Overview
overview
10Static
static
7Mydoom/00b...f7.exe
windows10-2004-x64
1Mydoom/055...81.exe
windows10-2004-x64
Mydoom/0b7...c5.exe
windows10-2004-x64
8Mydoom/0d5...64.exe
windows10-2004-x64
10Mydoom/176...9c.exe
windows10-2004-x64
7Mydoom/1fe...81.exe
windows10-2004-x64
7Mydoom/233...98.exe
windows10-2004-x64
7Mydoom/252...03.exe
windows10-2004-x64
7Mydoom/2af...b2.exe
windows10-2004-x64
7Mydoom/3d9...64.exe
windows10-2004-x64
8Mydoom/3db...e5.exe
windows10-2004-x64
7Mydoom/493...dc.exe
windows10-2004-x64
7Mydoom/4d6...08.exe
windows10-2004-x64
7Mydoom/564...2a.exe
windows10-2004-x64
7Mydoom/6c3...4c.exe
windows10-2004-x64
7Mydoom/6c3...c3.exe
windows10-2004-x64
7Mydoom/771...20.exe
windows10-2004-x64
7Mydoom/7bc...61.exe
windows10-2004-x64
7Mydoom/8e9...88.exe
windows10-2004-x64
7Mydoom/9a7...60.exe
windows10-2004-x64
7Mydoom/9e0...f3.exe
windows10-2004-x64
7Mydoom/a9a...0f.exe
windows10-2004-x64
7Mydoom/b4a...95.exe
windows10-2004-x64
7Mydoom/c03...ef.exe
windows10-2004-x64
8Mydoom/c45...24.exe
windows10-2004-x64
7Mydoom/d42...06.exe
windows10-2004-x64
7Mydoom/d66...91.exe
windows10-2004-x64
7Mydoom/e16...36.exe
windows10-2004-x64
7Mydoom/e30...02.exe
windows10-2004-x64
7Mydoom/fe3...d5.exe
windows10-2004-x64
7Analysis
- max time kernel
529s - max time network
539s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
11/06/2024, 01:19
Behavioral task
behavioral1
Sample
Mydoom/00b9b6cf27deeda8de99d1719ef724808afa92080026df8dd17159be8ea420f7.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Mydoom/05500734fe07ac2b5bc89aa12b090203c4b74851cb0d62bd388f27ec6d6caa81.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Mydoom/0b75e2fadffc45dff940e58f5b6f8d99832426bb880f432f98d853308b29c9c5.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
Mydoom/0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Mydoom/1760c5727e5568d3b18a1cbf0d50c311613699af8233c96fb3eee197f438ce9c.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
Mydoom/1fe99fb7c527a90826896e695f23e712375358df3c7aa9163af6b96d872a9f81.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Mydoom/23361735678f37d77510b22306c727a987f84c87143bb0062f3d76413c36fc98.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
Mydoom/2522b83852588bc0f7f620f9b4fe3a9337b9608be335d3958d190275f333df03.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Mydoom/2af6bc16f25822d6d2f1429bc15f3d47f6c0bcb026ba387249d173fc753919b2.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
Mydoom/3d9f9c162e130c197301adb5a4e141f2e1ae8a19c85b457c429e8410a5c91464.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Mydoom/3db846a796caa001666df8f7cae709fff02f984711b0e70e0e79c457d631b4e5.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
Mydoom/493813116f32ad6f455676cd54e32a2167ece845038202614cbb49e126f5afdc.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Mydoom/4d61a61265cdd942cff973609170529eaf19579b5d17e64deccbd6f6f1fdfa08.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
Mydoom/5642f8bd3bc151349ded1a3c160c037c26194c9da2b7ace5d8ca11cddb57612a.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Mydoom/6c37d14d5ad674e4c0fa8df0a999be6b27399936c9ff16f7fb30b802addb7b4c.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
Mydoom/6c3c9af653a28977257ce971ed701b1b893cdf67d5c57baa44a9d76c28675dc3.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Mydoom/77186e57b2eeb3ed4b56cfe280d5eeea3155d9502217cda824600bc93d365320.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
Mydoom/7bca70a81cc9e1067e99e313802a4cc095f79bbc3a1aa86b7b3b9eabf3748e61.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Mydoom/8e934dcd46eb57d42712d097deab6ce00ef1ce2db87d03f8d3d8e8c10da7e088.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
Mydoom/9a75c8e353df060ec927ada5990402b57764275f2a860d9cf500a661ec3de060.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
Mydoom/9e067453f09c5cbfa4c5a74fe3e70d7d8e66a25057e6c35240dce5a40ec31bf3.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
Mydoom/a9a89ed0d139fbc436794f5d3a8e58c547247039d8c86767b1e2f2bce40e390f.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
Mydoom/b4ab8f5c8b97307b328ba30fdefdbe4341c4e2c576729fdb5c7329d5b07bb695.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
Mydoom/c03431309015563257e5e118656d07ce136f151339054b9f66894ecf9dde9aef.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
Mydoom/c45a330cf80c33977658649596d4867301e928381c5fc37ec3edabfad2251324.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
Mydoom/d42fc4dabd9a9e74156d1a856cb542ed2e0796d2d7c6b976c0ac5421a87f9806.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
Mydoom/d66f6565e97f43030ff6fba9c9550894aad05affb66efaf561ec229d80b0a691.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
Mydoom/e16d377c12b63acb694601b4bde36d61839054409e7fae1661fb051892d2ed36.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
Mydoom/e302f733d4a31342a0c908055a6e59b3fd8f1ed3ce98750d00251e4f0efe6c02.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
Mydoom/fe3b2cf08a6224a04194a6555b4593b0a7428cb1fe057c08776d09568fc58cd5.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
General
- Target Mydoom/0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
- Size 9.4MB
- Sample240611-bp1apaycle
- SHA256 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464
- MD5 813b749967045532f86e6442447bcd8b
- SHA1 8d0615e7f7ba672a3fc94c05a9451f9d08797af7
- SHA512 47c16f403ab33ebb9e59c7c3a053dc29d0d654174d2be9153966ad9fc873e641f34ab44c7e38fb4c6fd376b384d4e1da0dacafb384e9abb1c7eb92cb32533877
- SSDEEP 24576:GYx7SFGwWG8/Ad5kybgeK8uQY2ZqR7NlaDbTxnVhv2MMLdGIhJ:IFFbK8q2ZhDbTNv2MuV
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
resource yara_rule behavioral4/memory/1844-6-0x0000000000400000-0x0000000000538000-memory.dmp dcrat - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation wininit.exe - Executes dropped EXE 2 IoCs
pid Process 3008 wininit.exe 2176 wininit.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 25 IoCs
pid Process 2004 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 2004 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 2004 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 2004 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 2004 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 2004 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 2004 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 2004 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 2004 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 2004 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 2004 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 2004 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 2004 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 3008 wininit.exe 3008 wininit.exe 3008 wininit.exe 3008 wininit.exe 3008 wininit.exe 3008 wininit.exe 3008 wininit.exe 3008 wininit.exe 3008 wininit.exe 3008 wininit.exe 3008 wininit.exe 3008 wininit.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2004 set thread context of 1844 2004 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 94 PID 3008 set thread context of 2176 3008 wininit.exe 115 - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\diagnostics\scheduled\Maintenance\uk-UA\RuntimeBroker.exe 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe File created C:\Windows\Offline Web Pages\WmiPrvSE.exe 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe File opened for modification C:\Windows\Offline Web Pages\WmiPrvSE.exe 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe File created C:\Windows\Offline Web Pages\24dbde2999530ef5fd907494bc374d663924116c 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
pid pid_target Process procid_target 4460 2004 WerFault.exe 83 3052 3008 WerFault.exe 105 - Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3172 schtasks.exe 2772 schtasks.exe 4704 schtasks.exe - Delays execution with timeout.exe 6 IoCs
pid Process 4284 timeout.exe 3956 timeout.exe 4772 timeout.exe 836 timeout.exe 4940 timeout.exe 1464 timeout.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2004 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 2004 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 2004 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 1844 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 3008 wininit.exe 3008 wininit.exe 3008 wininit.exe 2176 wininit.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2004 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe Token: SeDebugPrivilege 1844 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe Token: SeDebugPrivilege 3008 wininit.exe Token: SeDebugPrivilege 2176 wininit.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2004 wrote to memory of 4416 2004 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 85 PID 2004 wrote to memory of 4416 2004 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 85 PID 2004 wrote to memory of 4416 2004 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 85 PID 4416 wrote to memory of 4772 4416 cmd.exe 87 PID 4416 wrote to memory of 4772 4416 cmd.exe 87 PID 4416 wrote to memory of 4772 4416 cmd.exe 87 PID 2004 wrote to memory of 4888 2004 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 88 PID 2004 wrote to memory of 4888 2004 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 88 PID 2004 wrote to memory of 4888 2004 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 88 PID 4888 wrote to memory of 836 4888 cmd.exe 90 PID 4888 wrote to memory of 836 4888 cmd.exe 90 PID 4888 wrote to memory of 836 4888 cmd.exe 90 PID 2004 wrote to memory of 1468 2004 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 91 PID 2004 wrote to memory of 1468 2004 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 91 PID 2004 wrote to memory of 1468 2004 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 91 PID 1468 wrote to memory of 4940 1468 cmd.exe 93 PID 1468 wrote to memory of 4940 1468 cmd.exe 93 PID 1468 wrote to memory of 4940 1468 cmd.exe 93 PID 2004 wrote to memory of 1844 2004 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 94 PID 2004 wrote to memory of 1844 2004 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 94 PID 2004 wrote to memory of 1844 2004 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 94 PID 2004 wrote to memory of 1844 2004 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 94 PID 2004 wrote to memory of 1844 2004 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 94 PID 2004 wrote to memory of 1844 2004 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 94 PID 2004 wrote to memory of 1844 2004 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 94 PID 2004 wrote to memory of 1844 2004 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 94 PID 2004 wrote to memory of 1844 2004 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 94 PID 1844 wrote to memory of 3172 1844 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 99 PID 1844 wrote to memory of 3172 1844 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 99 PID 1844 wrote to memory of 3172 1844 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 99 PID 1844 wrote to memory of 2772 1844 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 101 PID 1844 wrote to memory of 2772 1844 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 101 PID 1844 wrote to memory of 2772 1844 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 101 PID 1844 wrote to memory of 4704 1844 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 103 PID 1844 wrote to memory of 4704 1844 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 103 PID 1844 wrote to memory of 4704 1844 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 103 PID 1844 wrote to memory of 3008 1844 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 105 PID 1844 wrote to memory of 3008 1844 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 105 PID 1844 wrote to memory of 3008 1844 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 105 PID 3008 wrote to memory of 2092 3008 wininit.exe 106 PID 3008 wrote to memory of 2092 3008 wininit.exe 106 PID 3008 wrote to memory of 2092 3008 wininit.exe 106 PID 2092 wrote to memory of 1464 2092 cmd.exe 108 PID 2092 wrote to memory of 1464 2092 cmd.exe 108 PID 2092 wrote to memory of 1464 2092 cmd.exe 108 PID 3008 wrote to memory of 2128 3008 wininit.exe 109 PID 3008 wrote to memory of 2128 3008 wininit.exe 109 PID 3008 wrote to memory of 2128 3008 wininit.exe 109 PID 2128 wrote to memory of 4284 2128 cmd.exe 111 PID 2128 wrote to memory of 4284 2128 cmd.exe 111 PID 2128 wrote to memory of 4284 2128 cmd.exe 111 PID 3008 wrote to memory of 4952 3008 wininit.exe 112 PID 3008 wrote to memory of 4952 3008 wininit.exe 112 PID 3008 wrote to memory of 4952 3008 wininit.exe 112 PID 4952 wrote to memory of 3956 4952 cmd.exe 114 PID 4952 wrote to memory of 3956 4952 cmd.exe 114 PID 4952 wrote to memory of 3956 4952 cmd.exe 114 PID 3008 wrote to memory of 2176 3008 wininit.exe 115 PID 3008 wrote to memory of 2176 3008 wininit.exe 115 PID 3008 wrote to memory of 2176 3008 wininit.exe 115 PID 3008 wrote to memory of 2176 3008 wininit.exe 115 PID 3008 wrote to memory of 2176 3008 wininit.exe 115 PID 3008 wrote to memory of 2176 3008 wininit.exe 115 PID 3008 wrote to memory of 2176 3008 wininit.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\Mydoom\0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe"C:\Users\Admin\AppData\Local\Temp\Mydoom\0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe"1⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:4772
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:836
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:4940
-
-
-
C:\Users\Admin\AppData\Local\Temp\Mydoom\0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe"C:\Users\Admin\AppData\Local\Temp\Mydoom\0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\WmiPrvSE.exe'" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
PID:3172
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "sysmon" /sc ONLOGON /tr "'C:\ProgramData\USOShared\Logs\User\sysmon.exe'" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
PID:2772
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "wininit" /sc ONLOGON /tr "'C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\wininit.exe'" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
PID:4704
-
-
C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\wininit.exe"C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\wininit.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 14⤵
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\timeout.exetimeout 15⤵
- Delays execution with timeout.exe
PID:1464
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 14⤵
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\SysWOW64\timeout.exetimeout 15⤵
- Delays execution with timeout.exe
PID:4284
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 14⤵
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\SysWOW64\timeout.exetimeout 15⤵
- Delays execution with timeout.exe
PID:3956
-
-
-
C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\wininit.exe"C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\wininit.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2176
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 15324⤵
- Program crash
PID:3052
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 15042⤵
- Program crash
PID:4460
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2004 -ip 20041⤵PID:3580
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3008 -ip 30081⤵PID:5064
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\wininit.exe
- Size 9.4MB
- SHA256 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464
- MD5 813b749967045532f86e6442447bcd8b
- SHA1 8d0615e7f7ba672a3fc94c05a9451f9d08797af7
- SHA512 47c16f403ab33ebb9e59c7c3a053dc29d0d654174d2be9153966ad9fc873e641f34ab44c7e38fb4c6fd376b384d4e1da0dacafb384e9abb1c7eb92cb32533877
- SSDEEP 24576:GYx7SFGwWG8/Ad5kybgeK8uQY2ZqR7NlaDbTxnVhv2MMLdGIhJ:IFFbK8q2ZhDbTNv2MuV
- MD5 SHA1 SHA512 SSDEEP