Analysis
-
max time kernel
119s -
max time network
62s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
15/07/2024, 03:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7439f917bf00ed90ab211bc16c1bdc10N.exe
Resource
win7-20240708-en
windows7-x64
5 signatures
120 seconds
Behavioral task
behavioral2
Sample
7439f917bf00ed90ab211bc16c1bdc10N.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
4 signatures
120 seconds
General
-
Target
7439f917bf00ed90ab211bc16c1bdc10N.exe
-
Size
72KB
-
MD5
7439f917bf00ed90ab211bc16c1bdc10
-
SHA1
93684755176d96d5380812c28af5a70e675847b0
-
SHA256
7d1c06eee27aa3696fb1a8d064f8ac931f7f8296484b70da737dc333aa53db64
-
SHA512
a70deeec42ed1cf2377e4f40c3e784ff75ab4e89542946374fdc3765babee9f0ddf92f61eafa6a06ec1888c5c14d3967daba0dbee3b492e4dc022f82fbfd3277
-
SSDEEP
1536:Ay2wpOqmXZ879wlQd0pBbgUuQF8uHBx7ghY4Mmw0n:N2oIZ879wlQd0pyihFkdwy
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts 7439f917bf00ed90ab211bc16c1bdc10N.exe -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification D:\autorun.inf cmd.exe File created \??\E:\autorun.inf cmd.exe File opened for modification \??\E:\autorun.inf cmd.exe File created D:\autorun.inf cmd.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 7439f917bf00ed90ab211bc16c1bdc10N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 7439f917bf00ed90ab211bc16c1bdc10N.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde 7439f917bf00ed90ab211bc16c1bdc10N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 7439f917bf00ed90ab211bc16c1bdc10N.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 7439f917bf00ed90ab211bc16c1bdc10N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 7439f917bf00ed90ab211bc16c1bdc10N.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 7439f917bf00ed90ab211bc16c1bdc10N.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 7439f917bf00ed90ab211bc16c1bdc10N.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2956 wrote to memory of 1184 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 33 PID 2956 wrote to memory of 1184 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 33 PID 2956 wrote to memory of 1184 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 33 PID 2956 wrote to memory of 1184 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 33 PID 2956 wrote to memory of 2028 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 34 PID 2956 wrote to memory of 2028 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 34 PID 2956 wrote to memory of 2028 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 34 PID 2956 wrote to memory of 2028 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 34 PID 2956 wrote to memory of 1684 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 35 PID 2956 wrote to memory of 1684 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 35 PID 2956 wrote to memory of 1684 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 35 PID 2956 wrote to memory of 1684 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 35 PID 2956 wrote to memory of 788 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 36 PID 2956 wrote to memory of 788 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 36 PID 2956 wrote to memory of 788 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 36 PID 2956 wrote to memory of 788 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 36 PID 2956 wrote to memory of 2324 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 37 PID 2956 wrote to memory of 2324 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 37 PID 2956 wrote to memory of 2324 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 37 PID 2956 wrote to memory of 2324 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 37 PID 2956 wrote to memory of 1920 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 38 PID 2956 wrote to memory of 1920 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 38 PID 2956 wrote to memory of 1920 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 38 PID 2956 wrote to memory of 1920 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 38 PID 2956 wrote to memory of 1264 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 39 PID 2956 wrote to memory of 1264 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 39 PID 2956 wrote to memory of 1264 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 39 PID 2956 wrote to memory of 1264 2956 7439f917bf00ed90ab211bc16c1bdc10N.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\7439f917bf00ed90ab211bc16c1bdc10N.exe"C:\Users\Admin\AppData\Local\Temp\7439f917bf00ed90ab211bc16c1bdc10N.exe"1⤵
- Drops file in Drivers directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c copy /v /y "C:\Users\Admin\AppData\Local\Temp\7439f917bf00ed90ab211bc16c1bdc10N.exe" "C:\Users\Admin\AppData\Local\Temp\bin.exe"2⤵PID:1184
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c copy /v /y "C:\Users\Admin\AppData\Local\Temp\7439f917bf00ed90ab211bc16c1bdc10N.exe" D:\bin.exe2⤵PID:2028
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo [autorun] > D:\autorun.inf2⤵
- Drops autorun.inf file
PID:1684
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo open=bin.exe >> D:\autorun.inf2⤵
- Drops autorun.inf file
PID:788
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c copy /v /y "C:\Users\Admin\AppData\Local\Temp\7439f917bf00ed90ab211bc16c1bdc10N.exe" E:\bin.exe2⤵PID:2324
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo [autorun] > E:\autorun.inf2⤵
- Drops autorun.inf file
PID:1920
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo open=bin.exe >> E:\autorun.inf2⤵
- Drops autorun.inf file
PID:1264
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed77df28f19a260efff52829074ede07
SHA1723cc1ce69aa814cd9c79a1b13b4e839e80acf5c
SHA256ce099af2ef299aa02def5aa769f1e966034f141a7024ce332c86cbbc703fabfc
SHA51298033db83b53b1c40185c3fe0b0e39d3371fa8445313eb3876886aea03e380d8ba74eeb20fd23514db40e7782c9dfae5da80721cda813c5c56c48b15804ad537
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
72KB
MD57439f917bf00ed90ab211bc16c1bdc10
SHA193684755176d96d5380812c28af5a70e675847b0
SHA2567d1c06eee27aa3696fb1a8d064f8ac931f7f8296484b70da737dc333aa53db64
SHA512a70deeec42ed1cf2377e4f40c3e784ff75ab4e89542946374fdc3765babee9f0ddf92f61eafa6a06ec1888c5c14d3967daba0dbee3b492e4dc022f82fbfd3277
-
Filesize
72KB
MD5df4458c335f64d79df93c5f848fe8acc
SHA1fdb4dd5053991e5ff5ab40fab96770a63c8de283
SHA256c1324a5666a485f3a408d048879ae2f4b5bdce48da6178795186d8c0e859c9b0
SHA5123068fa726e89b47b9d4f635b13554892ac68c8dd4c05d704578373c731dd251f1f50e6ccf74eb6e5a94bc139d7cc2694afac00cd5fc7b81bbb7b4ff1aa7f6b30