512 c1c94bbb781625b2317f0a8178d3a10d891fb71bca8f82cd831c484e8ab125301b82a14fe2ff070dc99a496cc00234300fa5536401018c40d49d44ae89409670
- SSDEEP 12288:jnBiMQ99uGlsU/9GVkIle38wsquxPLFNmb7uMkHHk4JlQ/Saho6:jBo99hlsUFGVkqeXsquxPLFNGTMk4JlI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Web\606C646364636479.tmp
- Size 108KB
- SHA256 1eacebb614305a9806113545be7b23cf14ce7e761ccf634510a7f1c0cfb6cd16
- MD5 f697e0c5c1d34f00d1700d6d549d4811
- SHA1 f50a99377a7419185fc269bb4d12954ca42b8589
- SHA512 d5f35672f208ebbe306beeb55dadde96aa330780e2ea84b45d3fa6af41369e357412d82978df74038f2d27dff4d06905fd0b4d852b0beef1bcfdd6a0849bc202
- SSDEEP 3072:exxIOrXQxPgdT+RuiZb8kVAvreL9e3e7vo/MaiNp3N6p:eLgyDzeL9eko/MV6p
- MD5 SHA1 SHA512 SSDEEP