Analysis
-
max time kernel
138s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
03/07/2024, 02:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe
Resource
win7-20240611-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe
-
Size
2.2MB
-
MD5
1fa3b9c4788f64b2c7db9974154ed3b8
-
SHA1
387ca10633c95177b25457602993a75910f71cc8
-
SHA256
c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe
-
SHA512
1c848f8aa6da4df2c2a508c2def77653b5cdad6982417ef39d6906081ad816f4b45635dc848be68d59e78a7e8c73e0b1bdd37d31851eb199753bf145c0cbb07d
-
SSDEEP
24576:Pe6u/p6D3RSinEBlDfHfnGVaUI6tvW1qMTyM4WE1X4swDOn0LKsdN3fK:POB6zYxf6h581qMWVWEGHmsfPK
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2316 sqlwm.exe 2512 srvurl.exe -
Loads dropped DLL 2 IoCs
pid Process 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 42 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe File opened (read-only) \??\T: c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe File opened (read-only) \??\M: c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe File opened (read-only) \??\L: c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe File opened (read-only) \??\J: c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe File opened (read-only) \??\Z: srvurl.exe File opened (read-only) \??\K: srvurl.exe File opened (read-only) \??\X: c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe File opened (read-only) \??\U: srvurl.exe File opened (read-only) \??\N: srvurl.exe File opened (read-only) \??\M: srvurl.exe File opened (read-only) \??\J: srvurl.exe File opened (read-only) \??\V: srvurl.exe File opened (read-only) \??\Y: c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe File opened (read-only) \??\K: c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe File opened (read-only) \??\E: c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe File opened (read-only) \??\U: c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe File opened (read-only) \??\N: c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe File opened (read-only) \??\R: srvurl.exe File opened (read-only) \??\P: c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe File opened (read-only) \??\R: c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe File opened (read-only) \??\Q: c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe File opened (read-only) \??\P: srvurl.exe File opened (read-only) \??\T: srvurl.exe File opened (read-only) \??\O: srvurl.exe File opened (read-only) \??\Z: c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe File opened (read-only) \??\I: srvurl.exe File opened (read-only) \??\G: srvurl.exe File opened (read-only) \??\Q: srvurl.exe File opened (read-only) \??\S: c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe File opened (read-only) \??\O: c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe File opened (read-only) \??\W: srvurl.exe File opened (read-only) \??\W: c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe File opened (read-only) \??\G: c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe File opened (read-only) \??\Y: srvurl.exe File opened (read-only) \??\H: srvurl.exe File opened (read-only) \??\L: srvurl.exe File opened (read-only) \??\H: c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe File opened (read-only) \??\X: srvurl.exe File opened (read-only) \??\E: srvurl.exe File opened (read-only) \??\S: srvurl.exe File opened (read-only) \??\V: c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe -
Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\dnswdm.scr c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe File created C:\Windows\SysWOW64\srvurl.exe c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat srvurl.exe File opened for modification C:\Windows\SysWOW64\libusb.exe c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe File created C:\Windows\SysWOW64\libusb.exe c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe File created C:\Windows\SysWOW64\sqlwm.exe c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe File opened for modification C:\Windows\SysWOW64\dnswdm.scr c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\Contacts\desktop.ini srvurl.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\Contacts srvurl.exe File opened for modification C:\Windows\SysWOW64\sqlwm.exe c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe File opened for modification C:\Windows\SysWOW64\lsahost.scr c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe File created C:\Windows\SysWOW64\lsahost.scr c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe File opened for modification C:\Windows\SysWOW64\srvurl.exe c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe -
Modifies Control Panel 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Control Panel\Desktop c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Control Panel\Desktop\ScreenSaveBackup c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\SysWOW64\\lsahost.scr" c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Control Panel\Desktop\ScreenSaveUtility = "C:\\Windows\\SysWOW64\\dnswdm.scr" c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Control Panel\Desktop\ScreenSaveTimeOut = "60" c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe -
Modifies data under HKEY_USERS 18 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced srvurl.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\WAB\NamedProps = 0420060000000000c00000000000004604000000000000800e0000000100330032003800350034000000000001800e0000000100330032003800350035000000000002800e0000000100330032003800350036000000000003800e0000000100330032003800350037000000813284c18505d011b29000aa003cf6760b000000000004800e0000000100330032003700360039000000000005800e0000000100330032003700370030000000000006800e0000000100330032003700370031000000000007800e0000000100330032003700370032000000000008800e0000000100330032003700370033000000000009800e000000010033003200370037003400000000000a800e000000010033003200370037003500000000000b800e000000010033003200370037003600000000000c800e000000010033003200370037003700000000000d800e000000010033003200370037003800000000000e800e0000000100330032003700370039000000 srvurl.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\WAB\NamedPropCount = "2" srvurl.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix srvurl.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" srvurl.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\EnableBalloonTips = "0" srvurl.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\WAB srvurl.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\WAB\NamedProps = 0420060000000000c00000000000004604000000000000800e0000000100330032003800350034000000000001800e0000000100330032003800350035000000000002800e0000000100330032003800350036000000000003800e0000000100330032003800350037000000 srvurl.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\WAB\NamedProps = 0420060000000000c00000000000004607000000000000800e0000000100330032003800350034000000000001800e0000000100330032003800350035000000000002800e0000000100330032003800350036000000000003800e000000010033003200380035003700000000000f800e0000000100330032003800310032000000000010800e0000000100330032003800310033000000000011800e0000000100330032003800310034000000813284c18505d011b29000aa003cf6760b000000000004800e0000000100330032003700360039000000000005800e0000000100330032003700370030000000000006800e0000000100330032003700370031000000000007800e0000000100330032003700370032000000000008800e0000000100330032003700370033000000000009800e000000010033003200370037003400000000000a800e000000010033003200370037003500000000000b800e000000010033003200370037003600000000000c800e000000010033003200370037003700000000000d800e000000010033003200370037003800000000000e800e0000000100330032003700370039000000 srvurl.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections srvurl.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\WAB\NamedPropCount = "1" srvurl.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\WAB\NamedProps = 0420060000000000c00000000000004608000000000000800e0000000100330032003800350034000000000001800e0000000100330032003800350035000000000002800e0000000100330032003800350036000000000003800e000000010033003200380035003700000000000f800e0000000100330032003800310032000000000010800e0000000100330032003800310033000000000011800e0000000100330032003800310034000000000012800e0000000100330032003800300032000000813284c18505d011b29000aa003cf6760b000000000004800e0000000100330032003700360039000000000005800e0000000100330032003700370030000000000006800e0000000100330032003700370031000000000007800e0000000100330032003700370032000000000008800e0000000100330032003700370033000000000009800e000000010033003200370037003400000000000a800e000000010033003200370037003500000000000b800e000000010033003200370037003600000000000c800e000000010033003200370037003700000000000d800e000000010033003200370037003800000000000e800e0000000100330032003700370039000000 srvurl.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" srvurl.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings srvurl.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 srvurl.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings srvurl.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" srvurl.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 srvurl.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Token: SeChangeNotifyPrivilege 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Token: SeBackupPrivilege 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Token: SeBackupPrivilege 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Token: SeBackupPrivilege 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Token: SeBackupPrivilege 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Token: SeBackupPrivilege 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Token: SeBackupPrivilege 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Token: SeBackupPrivilege 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Token: SeBackupPrivilege 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Token: SeBackupPrivilege 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Token: SeBackupPrivilege 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Token: SeBackupPrivilege 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Token: SeBackupPrivilege 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Token: SeBackupPrivilege 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Token: SeBackupPrivilege 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Token: SeBackupPrivilege 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Token: SeBackupPrivilege 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Token: SeBackupPrivilege 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Token: SeBackupPrivilege 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Token: SeBackupPrivilege 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Token: SeBackupPrivilege 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Token: SeBackupPrivilege 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Token: SeBackupPrivilege 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Token: SeBackupPrivilege 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Token: SeBackupPrivilege 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Token: SeBackupPrivilege 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Token: SeBackupPrivilege 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Token: SeBackupPrivilege 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Token: SeBackupPrivilege 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Token: SeBackupPrivilege 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Token: SeBackupPrivilege 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Token: SeBackupPrivilege 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Token: SeBackupPrivilege 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Token: SeBackupPrivilege 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Token: SeBackupPrivilege 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Token: SeBackupPrivilege 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Token: SeBackupPrivilege 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Token: SeBackupPrivilege 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Token: SeBackupPrivilege 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Token: SeBackupPrivilege 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Token: SeBackupPrivilege 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Token: SeBackupPrivilege 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Token: SeBackupPrivilege 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Token: SeBackupPrivilege 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe Token: SeDebugPrivilege 2512 srvurl.exe Token: SeChangeNotifyPrivilege 2512 srvurl.exe Token: SeBackupPrivilege 2512 srvurl.exe Token: SeBackupPrivilege 2512 srvurl.exe Token: SeBackupPrivilege 2512 srvurl.exe Token: SeBackupPrivilege 2512 srvurl.exe Token: SeBackupPrivilege 2512 srvurl.exe Token: SeBackupPrivilege 2512 srvurl.exe Token: SeBackupPrivilege 2512 srvurl.exe Token: SeBackupPrivilege 2512 srvurl.exe Token: SeBackupPrivilege 2512 srvurl.exe Token: SeBackupPrivilege 2512 srvurl.exe Token: SeBackupPrivilege 2512 srvurl.exe Token: SeBackupPrivilege 2512 srvurl.exe Token: SeBackupPrivilege 2512 srvurl.exe Token: SeBackupPrivilege 2512 srvurl.exe Token: SeBackupPrivilege 2512 srvurl.exe Token: SeBackupPrivilege 2512 srvurl.exe Token: SeBackupPrivilege 2512 srvurl.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 2512 srvurl.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1548 wrote to memory of 2316 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 28 PID 1548 wrote to memory of 2316 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 28 PID 1548 wrote to memory of 2316 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 28 PID 1548 wrote to memory of 2316 1548 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe 28 PID 2920 wrote to memory of 2512 2920 taskeng.exe 31 PID 2920 wrote to memory of 2512 2920 taskeng.exe 31 PID 2920 wrote to memory of 2512 2920 taskeng.exe 31 PID 2920 wrote to memory of 2512 2920 taskeng.exe 31 PID 2920 wrote to memory of 2512 2920 taskeng.exe 31 PID 2920 wrote to memory of 2512 2920 taskeng.exe 31 PID 2920 wrote to memory of 2512 2920 taskeng.exe 31 -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe"C:\Users\Admin\AppData\Local\Temp\c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe.exe"1⤵
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Enumerates connected drives
- Drops file in System32 directory
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
- outlook_win_path
PID:1548 -
C:\Windows\SysWOW64\sqlwm.exeC:\Windows\SysWOW64\sqlwm.exe /combine local system2⤵
- Executes dropped EXE
PID:2316
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {4321344B-ED11-41A8-9D22-49EA98EEB7A3} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\srvurl.exeC:\Windows\SysWOW64\srvurl.exe kfc2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:2512
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4B
MD559babb838a876914f6b5402512da3d41
SHA1eb72a9af96d374bc1d0045513ae1f4541060a7e5
SHA256443c07a2c83b7b0253a325d2b72ac757c3aa5b41cd749842bc74fb3ee9b26866
SHA5126c7f7fd694df9949b4716d009242b423216aa52e579414505406d6d3fcaa84fd8c9227e55eb80d28ba40068d80fd6f8be089f2b655ebc72872cd226236fa97ea
-
Filesize
2.0MB
MD5138ebcb924dfce3b4e96378195afc0f3
SHA193e98c5c7ddc503921212e50e6f22b89b25438bf
SHA2567639e64d04a05baadb4fcd5175d331e7427327fe1cbdfd46382e4c26a605fbd4
SHA51222567475478573388b3fd20efe4a79f891c41bd3d62e7eca11fa7c71d4b4abe9559cc2ca72796778f620aa28756e245eacf9058aa6af702addff68d96fd19e81
-
Filesize
2.2MB
MD51fa3b9c4788f64b2c7db9974154ed3b8
SHA1387ca10633c95177b25457602993a75910f71cc8
SHA256c5d93609759a7cce69b2bb09fbdc24f47622acf350984bae54cfb65d712ce3fe
SHA5121c848f8aa6da4df2c2a508c2def77653b5cdad6982417ef39d6906081ad816f4b45635dc848be68d59e78a7e8c73e0b1bdd37d31851eb199753bf145c0cbb07d