Analysis
-
max time kernel
148s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 18:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0ea6d3a668fff9555b871918109bce14430a85aec0b81a9cb0de728af864287c.exe
Resource
win7-20240708-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
0ea6d3a668fff9555b871918109bce14430a85aec0b81a9cb0de728af864287c.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
0ea6d3a668fff9555b871918109bce14430a85aec0b81a9cb0de728af864287c.exe
-
Size
84KB
-
MD5
e16cf58ebf22132f7f2870fa2e17b94d
-
SHA1
270b60ea1c9d6f37e608f211b8bf11aa7ee9653a
-
SHA256
0ea6d3a668fff9555b871918109bce14430a85aec0b81a9cb0de728af864287c
-
SHA512
2baa51d5b2aa35207b89a893361e18c41d514905fe05dc3ebe86d12d1747ce3f9ad23d73810be1a99c5e6e3bb893f09c5cf99e98f78de2e05b8f42a914847dcd
-
SSDEEP
1536:1clIGFNMi+hJUneHoGTvvv4V9hqdhbtgS:+RMi+fUnCTvvv4V9hEhbCS
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 236 lsass.exe 2316 lsass.exe 2644 lsass.exe 2984 lsass.exe -
Loads dropped DLL 5 IoCs
pid Process 828 0ea6d3a668fff9555b871918109bce14430a85aec0b81a9cb0de728af864287c.exe 828 0ea6d3a668fff9555b871918109bce14430a85aec0b81a9cb0de728af864287c.exe 828 0ea6d3a668fff9555b871918109bce14430a85aec0b81a9cb0de728af864287c.exe 828 0ea6d3a668fff9555b871918109bce14430a85aec0b81a9cb0de728af864287c.exe 828 0ea6d3a668fff9555b871918109bce14430a85aec0b81a9cb0de728af864287c.exe -
resource yara_rule behavioral1/memory/828-173-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/828-181-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/828-171-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/828-274-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/828-387-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2316-383-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2316-541-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\Audio Driver = "C:\\Users\\Admin\\AppData\\Roaming\\system\\lsass.exe" reg.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2980 set thread context of 828 2980 0ea6d3a668fff9555b871918109bce14430a85aec0b81a9cb0de728af864287c.exe 31 PID 236 set thread context of 2316 236 lsass.exe 36 PID 236 set thread context of 2644 236 lsass.exe 37 PID 2644 set thread context of 2984 2644 lsass.exe 38 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6 lsass.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 0f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd lsass.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 19000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a92000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd lsass.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd lsass.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A lsass.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 lsass.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e709000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 lsass.exe -
Suspicious use of AdjustPrivilegeToken 61 IoCs
description pid Process Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe Token: SeDebugPrivilege 2316 lsass.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2980 0ea6d3a668fff9555b871918109bce14430a85aec0b81a9cb0de728af864287c.exe 828 0ea6d3a668fff9555b871918109bce14430a85aec0b81a9cb0de728af864287c.exe 236 lsass.exe 2316 lsass.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 2980 wrote to memory of 828 2980 0ea6d3a668fff9555b871918109bce14430a85aec0b81a9cb0de728af864287c.exe 31 PID 2980 wrote to memory of 828 2980 0ea6d3a668fff9555b871918109bce14430a85aec0b81a9cb0de728af864287c.exe 31 PID 2980 wrote to memory of 828 2980 0ea6d3a668fff9555b871918109bce14430a85aec0b81a9cb0de728af864287c.exe 31 PID 2980 wrote to memory of 828 2980 0ea6d3a668fff9555b871918109bce14430a85aec0b81a9cb0de728af864287c.exe 31 PID 2980 wrote to memory of 828 2980 0ea6d3a668fff9555b871918109bce14430a85aec0b81a9cb0de728af864287c.exe 31 PID 2980 wrote to memory of 828 2980 0ea6d3a668fff9555b871918109bce14430a85aec0b81a9cb0de728af864287c.exe 31 PID 2980 wrote to memory of 828 2980 0ea6d3a668fff9555b871918109bce14430a85aec0b81a9cb0de728af864287c.exe 31 PID 2980 wrote to memory of 828 2980 0ea6d3a668fff9555b871918109bce14430a85aec0b81a9cb0de728af864287c.exe 31 PID 828 wrote to memory of 568 828 0ea6d3a668fff9555b871918109bce14430a85aec0b81a9cb0de728af864287c.exe 32 PID 828 wrote to memory of 568 828 0ea6d3a668fff9555b871918109bce14430a85aec0b81a9cb0de728af864287c.exe 32 PID 828 wrote to memory of 568 828 0ea6d3a668fff9555b871918109bce14430a85aec0b81a9cb0de728af864287c.exe 32 PID 828 wrote to memory of 568 828 0ea6d3a668fff9555b871918109bce14430a85aec0b81a9cb0de728af864287c.exe 32 PID 568 wrote to memory of 1692 568 cmd.exe 34 PID 568 wrote to memory of 1692 568 cmd.exe 34 PID 568 wrote to memory of 1692 568 cmd.exe 34 PID 568 wrote to memory of 1692 568 cmd.exe 34 PID 828 wrote to memory of 236 828 0ea6d3a668fff9555b871918109bce14430a85aec0b81a9cb0de728af864287c.exe 35 PID 828 wrote to memory of 236 828 0ea6d3a668fff9555b871918109bce14430a85aec0b81a9cb0de728af864287c.exe 35 PID 828 wrote to memory of 236 828 0ea6d3a668fff9555b871918109bce14430a85aec0b81a9cb0de728af864287c.exe 35 PID 828 wrote to memory of 236 828 0ea6d3a668fff9555b871918109bce14430a85aec0b81a9cb0de728af864287c.exe 35 PID 236 wrote to memory of 2316 236 lsass.exe 36 PID 236 wrote to memory of 2316 236 lsass.exe 36 PID 236 wrote to memory of 2316 236 lsass.exe 36 PID 236 wrote to memory of 2316 236 lsass.exe 36 PID 236 wrote to memory of 2316 236 lsass.exe 36 PID 236 wrote to memory of 2316 236 lsass.exe 36 PID 236 wrote to memory of 2316 236 lsass.exe 36 PID 236 wrote to memory of 2316 236 lsass.exe 36 PID 236 wrote to memory of 2644 236 lsass.exe 37 PID 236 wrote to memory of 2644 236 lsass.exe 37 PID 236 wrote to memory of 2644 236 lsass.exe 37 PID 236 wrote to memory of 2644 236 lsass.exe 37 PID 236 wrote to memory of 2644 236 lsass.exe 37 PID 236 wrote to memory of 2644 236 lsass.exe 37 PID 236 wrote to memory of 2644 236 lsass.exe 37 PID 236 wrote to memory of 2644 236 lsass.exe 37 PID 2644 wrote to memory of 2984 2644 lsass.exe 38 PID 2644 wrote to memory of 2984 2644 lsass.exe 38 PID 2644 wrote to memory of 2984 2644 lsass.exe 38 PID 2644 wrote to memory of 2984 2644 lsass.exe 38 PID 2644 wrote to memory of 2984 2644 lsass.exe 38 PID 2644 wrote to memory of 2984 2644 lsass.exe 38 PID 2644 wrote to memory of 2984 2644 lsass.exe 38 PID 2644 wrote to memory of 2984 2644 lsass.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ea6d3a668fff9555b871918109bce14430a85aec0b81a9cb0de728af864287c.exe"C:\Users\Admin\AppData\Local\Temp\0ea6d3a668fff9555b871918109bce14430a85aec0b81a9cb0de728af864287c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\0ea6d3a668fff9555b871918109bce14430a85aec0b81a9cb0de728af864287c.exe"C:\Users\Admin\AppData\Local\Temp\0ea6d3a668fff9555b871918109bce14430a85aec0b81a9cb0de728af864287c.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\WWJLG.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Audio Driver" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\system\lsass.exe" /f4⤵
- Adds Run key to start application
PID:1692
-
-
-
C:\Users\Admin\AppData\Roaming\system\lsass.exe"C:\Users\Admin\AppData\Roaming\system\lsass.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Users\Admin\AppData\Roaming\system\lsass.exe"C:\Users\Admin\AppData\Roaming\system\lsass.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2316
-
-
C:\Users\Admin\AppData\Roaming\system\lsass.exe"C:\Users\Admin\AppData\Roaming\system\lsass.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Roaming\system\lsass.exe"C:\Users\Admin\AppData\Roaming\system\lsass.exe"5⤵
- Executes dropped EXE
- Modifies system certificate store
PID:2984
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dabf45c8b78905e365601097448040a6
SHA16d65e134b6d9009d999915d409d6d8b09d0a3c40
SHA25647252f869edc69bf85cccbc6cfa8cd0de62ae477e6988c1cd6fbf6f55a8e61ce
SHA512f03b7405627bde767db26f6e5cc33ea8c6ea54fd00dd49ce90a316cda2db97928e7b9a95e873c846a20c46ee7fca6452aa5b1d1588d2772790d649e06a93ba9a
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
146B
MD5c8cba0a9d4d5600b5f53c4c0681d1115
SHA10e5348e210ca70b2b0ffdc3ff7e6f611716df80c
SHA256ca2b63f6d7bf17480415ae93e115bf9f9699335e84e62719eefdbcc5a78bd2e1
SHA512a2ad6eb5ae2f6d57ca15363ac2f0c57ca3580474e94b9c010750948814cf4d5ffa0c3e7ef44634a3593da23f56011703ff220a3d7780f6f01785bf3b6676ced0
-
Filesize
84KB
MD5f663e51b658769fb6489ca9d455b9ed7
SHA1b52ca2a568a00d9540478ccadab07fa3d7f67110
SHA2565245ee5afee537e849c3903da87c2221faca8d6f3c04c649a71f29d917a8bfcb
SHA512c7b1509be4371038f431acc39cd3c9b6c0391cec8f7187f3fb44e49bfddf70a2953dfe635aa49f2dd63f51c75c46fd97156b3771d94e80c1a3794ef9a141f158